PHP2Shell Vulnerability: How to Secure Your Website and Verify the PHP Security Patch

A serious security problem called PHP2Shell has created worries for website owners, developers and hosting companies. The flaw could let hackers run code on weak servers without needing to log in to a website or its control panel.

PHP powers many websites, including WordPress, Joomla, Drupal, and other PHP-based applications website owners and administrators need to identify affected websites, apply the appropriate security updates, and verify that their systems are safe before restoring normal public access.

In this guide, Kapwa Marketing explains how to temporarily restrict website access, configure maintenance mode, check the exact PHP version, apply security updates, and perform the necessary checks before bringing a website back online.

What Is the PHP2Shell Vulnerability?

PHP2Shell refers to two critical vulnerabilities in PHP:

• CVE-2026-109618
• CVE-2026-109619

These vulnerabilities can potentially allow unauthenticated remote code execution, meaning an attacker may execute malicious code on a vulnerable server without first logging in.

The issue affects the PHP runtime itself, rather than being limited to a particular website platform, theme, or plugin. Updating WordPress core, themes, and plugins alone will not resolve the issue if the underlying PHP installation remains vulnerable.

PHP released security updates on October 21, 2026. Website administrators should identify affected installations and apply the appropriate security patches as soon as possible.

Official reference: PHP Security Announcement — October 21, 2026

What should you do?

Step 1: Identify All Websites That Need Attention

Start by listing all websites, domains, and hosting accounts that may be affected.

Check the PHP version and security status of each website. If you manage multiple hosting providers, assess each environment separately.

If you no longer have access to a hosting account, contact the account owner or hosting provider to arrange access or request confirmation that the necessary security updates have been applied.

Do not assume a website is protected simply because it is temporarily unavailable.

Step 2: Temporarily Rename the Website Directory

If a vulnerable website cannot be patched immediately, temporarily restricting public access can help reduce exposure while remediation is underway.

Follow the appropriate directory-renaming procedure for your hosting environment.

If the website directory is public_html:

• Open the hosting file manager or use your authorized file-access method.
• Locate the public_html directory.
• Rename it to public_html_.

If the website uses a domain-named directory:

• Locate the directory associated with the domain, such as test.com.
• Rename it to test.com_.

Verify that the website is inaccessible

After renaming the directory, test the website from an external browser or connection.

Confirm that:

• The website is no longer publicly accessible as expected.
• PHP files cannot be executed through the affected domain.
• The domain is not serving website content from another directory or document root.

Renaming a directory alone does not guarantee protection on every hosting configuration. If the website remains accessible, keep investigating the configuration with the hosting provider or server administrator.

Step 3: Configure Temporary Maintenance Mode

After temporarily restricting access, configure the maintenance page so visitors can see that the website is undergoing maintenance.

For websites using compatible Apache or LiteSpeed configurations, follow these steps:

1. Locate the existing .htaccess file in the website’s main directory.
2. Rename the original file to .htaccess.backup to preserve the existing configuration.
3. Upload the provided temporary blocking .htaccess file.
4. Upload the provided maintenance.html file to the website’s main directory.
5. Verify that both files are in the correct location.

The temporary .htaccess configuration supplied by Jude contains the following:

RewriteEngine On

# Serve this page when maintenance mode returns 503.
ErrorDocument 503 /maintenance.html

# TEMPORARY MAINTENANCE MODE
# Replace YOUR_IP_ADDRESS with the IP address that should bypass maintenance.
RewriteCond %{REQUEST_URI} !^/maintenance\.html$
RewriteCond expr "%{REMOTE_ADDR} != 'YOUR_IP_ADDRESS'"
RewriteRule ^ - [503,L]
# END OF TEMPORARY MAINTENANCE MODE

Important: Replace YOUR_IP_ADDRESS with the actual public IP address that should be allowed to bypass maintenance mode. Do not leave the placeholder unchanged.

The configuration is intended to return HTTP 503 for requests that do not qualify for the temporary exception, while allowing the maintenance page itself to load.

