What Is PHP2Shell? How to Fix the PHP Vulnerability on Windows Server (IIS)

2026-10-27

Last updated: October 26, 2026. We’re testing these commands on our own servers and will add screenshots here shortly.

In October 2026, two critical security flaws in PHP, known as PHP2Shell, made headlines around the world. This guide explains what happened, then walks you through checking and patching PHP on Windows Server and IIS step by step, with commands you can copy and paste.

What happened? See What is PHP2Shell?
Need to fix a server? Go to Am I affected?, then the step-by-step fix.
On shared hosting? Jump to what you can do on shared hosting.

Winserver customers: PHP on your VPS is managed by you, so please check your version using the steps below. If you’re unsure whether your server is affected, contact our support team and we’ll point you in the right direction.

TABLE OF CONTENTS

What is PHP2Shell? (October 2026 PHP vulnerability)

PHP is the programming language behind a huge number of websites, including every WordPress site. On October 21, 2026, the PHP project fixed two flaws found by the security company Wiz: CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 for severity.

An attacker could send a single crafted request to a website and potentially take control of the server, without a password and before the website’s own code even runs. The flaws are in PHP itself, so updating WordPress or plugins doesn’t help. PHP needs to be updated.

Why it made headlines

It’s everywhere. Wiz described the flaws as affecting around 70% of the internet.
Many sites run old PHP. Qualys estimates that about 71% of PHP installations run old versions that no longer get official updates.
Sites went offline as a precaution. Several European government, school and hospital websites were taken offline on October 21 while they were checked and patched.
Attackers moved fast. Attack attempts started even before the flaws were made public.

Which games and sites went offline?

On October 21, many popular Japanese games and websites went into emergency maintenance as companies rushed to patch or protect their servers. These were precautionary shutdowns, not confirmed hacks.

Type	Services that went offline
Pokémon apps	Pokémon Sleep, Pokémon HOME, Pokémon Champions
Cygames titles	Uma Musume: Pretty Derby, Granblue Fantasy, Shadowverse: Worlds Beyond, Princess Connect! Re:Dive
Other games	CHUNITHM
Japanese websites and stores	pixiv, Niconico, Bandai Channel, Animate Online Shop, Melonbooks, BASE, BOOK☆WALKER

Cygames’ notice for Uma Musume said a PHP vulnerability had been found on its servers. Nintendo’s online services for Switch and Switch 2 were also down at the same time, but Nintendo has not confirmed the outage was related to PHP. Most of the Japanese websites planned to be back by the morning of October 22 (Japan time).

Sources: Dexerto, Gigazine (Japanese).

Timeline

Date (2026)	What happened
October 17	Amazon’s threat intelligence team records an attack attempt, four days before the flaws are public.
October 21	The flaws are made public and the PHP project releases fixed versions. Pokémon apps, Cygames titles and major Japanese websites go into emergency maintenance, and some European organizations take sites offline as a precaution.
October 21–23	Security companies report widespread attack attempts, including from botnets (networks of hijacked devices).
October 23	Reuters reports that Japan plans to simulate cyberattacks in response to the PHP flaws.

As of October 23, security researchers were seeing many attack attempts but had not confirmed a successful break-in using these flaws, according to SecurityWeek. That can change quickly, so update soon.

Am I affected?

Your situation	What to do
I just visit websites	Nothing. The flaws affect web servers, not visitors.
My site is on shared hosting	Your host updates PHP. See what to do on shared hosting.
I run my own Windows server, VPS or dedicated server with PHP on IIS	Update PHP yourself. Follow the step-by-step fix.
I run PHP on a Linux server	Update through your Linux distribution’s packages, or check with your vendor.

Fixed PHP versions

PHP branch	Fixed version	What to do
8.5	8.5.12	Update now
8.4	8.4.27	Update now
8.3	8.3.36	Update now
8.2	8.2.35	Update now. Security support ends December 31, 2026, so plan a move to 8.4 or 8.5.
8.1, 8.0, 7.4	No official release	End of life. No ready-made Windows builds. Upgrade to a supported branch.
7.3 and older	No fix	Upgrade to a supported branch.

Sources: PHP project announcement, SOCRadar, watchTowr.

Step-by-step: patch PHP on Windows Server and IIS

IIS runs PHP through FastCGI using php-cgi.exe, which is one of the affected setups. Windows Update does not update PHP, so if you installed PHP yourself, you need to update it yourself.

Before you start: back up your server, and if you can, try these steps on a test server first. A small, separate VPS works well: copy your site over, update PHP there, and check everything works before touching the live server.

Open PowerShell as Administrator (right-click PowerShell → Run as administrator) and run the commands below in the same window, in order.

Step 1: Find the PHP that IIS uses

This lists the PHP that IIS runs through FastCGI. Look for the fullPath value, for example C:\PHP\php-cgi.exe.

& "$env:windir\system32\inetsrv\appcmd.exe" list config /section:system.webServer/fastCgi

Step 2: Check your PHP version

Set your PHP folder (change C:\PHP if Step 1 showed a different folder), then check the version:

$PhpDir = 'C:\PHP'
& "$PhpDir\php-cgi.exe" -v

If the version is older than the fixed version for your branch, continue to Step 3.

