All Stone Tech Logo
All Stone Tech

Update your WordPress, Joomla or Drupal site today.

PHP2Shell is a pair of critical flaws in PHP, the language those platforms run on. An attacker can take over an unpatched server without logging in. Exploit code is public and attack attempts have started.

Here is what to do, and who to call if you can't do it yourself.

Get help with my siteSee the steps

Last updated · CVE-2026-109618, CVE-2026-109619

What to do today

  1. Updating WordPress, plugins or themes does not fix this.

    The flaw is in PHP, the language running on your server. WordPress, Joomla and Drupal all run on it. The fix has to happen on the server.

  2. Check which PHP version your site runs.

    In WordPress, go to Tools → Site Health → Info → Server. Your hosting company's dashboard usually shows it too.

  3. Make sure it is a patched release.

    You need 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer on your branch. Anything older than 8.2 no longer gets official fixes and needs a real upgrade, not a patch.

  4. Not sure? Ask your host directly.

    Log in to your hosting company's site yourself and ask them. Don't click "update now" links in emails this week: scammers are sending lookalike alerts. Many managed hosts have already patched.

  5. After patching, change your passwords and keys.

    This flaw can expose passwords and API keys held in server memory. Once you are patched, change admin passwords and rotate any keys the site uses.

Can't do it yourself? We'll handle it.

Tell us what you have and what you need. Any of these is a good reason to reach out:

  • You don't know how, or don't have time.
  • You can't find, or can't reach, whoever built your site.
  • You're ready to stop patching every few years and move off the platform for good.

We patch first, then talk about anything else. We will never ask for your passwords by email.

What is your site built on?
What do you need?

We reply within one business day.

Why this should be your last time

Every few years a flaw like this puts millions of sites at risk overnight, and their owners find out from the news. Traditional platforms leave you carrying the risk of running a server without owning the code on it.

Every All Stone Tech client was already off PHP-based platforms, so none of them had anything to patch this week. A deeper look at what to do long term is coming soon. Tick the box on the form above and we'll send it to you.

Vibe-coded sites aren't safer. Managed ones are. All Stone Tech builds your site with you and keeps it patched.