SiteLock Security Advisory: PHP2Shell - How SiteLock responded and what to do for your website
What happened
On Oct 21, 2026, PHP disclosed two critical flaws: CVE-2026-109618 and CVE-2026-109619, known as “PHP2Shell.” They can let attackers take control of a vulnerable website without logging in. We want to explain what SiteLock did and what you can do to protect your website.
How SiteLock responded
We applied available PHP security patches and added additional protective controls where needed. We also increased security monitoring and threat hunting across our environment.
We have found no evidence that these vulnerabilities were exploited in our environment, and we do not expect any disruption to our services.
Where things stand
You don't need to do anything in your SiteLock account. We’ll continue monitoring the situation and tell customers if anything changes that affects them or requires action.
What to do for your website
- Ask your host whether your site’s PHP is patched against CVE-2026-109618 and CVE-2026-109619
- If you’re on PHP 8.1 or older, plan an upgrade as soon as possible
- Check for anything unusual: unknown admin users, new plugins or files. A SiteLock scan can help
- Turn on two-factor authentication and remove old logins
- Confirm you have a recent off-server backup
- A WordPress or plugin update alone won’t fix this. PHP itself has to be updated
Questions?
Feel free to call us at (844) 217-0577 or submit a ticket through your SiteLock dashboard and our Support team will be happy to help.