Check your website after a big security alert (PHP2Shell, October 2026)

1. Workflow

1. Ask any chatbot to interview you about what your site runs on and who manages the server, and get a one-page triage note with your first three moves.

   Tool

   Any chat (ChatGPT, Claude or Grok)

   Why

   Most site owners don't know which PHP version they run or who updates it. The PHP project says the update is the only complete fix, and the researchers say updating WordPress or another app doesn't update the PHP runtime underneath it (php.net and php2shell.com, checked Oct 23, 2026), so the first job is finding who controls PHP.

   Cost

   $0 on free plans.

   Copy prompt Paste into ChatGPT, Claude or Grok. Don't paste passwords or keys.

   Preview prompt: Triage my site for a security alert

   ROLE You are a calm, practical website-security helper for a small business or creator who is not a server expert. GOAL Work out what my website runs on and who can fix it, so I know whether a big security alert (for example the October 2026 PHP2Shell bugs in PHP) applies to me and what to do first. WHAT THE NEXT STEP NEEDS A one-page triage note for Steps 2 to 6: what my site is built on, who manages the server, where I log in, what to check, and who to contact. HOW TO WORK WITH ME Do not write the deliverable yet. Interview me first. - Ask your questions ONE AT A TIME and wait for my answer before asking the next. (If I ask for speed, you may ask a short numbered batch of at most 4 questions instead.) - With every question, offer 2-3 sensible example answers or a default, so I can reply "default" or pick one. - If an answer is vague, ask one follow-up. If I don't know, choose a sensible default and tell me what you chose. - Do not generate the deliverable until I have answered every question. When you have enough, give me a 3-5 line summary of what you understood and ask me to confirm. - Do not invent facts about my site, my host or the alert. If you don't know whether my platform uses PHP, say so and tell me how to find out. Never ask me for passwords, keys or login codes. FACTS YOU MAY USE (from official pages checked Oct 23, 2026; do not add others) - On Oct 21, 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical bugs, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. At risk: all PHP installations serving web requests (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed). - Linux distributions and LTS vendors got the patches in advance, so a host may run a vendor package with a backported fix even if its version number looks older. PHP 8.1 and older get no updates from the PHP project. - The PHP project says temporary mitigations reduce exposure but do not make an installation safe; updating is the complete fix. - The researchers' site php2shell.com says to install a fixed PHP release on every runtime, then restart Apache, PHP-FPM and any long-running PHP workers, and that updating an application (such as WordPress) does not update the PHP runtime beneath it. - On Oct 23, 2026 the PHP project suggested setting session.upload_progress.enabled=0 until the next regular bugfix release, against an unlikely extra attack path. QUESTIONS TO COVER (in a sensible order, skip any I already answered above) 1. What is your site built with? Examples: self-hosted WordPress, Drupal or Joomla; a hosted builder such as Squarespace, Wix or Shopify; a custom app. (Default: I'll help you find out from your login page or invoices.) 2. Who runs the server? Examples: a shared host, a managed WordPress host, a freelancer or agency, me on my own server. (Default: your hosting company.) 3. Which logins do you have? Examples: the site's admin panel, the host's control panel, none. (Default: the site admin panel only.) 4. Does the site take payments, logins or customer data? (Default: yes, treat it as important.) 5. When was it last backed up, and where? (Default: unknown, so a backup is the first task.) THE DELIVERABLE (only after I confirm) A triage note with these headings: My site (platform, host, who manages PHP); Does this alert likely apply? (yes / probably / unlikely / unknown, with one sentence why, based only on the facts above); First 3 things to do today; Who to contact and how; What to record when it's done. Put the deliverable inside one clearly delimited block that starts with a line "=== COPY START ===" and ends with a line "=== COPY END ===", with no commentary inside the block. Put any notes outside it. AFTER THE DELIVERABLE Ask me: "Anything to tweak?" If I ask for changes, revise and give me the full updated block again between the same markers. Repeat until I say it is good. FINISH When I'm happy, end with one line telling me what to do next: if you run WordPress, open Tools > Site Health (Step 2); if your platform manages the server for you, go to Step 4 and ask its support.

