PHP security
Make your site static, and PHP2Shell hits nothing.
PHP2Shell lets anyone on the internet run code on a server whose PHP isn't up to date, no login needed, whether the site on it is WordPress, Joomla, Drupal or TYPO3. MakeStatic turns your site into a static one that works just like it: same pages, your own domain, search and contact forms included. No PHP runs for your visitors, so your public site gives PHP2Shell nothing to attack. No plugin, nothing to install: all we need is the address.
Your whole site, on your own domain.
Free while we're in beta. No credit card.
Test it on one of your pages
About twenty seconds, no account. You see your page and the copy side by side and click through it yourself.
A copy that works like your site
A plain HTML export saves each page with the files it links to. Anything a page loads only after it opens, like images that appear as you scroll, a menu that fills in, content a script fetches or a link that redirects, often goes missing. And you hear about it from a visitor.
A MakeStatic copy works like your site, it doesn't just look like it. You test it yourself, side by side with your site, before deciding anything. And if a page of the copy ever behaves differently from yours, write to [email protected] and we'll fix it.
- Images that load as you scroll, in every size your site has for phones and big screens.
- Fonts, icons and everything your theme or page builder brings along.
- Content a script loads after the page opens, and menus that fill in on hover.
- Links that redirect to another address still redirect.
- Videos that play and let you skip ahead.
- Contact forms that deliver and a search box that answers.
Why a static site is out of reach
The attack is a request that PHP processes. It works on any address where PHP answers what a visitor sends, whatever the site built on it does, and on some servers before the site's own code, and so its login, has run.
A static copy answers every visitor with files. No PHP runs for them: search runs in the visitor's browser, contact forms reach us, and an address the copy doesn't have just isn't found. There is no PHP behind the public address to send the attack to.
Your site, static, in three steps
- Enter your site's address. That's all we need: no plugin, no password to hand over.
- MakeStatic copies the whole site into a static one that works like it: pages, images, fonts, search and contact forms.
- Connect your domain, and your visitors get the static site at your own address. You keep editing where you always have; when you publish, the copy follows.
What PHP2Shell is
Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, with one cause. When PHP cuts a request short, for instance because it ran out of memory, it can leave behind data that is only half set up or already freed. A request an attacker sends can make PHP use that data, and end in code running on the server. The PHP project rates both 9.2 out of 10; the earliest affected code dates back to PHP 5.4, released in 2012.
Every PHP that answers web requests is affected, however the server runs it: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed. The PHP project rates the risk highest for Apache with mod_php, where a request from someone without an account works before any code of the site has run. The researchers showed it working against WordPress, Drupal, Joomla, Magento and others.
The flaws became public before the fix was out, and Cloudflare saw attacks on its customers. The PHP project says no setting protects completely: updating is the only safe choice.
Which versions, and what fixes them
- PHP 8.2 to 8.5: fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released on 21 October 2026.
- PHP 7.4, 8.0 and 8.1 no longer get releases from the PHP project. It published fixes for them as source code; whether your host or your distribution installs them is up to them.
- PHP 5.4 to 7.3 are affected and get no fix. The way out is a supported version.
And the system you edit in?
The system you edit in still runs on PHP. It stays online at its own address, and until its PHP is updated, PHP2Shell works there like anywhere else. Its login doesn't protect it, because the flaw sits in PHP, beneath WordPress or Joomla. Update its PHP, or ask your host to.
What the copy changes is that your public site doesn't depend on it. Nothing from the editing installation reaches your visitors until you publish, and every publish lists the pages it changed. So you'll see a page that changed without you before your visitors do.
An old site on PHP 7? Switch PHP off.
Many finished sites still run on PHP 7 or 8.1, which the PHP project no longer ships fixes for. If nobody edits such a site any more, a copy keeps every page online at its address, and the old PHP can be switched off for good.
If your site runs on PHP
- Check which PHP version it runs; your host's control panel shows it. 8.2.35, 8.3.36, 8.4.27, 8.5.12 and everything after them are fixed.
- Update it. A changed setting doesn't close the flaw, the PHP project says, and Cloudflare advises the update even behind its firewall rules.
- Check the server for signs of a break-in even once it's updated: it can have been taken over before the fix was out.
- If it was, clean it up first. A copy shows what the site shows, including whatever was planted in its pages.
- Then make it static, so the next flaw in PHP doesn't reach your visitors either.
Sources
The PHP project's security announcement of 21 October 2026 on php.net; its advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp on GitHub; the research notes by Calif and Wiz; Cloudflare's report on the attacks it blocked. Checked on 22 October 2026.
Frequently asked questions
- Does PHP2Shell need a login?
- No. The PHP project says both flaws work without any account, and on Apache with mod_php a single request works before the site's own code, and so its login, has run.
- My site runs WordPress. Is it affected?
- Yes, if its server runs a PHP without the fix. WordPress, Joomla, Drupal and TYPO3 are written in PHP, and the flaw is in PHP, not in them. Updating WordPress doesn't fix it; updating PHP does.
- Do I have to give up WordPress to get a static site?
- No. You keep editing in WordPress, Joomla or whatever your site runs on, just as you do today. When you publish, your visitors get a static copy that works like the site: search runs in their browser, and contact forms still reach you.
Free while we're in beta
MakeStatic is new, and while it's in beta you get all of it for free: your whole site, on your own domain. No credit card, no commitment.
At some point it will cost something. When there's a price, you'll see it before anything about your site changes.