The .htaccess syntax and behavior must be verified against the server’s Apache or LiteSpeed configuration. Other hosting environments may require a different method.

The maintenance.html file contains the following:

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <meta name="robots" content="noindex, nofollow, noarchive">
  <meta name="googlebot" content="noindex, nofollow, noarchive">
  <title>Website Maintenance | Temporarily Unavailable</title>
  <style>
    :root {
      color-scheme: light;
      --background: #f6f8fb;
      --surface: #ffffff;
      --text: #172033;
      --muted: #5c667a;
      --accent: #0f766e;
      --accent-soft: #d9f3ef;
      --line: #d9e1ec;
      --shadow: 0 24px 70px rgba(23, 32, 51, 0.14);
    }

    * {
      box-sizing: border-box;
    }

    html,
    body {
      min-height: 100%;
    }

    body {
      margin: 0;
      min-height: 100vh;
      display: grid;
      place-items: center;
      padding: 32px 18px;
      background:
        radial-gradient(circle at top left, rgba(15, 118, 110, 0.13), transparent 34rem),
        linear-gradient(135deg, #f9fbfd 0%, var(--background) 52%, #eef3f8 100%);
      color: var(--text);
      font-family: Arial, Helvetica, sans-serif;
      line-height: 1.5;
    }

    main {
      width: min(100%, 640px);
      text-align: center;
    }

    .panel {
      padding: clamp(32px, 7vw, 56px);
      border: 1px solid rgba(217, 225, 236, 0.88);
      border-radius: 8px;
      background: rgba(255, 255, 255, 0.88);
      box-shadow: var(--shadow);
      backdrop-filter: blur(10px);
      animation: rise 650ms ease-out both;
    }

    .maintenance-icon {
      position: relative;
      width: 78px;
      height: 78px;
      margin: 0 auto 26px;
      border-radius: 50%;
      background: var(--accent-soft);
      border: 1px solid rgba(15, 118, 110, 0.2);
    }

    .maintenance-icon::before,
    .maintenance-icon::after {
      content: "";
      position: absolute;
      left: 50%;
      top: 50%;
      background: var(--accent);
      transform-origin: center;
    }

    .maintenance-icon::before {
      width: 38px;
      height: 10px;
      border-radius: 999px;
      transform: translate(-50%, -50%) rotate(-38deg);
      box-shadow: 0 0 0 4px #ffffff;
    }

    .maintenance-icon::after {
      width: 11px;
      height: 42px;
      border-radius: 999px;
      transform: translate(-50%, -50%) rotate(-38deg);
    }

    h1 {
      margin: 0;
      font-size: clamp(2rem, 7vw, 3.8rem);
      line-height: 1.05;
      font-weight: 700;
      letter-spacing: 0;
    }

    .message {
      max-width: 540px;
      margin: 20px auto 0;
      color: var(--muted);
      font-size: clamp(1rem, 2.5vw, 1.16rem);
    }

    .note {
      display: inline-block;
      margin-top: 28px;
      padding-top: 22px;
      border-top: 1px solid var(--line);
      color: #394257;
      font-size: 0.95rem;
    }

    @keyframes rise {
      from {
        opacity: 0;
        transform: translateY(14px);
      }

      to {
        opacity: 1;
        transform: translateY(0);
      }
    }

    @media (prefers-reduced-motion: reduce) {
      *,
      *::before,
      *::after {
        animation-duration: 0.01ms !important;
        animation-iteration-count: 1 !important;
        scroll-behavior: auto !important;
      }
    }

    @media (max-width: 420px) {
      body {
        padding: 20px 14px;
      }

      .panel {
        padding: 30px 22px;
      }

      .maintenance-icon {
        width: 68px;
        height: 68px;
        margin-bottom: 22px;
      }
    }
  </style>
</head>
<body>
  <main aria-labelledby="maintenance-title">
    <section class="panel" aria-describedby="maintenance-message maintenance-note">
      <div class="maintenance-icon" aria-hidden="true"></div>
      <h1 id="maintenance-title">We&rsquo;ll Be Back Soon</h1>
      <p class="message" id="maintenance-message">Our website is currently being updated to improve your experience. Please check back again shortly.</p>
      <p class="note" id="maintenance-note">Thank you for your patience.</p>
    </section>
  </main>
</body>
</html>

Restore the original website directory name

Once the maintenance files are in place:

1. Rename public_html_ back to public_html, if that was the original directory name.
2. If the original directory was domain-named, such as test.com_, rename it back to test.com.
3. Confirm that the domain displays the maintenance page.