2. WordPress site? Log in and open Tools > Site Health. On the Info tab, open the Server section to see the PHP details, and check the Status tab for an outdated-PHP warning. Use the copy button on the Info tab if you want to send the details to your host.

   Tool

   WordPress admin (Site Health)

   Why

   WordPress's own documentation says the Info tab's Server section lists PHP details, the Status tab flags "Your site is running an outdated version of PHP", and changing server settings may need your hosting provider (wordpress.org, checked Oct 23, 2026). A version number alone can't show a backported fix, which is why Step 4 asks the host.

   Cost

   $0; Site Health is built into WordPress.

3. Optional: run OpenAI's free PHP version checker. In Codex, install it with $skill-installer install both skills from https://github.com/openai/php2shell-checker, then run $phpcheck-url check https://yoursite.com (or $phpcheck-server on a server you manage). Without Codex, run node phpcheck.js "https://yoursite.com" from the repo.

   Tool

   Codex or Node.js (php2shell-checker)

   Why

   The checker's README says it compares the PHP version a site advertises with the fixed releases and reports OK, POTENTIALLY VULNERABLE or UNKNOWN. URL mode only reads the X-Powered-By and Server headers and sends no exploit probes; many sites hide those headers (UNKNOWN), headers can't show vendor backports, and even OK only describes the advertised version (GitHub, checked Oct 23, 2026). Treat it as a hint, not proof.

   Cost

   $0; the checker is a public GitHub repo. ChatGPT's pricing page lists limited Codex on Free and Go and Codex on Plus (checked Oct 23, 2026).

4. Have a chatbot draft a short message to your host, developer or platform asking them to confirm in writing the exact PHP version or package, that it includes the Oct 21 fix, and that PHP workers were restarted. Send it.

   Tool

   Any chat (ChatGPT, Claude or Grok)

   Why

   The PHP project says Linux distributions and LTS vendors received the patches in advance, so your host may run a fixed vendor package with an older-looking number, and PHP 8.1 and older get no updates from the PHP project (php.net, checked Oct 23, 2026). Only whoever runs the server can confirm the fix and the restart that php2shell.com says is needed.

   Cost

   $0 on free plans.

   Copy prompt Paste into ChatGPT, Claude or Grok, then send the result through your host's support chat or email.

   Preview prompt: Write my message to the host

   ROLE You are a clear, polite writer of support tickets for a non-technical website owner. GOAL Draft a short message to my hosting company, developer or platform support asking them to confirm that the server running my site is protected against the October 2026 critical PHP bugs. WHAT THE NEXT STEP NEEDS A message I can paste into my host's support chat or email, that asks for a yes/no answer and the specific details I need to record in Step 6. HOW TO WORK WITH ME Do not write the deliverable yet. Interview me first. - Ask your questions ONE AT A TIME and wait for my answer before asking the next. (If I ask for speed, you may ask a short numbered batch of at most 4 questions instead.) - With every question, offer 2-3 sensible example answers or a default, so I can reply "default" or pick one. - If an answer is vague, ask one follow-up. If I don't know, choose a sensible default and tell me what you chose. - Do not generate the deliverable until I have answered every question. When you have enough, give me a 3-5 line summary of what you understood and ask me to confirm. - Do not invent facts about my host, my plan or my server. Do not claim my site was attacked or is vulnerable; ask, don't accuse. Never include passwords or keys. FACTS YOU MAY USE (from official pages checked Oct 23, 2026; do not add others) - On Oct 21, 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical bugs, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. At risk: all PHP installations serving web requests (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed). - Linux distributions and LTS vendors got the patches in advance, so a host may run a vendor package with a backported fix even if its version number looks older. PHP 8.1 and older get no updates from the PHP project. - The PHP project says temporary mitigations reduce exposure but do not make an installation safe; updating is the complete fix. - The researchers' site php2shell.com says to install a fixed PHP release on every runtime, then restart Apache, PHP-FPM and any long-running PHP workers, and that updating an application (such as WordPress) does not update the PHP runtime beneath it. - On Oct 23, 2026 the PHP project suggested setting session.upload_progress.enabled=0 until the next regular bugfix release, against an unlikely extra attack path. QUESTIONS TO COVER (in a sensible order, skip any I already answered above) 1. Who is this going to? Examples: my shared host's support chat, my developer, a managed WordPress host. (Default: the host's support chat.) 2. What is the site address and, if you saw it, the PHP version shown in Site Health or by the checker? (Default: site address only.) 3. How many sites or servers do you have with them? (Default: one.) 4. Tone and length? Examples: short and friendly, formal, firm because the site takes payments. (Default: short and friendly.) THE DELIVERABLE (only after I confirm) A message of 120 words or less that: names the site; mentions CVE-2026-109618 and CVE-2026-109619 and the fixed releases (8.5.12, 8.4.27, 8.3.36, 8.2.35 or a vendor backport); asks them to confirm in writing (1) the exact PHP version or package serving the site, (2) whether it includes the fix, (3) that PHP-FPM, Apache or other PHP workers were restarted afterwards, and (4) when it was done; and asks what they recommend if the site is on PHP 8.1 or older. Add a subject line if it's an email. Put the deliverable inside one clearly delimited block that starts with a line "=== COPY START ===" and ends with a line "=== COPY END ===", with no commentary inside the block. Put any notes outside it. AFTER THE DELIVERABLE Ask me: "Anything to tweak?" If I ask for changes, revise and give me the full updated block again between the same markers. Repeat until I say it is good. FINISH When I'm happy, end with one line telling me what to do next: send it, then move to Step 5 while you wait for the reply.

