Key takeaways
- Most small businesses cannot patch PHP2Shell themselves. The person who runs the server can, so the job today is asking the right question and keeping the answer.
- Ask for three things: the exact PHP version or vendor build, confirmation that it fixes CVE-2026-109618 and CVE-2026-109619, and the date it was installed, for every site and subdomain.
- Four ready emails below: one for your host, one for your web designer, one for a developer who manages your server, and one web designers can send to their clients.
The short answer
Send your web host, or whoever manages your website, one short email today asking them to confirm in writing that the PHP serving each of your sites includes the fix for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), which PHP released on October 21, 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Ask for the version or build, the install date, and a plan if any site is on PHP 8.1 or older. Copy the email that matches your setup below.
The vague question "are we affected?" usually gets a vague answer. A specific question with CVE numbers gets a specific one, and gives you a record if anything goes wrong later.
Who to ask
| Your setup | Who patches PHP | Who you email |
|---|---|---|
| Fully hosted builder, no hosting account of your own | The platform | Nobody; watch the platform's status page |
| Shared hosting with cPanel or a similar panel | The host | Host support (template 1) |
| Managed WordPress hosting | The host | Host support (template 1) |
| A web designer set it up and you pay them for care | Usually the host, checked by the designer | Your web designer (template 2) |
| Your own server or VPS, run by a developer | Your developer | Your developer (template 3) |
Not sure which one you are? Look at who bills you every month or year for hosting. If only a website builder bills you, you are in the first row.
Template 1: email to your web host
Subject: PHP2Shell (CVE-2026-109618, CVE-2026-109619) patch status for my account
Hello, I am writing about the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 that PHP fixed on October 21, 2026. For each domain and subdomain on my account (mapleleafbakery.ca, shop.mapleleafbakery.ca and staging.mapleleafbakery.ca), please confirm: 1) the exact PHP version or vendor build serving the site, 2) that this build includes the fix for both CVEs, and 3) the date and time it was installed. If any of my sites run PHP 8.1 or older, please tell me whether a backported fix is in place and what you recommend for upgrading. Thank you, Sam, Maple Leaf Bakery
List every domain yourself. Hosts answer the question asked, and a staging copy you forgot is still a way in.
Template 2: email to your web designer
Subject: Is our website patched for PHP2Shell?
Hi Priya, I have been reading about the PHP vulnerabilities fixed on October 21 (CVE-2026-109618 and CVE-2026-109619). Could you confirm which host our site is on, the PHP version it runs, and whether the host has installed the fix? If you are not sure, could you check with them today and send me their reply? Please also check the old landing page domain we used for last year's promotion. If anything needs upgrading or the site should go offline for a short time, let me know what you suggest and the cost before you start. Thanks, Sam
The line about cost matters. It keeps an urgent fix from turning into a surprise invoice, and it gives your designer permission to act quickly.
Template 3: message to a developer who manages your server
Subject: Urgent: install PHP security release on our server today
Hi Marc, PHP released emergency fixes on October 21 for CVE-2026-109618 and CVE-2026-109619 (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35). Please install the patched PHP on our server today, restart all PHP workers, and send me a short note with the version installed and the time it was done. If you cannot patch today, please tell me what interim settings or firewall rules you are putting in place from PHP's advisory, and whether you think we should take the site offline until the patch is in. Please also check the server for unexpected files, accounts or scheduled tasks since October 20. Thanks, Sam
Restarting the PHP workers is not a detail. PHP's advisory says settings and patches only take effect for workers that have been restarted.
Template 4: for web designers, a note to your clients
Subject: Your website and this week's PHP security issue
Hi Daniel, you may have seen news about a serious security flaw in PHP, the software behind WordPress and many other websites. PHP released a fix on October 21. I have checked your site: your host confirmed on October 21 that your server runs PHP 8.3.36, which includes the fix. You do not need to do anything. I will keep an eye on further news and let you know if anything changes. If you see anything unusual on the site, such as strange pages, redirects or new user accounts, reply to this email straight away. Best, Priya
Send this only after you have the host's confirmation in hand. If you do not have it yet, say when you expect it instead of reassuring the client early.
How to read the reply
Good reply: names a version that matches PHP's fixed releases (8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer), or names a vendor build with the fix, and gives a date. Save it in a folder with your hosting records.
Reply that needs a follow up:
- It mentions WordPress updates but not PHP. WordPress updates do not change PHP.
- It says "we are monitoring" without a date.
- It covers one domain when you listed three.
- It confirms PHP 8.1 or older without mentioning a backported fix for these two CVEs.
Reply once, quoting your original three questions. Our guide on how to check your PHP version shows how to read the numbers yourself, and if no clear answer comes, see how to take a site offline without hurting your Google ranking.
If you use a hosted website builder
With a fully hosted builder, the platform runs and patches its own servers, and you cannot change or install PHP. There is nothing to ask for in writing. Check the platform's status page or announcements, and keep doing the usual account basics: a strong password and two step sign in for everyone with access. We did not find public statements about PHP2Shell from the major builders on October 21, 2026, so we are not saying either way whether their systems were affected.
Our take
Owner on shared or managed hosting: template 1, today, with every domain listed. Some hosts, InMotion Hosting among them, have published what they changed on their servers; your email gets you the answer for your own account.
Owner who pays a web designer: template 2. You are paying for someone to watch this, so let them do the chasing, but ask for the host's actual reply, not a summary.
Owner with a developer and a server: template 3, and expect a same day answer. If you cannot reach your developer by the end of the day, contact your cloud provider's support about isolating the server.
Web designer: confirm first, then send template 4. A short, factual note now saves you a dozen worried emails later this week.
Frequently asked questions
What should I ask my web host about PHP2Shell?
Ask for the exact PHP version or vendor build serving each of your sites, confirmation that it fixes CVE-2026-109618 and CVE-2026-109619, and the date it was installed. If you are on PHP 8.1 or older, ask about backported fixes and an upgrade plan.
Who is responsible for patching PHP on my website?
Whoever runs the server. On shared and managed hosting that is the host. On your own server or VPS it is you or your developer. On a fully hosted builder it is the platform.
Can I patch PHP2Shell myself on shared hosting?
No. On shared hosting the PHP engine is installed by the host. You can often choose between versions in your control panel, but the patched builds themselves come from the host.
Should my web designer charge to fix this?
It depends on your agreement. A version check is usually quick. An upgrade from an old PHP version that needs testing and plugin fixes can take real work, so ask for the cost before work starts.
