On October 21, 2026, the NSA told every organization running PHP to patch two critical flaws immediately, or take their sites offline until they could. PHP runs roughly 70% of the websites on the internet, WordPress included. The flaws, CVE-2026-109618 and CVE-2026-109619, are being called PHP2Shell. They let an attacker run code on a server without logging in.
Most of the coverage stopped at “patch now.” That is good advice, but it is only half the job. A patch closes the door. It does not tell you whether anyone walked through it before it closed.
We host twelve sites on one account, so this was not a theory for us. This is exactly what we did, in the order we did it, and why the order matters.
First, Know What You Are Actually Dealing With
The flaws were not found on October 20, the day the news broke. A researcher at the security firm Calif reported the first one to the PHP team on August 11, and OpenAI and Wiz reported related findings over the following weeks. Part of the underlying bug had even been noticed in a 2024 code audit and set aside, because nobody could prove it was exploitable.
So the PHP team and a small group of vendors had about ten weeks of quiet time to build a fix. That is normal. It is called coordinated disclosure, and it exists so a hole in most of the web is not announced before a patch is ready. Then the secret leaked on October 20, two days early, and the patch was rushed out on October 21.
Here is the date that matters to a site owner: Amazon’s threat team saw an exploitation attempt on October 17, four days before the patch existed. If you are checking your own site, your window starts on October 17, not on the day you read the headline.
Step One: Pull the Logs Before Anything Else
Our first move was not to call the host and not to start changing settings. We pulled the server logs for every site on the account, every domain and subdomain, including the small ones nobody visits. Forgotten sites are exactly where trouble lands.
Logs come first because they are the only record you have of what actually reached your server. Everything else is somebody’s word. Your host can tell you they patched. A plugin can tell you it is protecting you. The access log simply records who asked for what, and what your server answered. If you have never opened one, our guide to reading server access logs walks through what each line means.
Order matters here for another reason. Once you start making changes, you are writing new entries on top of the evidence. Preserve first, then act. We cover that rule in depth in our Invasion Investigation series, and it applies to a disclosed vulnerability just as much as to a site you already know is hacked.
For PHP2Shell, the security community published a specific pattern to look for in the logs. It is a POST request that gets a 500 server error, followed by a POST from the same address that gets a 502, usually within a few minutes. Bursts of 500 errors from one visitor are another sign.
We ran October 1 through October 22 across all twelve sites, which came to 346,272 requests. We found:
- No 502 responses anywhere in the month.
- No 500-then-502 pairs from any address.
- No hits from the attacker addresses Amazon published.
- No successful logins by anyone but us.
- No new PHP files being called that were not there before October 17.
We did find one thing worth a second look. On October 18, a single cloud server sent two POST requests to one of our sites, and both got a 500 error. That was the only POST error on any site all month. It matched the first half of the attack pattern, and the second half never came. That is a lead, not proof, so we treated it like a lead.
We opened the site over FTP and sorted by date. One folder showed a change on October 20, but nothing inside it was that new. A folder’s date moves when something directly inside it is created and deleted, which is exactly what a cleaned-up dropper would look like. So we matched the folder’s timestamp against the log. In that same minute, the only activity was WordPress running its own scheduled tasks from our own server. Mystery solved, and the lead was closed.
That is the job: find the oddity, then run it down until it is explained. Do not panic over it and do not ignore it.
Step Two: Verify the Patch Yourself
Only after the logs did we look at the PHP version. Our host announced the patch was rolling out across their shared servers, but the announcement did not say when our particular server got it. So we checked.
The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Our server reported 8.4.27, the fixed version for its branch. In WordPress you can find this yourself under Tools, then Site Health, then the Info tab, under Server.
Two cautions. First, if your site runs PHP 8.1 or older, the PHP team did not release a fix at all. Some hosting control panels backported one, but an old PHP version is a problem you should be planning to retire anyway. Second, if you check your version with a phpinfo file, delete that file the moment you have read it. You will see why in the next step.
Step Three: Find the Bursts Hunting for Compromised Sites
With the attack pattern ruled out and the patch confirmed, the last step was the one most people never take. We went looking for the bots that are not trying to break in at all, because they are hunting for sites that are already broken into.
These bots work from lists of filenames that backdoors and web shells are commonly saved under. They request each name in rapid bursts, hoping a previous attacker left a door open. In October alone, our sites were asked for more than 3,000 different PHP filenames by roughly a thousand different addresses. Requests with no browser name at all, the clearest sign of a dumb script, came to about 70,000, and they came from fewer than 200 addresses. One of them fired 253 requests in a single minute.
The most-requested names tell you what attackers want. At the top were info.php and phpinfo.php, each requested by more than 200 separate addresses. That is version-hunting. A forgotten phpinfo file tells an attacker exactly which PHP version you run, which is exactly what they need to know during a week like this one. Below those came known shell and file-manager names, the kind of file an intruder drops so they can come back later.
On our sites, about three out of four of those requests were refused outright by rules in our .htaccess file. The rest landed on our generic page for addresses that do not exist. Not one of them reached a real file. Confirming that is exactly what checking your hardening in the server logs is for. That is the result you want: no backdoor exists for them to find. If one of those names does answer with real content on your site, you have a much bigger problem than a patch, and you should stop changing things and preserve the evidence. Those are not the only signs a backdoor still exists, either. Our Emergency Authority series walks through those first hours.
Why This Order
Logs first, because they are the evidence and changes overwrite it. Version second, because you should not take anyone’s word for a patch, including your host’s. Bursts third, because a patched server can still be carrying something that got in before the patch. Each step answers a different question: did they try, are we closed, and is anyone already inside.
If you would rather make that harder for the next one, our Site Hardening series covers the .htaccess rules and file permissions that turned most of those bursts into dead ends on our sites. If you find something you cannot explain, or your rankings took a hit after a compromise, the Ranking Recovery series picks up from there.
We did this for our own sites first. If your logs show something you cannot run down on your own, our website recovery service is built on the same process we used here.
Start a Recovery ReviewPaid assessment · scope agreed up front