5. While you wait: take a fresh backup, then update WordPress or your app, plugins and themes. If you manage the server yourself, install a fixed PHP release (or your vendor's patched package) on every PHP runtime, restart Apache, PHP-FPM and long-running PHP workers, and consider session.upload_progress.enabled=0 until the next PHP bugfix release.

   Tool

   Your host's control panel or your server

   Why

   php2shell.com calls installing a fixed PHP release and restarting the workers the only complete fix. The PHP project's Oct 21 mitigations reduce exposure but do not make an installation safe, and its Oct 23 advisory suggests turning off session upload progress until the next regular bugfix release because of an unlikely extra attack path (php.net, checked Oct 23, 2026). App and plugin updates are still good hygiene, but they don't patch PHP.

   Cost

   $0 for the steps; your hosting plan is whatever you already pay.

6. When the host replies, paste their answer into a chatbot and get a dated fix record plus a short checklist for the next big alert. Recheck Site Health or the checker and mark anything not confirmed.

   Tool

   Any chat (ChatGPT, Claude or Grok)

   Why

   OpenAI says it expects findings like this to increase sharply in the coming months (OpenAI, Oct 21, 2026, checked Oct 23, 2026). A written record and a reusable checklist turn the next alert into a 10-minute job instead of a scramble.

   Cost

   $0 on free plans.

   Copy prompt Paste into ChatGPT, Claude or Grok together with your host's reply.

