Security Notice: Critical PHP Vulnerability “PHP2Shell” — Check Your Server’s PHP Version Now

Dear SeekLab Clients,

On October 20, details of two critical remote code execution vulnerabilities in PHP (dubbed PHP2Shell, CVE-2026-109618 / CVE-2026-109619) were leaked ahead of disclosure. The PHP project released emergency fixes on October 21 at 14:00 UTC.

Many of our clients run their websites on PHP-based platforms such as WordPress and WooCommerce. These flaws are in the PHP runtime itself, so updating WordPress, themes or plugins will not fix them. You must upgrade PHP on your server. Please check your environment as soon as possible.

1. How serious is it?

• Remote server takeover without logging in: An attacker needs no account. A specially crafted request may be enough to run arbitrary code on your server, letting them alter pages, inject spam links or malicious redirects, or steal your database.
• Near-maximum severity: Rated 9.2 on CVSS v4.0 and 9.8 out of 10 by the US NVD.
• Very wide impact: Nearly every PHP version since 5.4 is affected. Servers running Apache with mod_php face the highest risk.
• Attacks have already started: Cloudflare, watchTowr and other security firms have observed exploitation attempts. US CISA and the UK NCSC have both issued alerts.

Why it matters for SEO: A compromised site typically ends up with injected spam links, hidden redirects or malicious code. Search engines may then show a "This site may be hacked" warning, demote the site, or remove it from the index. Rankings and traffic built up over years can drop sharply within a short time.

2. Check your PHP version

How to check:

# On the server
php -v
php-fpm -v

# Docker deployments: check inside the container
docker exec <container-name> php -v

Notes:

• The version shown by php -v on the command line may differ from the one your website actually uses. Also confirm the PHP-FPM or Apache module version.
• Docker users: Update your base image to a tag that includes the fix, rebuild and redeploy. Make sure any third-party images are updated as well.
• Ubuntu / Debian / RHEL and other distributions: Distribution patch versions are numbered differently from upstream PHP. Follow your distribution's security advisory and update through the system package manager.
• Shared hosting / managed WordPress users: Contact your hosting provider and get written confirmation that the PHP build your site runs includes this fix. VPS and cloud server users usually need to upgrade PHP themselves.
• After upgrading, restart PHP-FPM or your web server, then confirm the version again.

3. Temporary mitigations if you cannot upgrade yet

These steps only reduce risk. Upgrading PHP is the only complete fix.

1. Set session.upload_progress.enabled = 0 in php.ini, then restart all PHP processes.
2. Enable WAF protection. For example, Cloudflare has deployed protective rules for these flaws by default. Paid plan users should confirm the rules are set to "Block".
3. Limit request body size (e.g. post_max_size) and restrict upload requests at the web server or proxy layer.

4. How to tell if you have been compromised

Review your server logs from October 20 onward, paying attention to:

• PHP or web server processes launching shells or tools such as curl or wget;
• Unusual file upload requests followed by out-of-memory errors or repeated HTTP 500 errors;
• Unfamiliar pages, links or redirects on your site, or security issue alerts in Google Search Console.

Please complete these checks and upgrades as soon as possible to protect both your website's security and its search rankings.

The SeekLab Team
October 22, 2026