Verify that maintenance mode is working

Test the website from an external connection.

Confirm that:

• Visitors see the maintenance page.
• Direct requests to PHP files are blocked.
• The website is not accessible through another public path.
• The website’s original files remain intact.

If the maintenance page does not appear or PHP files remain accessible, keep the website restricted and review the configuration before proceeding.

Step 4: Check the Exact PHP Version Using phpinfo.php

Before restoring public access, confirm the exact PHP version running on the website, including its patch number.

• PHP 8.5.12 (for PHP 8.5.x)
• PHP 8.4.27 (for PHP 8.4.x)
• PHP 8.3.36 (for PHP 8.3.x)
• PHP 8.2.35 (for PHP 8.2.x)

A hosting control panel may show a configured PHP version, but the runtime serving the website should also be verified.

Follow the procedure below:

4.1 Temporarily allowlist your public IP address

Open the temporary .htaccess file and locate the maintenance-mode section.

Replace YOUR_IP_ADDRESS with your actual public IP address so your connection can bypass maintenance mode while other visitors remain restricted.

For example, if the public IP address you want to allow is 203.0.113.10, the relevant line would be:

RewriteCond expr "%{REMOTE_ADDR} != '203.0.113.10'"

This is an example address, not an address to use in your actual configuration.

Save the change and verify that your allowlisted connection can access the website while other connections still receive the maintenance page.

If you cannot verify the restriction, stop and correct the configuration before proceeding.

4.2 Create the phpinfo.php file

In the website’s root directory, create a file named:

phpinfo.php

Add the following PHP code to the file:

<?php phpinfo(); ?>

Save the file.

4.3 Open the file in your browser

While connected through the allowlisted public IP address, visit:

https://yourdomain.com/phpinfo.php

Replace yourdomain.com with the actual website domain.

The page should display PHP configuration information, including the PHP version and patch number.

For example, the version should match the appropriate patched release for the installed PHP branch:

• PHP 8.2.35
• PHP 8.3.36
• PHP 8.4.27
• PHP 8.5.12

Compare the reported version with the security update required for that installation. If an older version is displayed, do not assume the website is protected. Contact the hosting provider or administrator to confirm whether a verified security backport has been applied.

Security warning: A phpinfo() page can expose sensitive information about the server, its configuration, installed modules, and environment. Keep the file accessible only for the short period needed to verify the PHP version.

4.4 Immediately remove the diagnostic file

As soon as you have confirmed the PHP version:

1. Delete phpinfo.php from the website’s root directory.
2. Verify that https://yourdomain.com/phpinfo.php no longer displays PHP configuration information.
3. Remove the temporary IP exception from .htaccess.
4. Save the file and confirm that maintenance mode remains enabled for visitors.

Do not leave phpinfo.php on a publicly accessible website after testing.

Step 5: Test Maintenance Mode From a Different Public IP Address

After confirming the PHP version, verify that maintenance mode is still enabled for visitors who are not on the allowlist.

Jude recommends using Mozilla Firefox with a VPN extension to test the website from a different public IP address.

Follow these steps:

1. Keep the temporary maintenance configuration enabled.
2. Remove the phpinfo.php file and the temporary IP exception after completing the version check.
3. Open Mozilla Firefox and connect through a VPN extension.
4. Confirm that the VPN connection is active and uses a different public IP address from the allowlisted connection.
5. Visit the website’s main domain.
6. Confirm that the maintenance page appears.
7. Attempt to access a PHP file directly and verify that it cannot be executed or accessed publicly.