   Preview prompt: Record the fix and plan for next time

   ROLE You are an organised record-keeper who helps a small website owner close out a security alert properly. GOAL Turn what my host or developer told me into a short record that the site is fixed, plus a reusable checklist for the next big security alert. WHAT THE NEXT STEP NEEDS Nothing after this; the record goes in my notes or a shared doc, and the checklist is what I'll follow next time. HOW TO WORK WITH ME Do not write the deliverable yet. Interview me first. - Ask your questions ONE AT A TIME and wait for my answer before asking the next. (If I ask for speed, you may ask a short numbered batch of at most 4 questions instead.) - With every question, offer 2-3 sensible example answers or a default, so I can reply "default" or pick one. - If an answer is vague, ask one follow-up. If I don't know, choose a sensible default and tell me what you chose. - Do not generate the deliverable until I have answered every question. When you have enough, give me a 3-5 line summary of what you understood and ask me to confirm. - Do not invent facts. Only record what my host, developer or tools actually said; if something wasn't confirmed, mark it UNCONFIRMED instead of filling it in. FACTS YOU MAY USE (from official pages checked Oct 23, 2026; do not add others) - On Oct 21, 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical bugs, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. At risk: all PHP installations serving web requests (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed). - Linux distributions and LTS vendors got the patches in advance, so a host may run a vendor package with a backported fix even if its version number looks older. PHP 8.1 and older get no updates from the PHP project. - The PHP project says temporary mitigations reduce exposure but do not make an installation safe; updating is the complete fix. - The researchers' site php2shell.com says to install a fixed PHP release on every runtime, then restart Apache, PHP-FPM and any long-running PHP workers, and that updating an application (such as WordPress) does not update the PHP runtime beneath it. - On Oct 23, 2026 the PHP project suggested setting session.upload_progress.enabled=0 until the next regular bugfix release, against an unlikely extra attack path. QUESTIONS TO COVER (in a sensible order, skip any I already answered above) 1. Paste your host's or developer's reply. What did they confirm? Examples: version and restart confirmed; only "we're patched"; no reply yet. (Default: treat anything vague as unconfirmed.) 2. What does a recheck show now (Site Health, or the checker's OK / POTENTIALLY VULNERABLE / UNKNOWN)? (Default: not rechecked yet.) 3. Did you also update WordPress or your app, plugins and themes, and take a backup? (Default: not yet.) 4. Who else should know? Examples: a business partner, a client, nobody. (Default: just me.) THE DELIVERABLE (only after I confirm) 1. A dated FIX RECORD: site, platform, host, PHP version or package confirmed, worker restart confirmed (yes / no / UNCONFIRMED), date fixed, recheck result, backup date, open items. 2. A NEXT-ALERT CHECKLIST of at most 8 lines: where to read the official advisory, how to check what my site runs, who to message (with the Step 4 message as a template), what to ask them to confirm, and how to recheck. Put the deliverable inside one clearly delimited block that starts with a line "=== COPY START ===" and ends with a line "=== COPY END ===", with no commentary inside the block. Put any notes outside it. AFTER THE DELIVERABLE Ask me: "Anything to tweak?" If I ask for changes, revise and give me the full updated block again between the same markers. Repeat until I say it is good. FINISH When I'm happy, end with one line telling me what to do next: save the record, set a reminder to recheck after the next PHP bugfix release, and if anything is still UNCONFIRMED, follow up with your host.

2. Recommended tool chain

1. Any chat (ChatGPT, Claude or Grok)
2. WordPress admin (Site Health)
3. Codex or Node.js (php2shell-checker)
4. Any chat (ChatGPT, Claude or Grok)
5. Your host's control panel or your server
6. Any chat (ChatGPT, Claude or Grok)

3. Total cost

Unpriced items are left out of the total (marked “cost not sourced”), so the real total is higher. All totals are our arithmetic from sourced unit prices.

4. Current promos

• ChatGPT Plus: 4 months free for US college students (ends Oct 31, 2026)

  OpenAI's student page offers eligible US college students four free months of ChatGPT Plus, verified through SheerID. Claim by October 31.

  Applies to: ChatGPT Plus on the best route (not needed; Free works)

  Renews at $20/month after the free period unless you cancel. Not available for App Store or Google Play billing.

  Source: OpenAI: ChatGPT for students, checked Oct 22, 2026

5. Learn it

Last verified Oct 23, 2026. Items older than 30 days are marked.

6. Caveats and assumptions

• None of the official pages we checked (Oct 23, 2026) say whether these PHP bugs are being exploited in the wild. Don't assume either way; patch and confirm.
• A version number isn't proof. Vendor packages can carry backported fixes under older numbers, many sites hide their PHP version, and the checker says even OK only describes the advertised version. Your host's written confirmation is what counts.
• Updating WordPress, plugins or themes does not update PHP. On shared or managed hosting, only the host can patch PHP and restart its workers.
• If your site is on PHP 8.1 or older, the PHP project no longer ships updates for it; ask your host about a vendor backport or moving to a supported version. PHP 8.2 reaches end of life on Dec 31, 2026 (php.net, checked Oct 23, 2026).
• php2shell.com says a WAF, CDN or hosting-provider rule may help while you wait but is not a substitute for updating PHP, and that the absence of warning signs in your logs doesn't prove a site is unaffected (checked Oct 23, 2026).
• Never test or probe sites you don't own, and never paste passwords, keys or login codes into a chatbot or support chat.
• This is a general checklist, not a security audit. If you think your site was already compromised, contact your host and a security professional.
• Plan features and prices are from each company's pages on the dated checks and can change; costs are our arithmetic, one month unless stated.

Last verified Oct 23, 2026.