The test is successful only if the external connection remains restricted while the intended maintenance page is displayed.

A VPN may use shared or rotating IP addresses, so verify the actual public IP used by the browser. If you are testing before removing the allowlist, ensure that the VPN address is not also allowlisted.

If another connection can access the website or execute PHP scripts unexpectedly, keep the website restricted and review the configuration.

Step 6: Update PHP to a Patched Version

Temporary maintenance mode helps reduce exposure, but it does not resolve the underlying vulnerability.

Update the PHP runtime to the appropriate patched version or install a verified security-backported package supplied by the operating system vendor or hosting provider.

The PHP release announcement lists these patched versions:

Confirm that the version serving the website is patched, rather than relying only on the version selected in the hosting control panel.

If the hosting provider manages PHP updates, request confirmation that the relevant runtime and PHP workers have been updated.

Older PHP branches may require additional investigation because upstream security support may have ended. Some vendors provide backported fixes, so ask the provider to verify the actual patch status.

Step 7: Check for Signs of Compromise

Even after PHP has been updated, a previously vulnerable website may have been compromised.

Before restoring public access, review the website and server for suspicious activity.

Check for:

• Unexpected files or unauthorized changes to existing files.
• Unfamiliar administrator accounts.
• Suspicious web server, PHP, or authentication logs.
• Unexpected processes or commands launched by the web server.
• Unusual outbound network connections.
• Other indicators of unauthorized access.

If you discover signs of compromise, keep the website restricted and investigate the incident before restoring access. Additional remediation, credential rotation, or restoration from a known-clean backup may be necessary.

Document the checks performed and any actions taken.

Step 8: Restore the Website Safely

Restore normal public access only after the security patch has been verified and the required security checks have been completed.

Before doing so, confirm the following:

✔️ The correct PHP patch or verified security backport is installed.

✔️ The actual PHP runtime serving the website has been verified.

✔️ The temporary phpinfo.php file has been deleted.

✔️ The temporary IP exception has been removed.

✔️ The maintenance configuration has been reviewed.

✔️ Website files and server logs have been checked for signs of compromise.

✔️ The website’s functionality has been tested.

✔️ The responsible administrator has approved restoring public access.

✔️ WP Core files, themes and plugins are all up-to-date.

When the website is ready:

1. Preserve a copy of the temporary configuration and document the changes.
2. Remove the temporary maintenance blocking rules.
3. Restore the original .htaccess file from .htaccess.backup, or reinstate the original rules through the appropriate configuration process.
4. Remove the temporary maintenance page and any other temporary files when no longer needed.
5. Test the website from an external connection.
6. Confirm that normal pages and expected PHP functionality work correctly.
7. Continue monitoring the website for suspicious activity.

Do not remove the maintenance restrictions until the underlying PHP security issue has been addressed.

Final Thoughts

The PHP2Shell vulnerability highlights the importance of securing both a website’s application and its underlying server environment.

Following a controlled process helps administrators reduce exposure while addressing the vulnerability. This includes temporarily restricting public access, configuring maintenance mode, verifying the actual PHP version, applying security updates, and checking for signs of compromise.

The temporary IP exception and phpinfo.php file are diagnostic measures only. They must be removed after testing, and they must never replace the necessary PHP security update.

At Kapwa Marketing, we believe that maintaining a strong online presence includes taking website security seriously. Keeping website infrastructure updated and responding promptly to security issues helps businesses protect their operations and maintain customer trust.

Need help with your website? Contact Kapwa Marketing to discuss your website maintenance and digital needs.

Security References

• PHP Official Security Announcement — October 21, 2026
• The Hacker News — PHP2Shell Security Report

Disclaimer: This article provides general cybersecurity information. Directory renaming, .htaccess rules, and temporary IP exceptions depend on the hosting configuration and do not guarantee protection on their own. Consult your hosting provider or a qualified administrator before making changes to a production website.