Double-check what your website actually uses (optional but recommended). This creates a temporary page, opens it, then deletes it. Change the folder if your site isn’t in the default wwwroot:

$SiteDir = 'C:\inetpub\wwwroot'
Set-Content "$SiteDir\version-check.php" '<?php phpinfo();'
Start-Process 'http://localhost/version-check.php'

Read the version at the top of the page, then delete the file straight away, because phpinfo pages reveal details attackers find useful:

Remove-Item "$SiteDir\version-check.php"

Step 3: Install the Visual C++ Redistributable

Current PHP builds for Windows need Microsoft’s Visual C++ Redistributable. If it’s already installed, this simply updates it:

$ProgressPreference = 'SilentlyContinue'
Invoke-WebRequest 'https://aka.ms/vs/17/release/vc_redist.x64.exe' -OutFile "$env:TEMP\vc_redist.x64.exe" -UseBasicParsing
Start-Process "$env:TEMP\vc_redist.x64.exe" -ArgumentList '/install /quiet /norestart' -Wait

Step 4: Download the fixed PHP version

Set the fixed version for your branch. For IIS, use the x64 Non Thread Safe (NTS) build:

$Version = '8.4.27'
$Zip     = "php-$Version-nts-Win32-vs17-x64.zip"
Invoke-WebRequest "https://windows.php.net/downloads/releases/$Zip" -OutFile "$env:TEMP\$Zip" -UseBasicParsing

Check the file name on windows.php.net before running this. PHP 8.4 and 8.5 builds use vs17 in the name, while older branches may use vs16. If the download fails or your branch isn’t listed, upgrade to 8.4 or 8.5 instead.

Step 5: Swap in the new PHP

This stops IIS (your sites go offline briefly), keeps your old PHP as a dated backup, extracts the new version, and copies your settings across:

$Backup = "$PhpDir-old-$(Get-Date -Format yyyyMMdd-HHmm)"
Stop-Service W3SVC
Move-Item $PhpDir $Backup
Expand-Archive "$env:TEMP\$Zip" -DestinationPath $PhpDir
Copy-Item "$Backup\php.ini" "$PhpDir\php.ini"
Start-Service W3SVC

Extensions: extensions that come with PHP are included in the new download. If you use third-party extensions (extra DLL files you added yourself), only copy them across if they were built for your new PHP version and NTS. Old ones can stop PHP from starting.

Step 6: Confirm the update worked

& "$PhpDir\php-cgi.exe" -v

You should see the new version number. Then open your website and check that it loads normally. You can repeat the phpinfo check from Step 2 to confirm, remembering to delete the file afterwards.

If something goes wrong: roll back

Run this in the same PowerShell window to put your old PHP back while you troubleshoot:

Stop-Service W3SVC
Move-Item $PhpDir "$PhpDir-failed"
Move-Item $Backup $PhpDir
Start-Service W3SVC

If you closed the window, set $PhpDir again and use the backup folder name you’ll see next to your PHP folder (for example C:\PHP-old-20261026-1430).

Steps based on PHP’s IIS installation guide and Techdows.

Can’t update today? Reduce your risk in the meantime

The PHP project is clear that no setting fully protects you. Updating is the only complete fix. If you need a little time:

Restrict access to the site, for example by allowing only your own IP address in Windows Firewall or IIS, or take it offline until it’s updated. The UK’s NCSC recommends taking unpatchable systems offline. On a VPS or dedicated server you control the firewall yourself, so this takes minutes.
Use a web application firewall. Cloudflare has released rules for known attack patterns, available on all plans, including free.
Temporary php.ini changes listed in PHP’s advisory, including lowering post_max_size and setting session.upload_progress.enabled=0, then restarting IIS. Read the official advisory before changing these, as some settings can affect how your site works.

After updating

Check every PHP install on the server, not just your main site. Step 1 lists every PHP version IIS knows about.
Look through your IIS logs (by default in C:\inetpub\logs\LogFiles) for unusual requests from October 17 onward. If anything looks suspicious, or files have changed that you didn’t change, treat the server as possibly compromised and get help.
Delete the downloaded files when you’re happy everything works, and remove the backup folder once you’re sure you won’t need to roll back.
Keep PHP updated from now on. Follow the PHP news page so you hear about the next security release.

On shared hosting? Here’s what you can do

If your site is on shared hosting, you usually can’t update PHP yourself. Your host controls it. You can still protect yourself:

Check your PHP version in your hosting control panel, or with a temporary phpinfo page as in Step 2 (and delete it afterwards).
Ask your host directly whether PHP has been updated to a fixed version, and when. Many hosts publish a status or announcement page for incidents like this.
Choose a newer PHP version if your control panel lets you switch versions, and pick a fixed one.
Add a web application firewall, such as Cloudflare’s free plan, while you wait.

If you find yourself waiting days for a fix with no way to act, that’s worth remembering when you next review your hosting.

Looking ahead: more control, as long as you stay on top of updates

PHP2Shell shows how much it matters who controls your server. Many site owners on shared hosting spent this week waiting for their host to update PHP, unable to do anything themselves. On your own VPS or dedicated server, the decisions are yours:

Patch on your schedule: install a fix the same day it’s released.
Lock things down fast: set your own firewall rules or restrict access while you update.
Stay separate: your sites aren’t affected by other customers’ sites.
Test safely: keep a second server for trying updates before they go live.

That control comes with responsibility: an unpatched server is no safer than any other, so it suits teams who are ready to keep their software updated. For those teams, it means never waiting on someone else when the next urgent fix arrives.

Already running your own server? This week is a good moment to review your setup: a separate test server for trying updates safely, a dedicated server if your sites have outgrown a VPS, or a provider whose support can help when urgent issues like this come up.

FAQ

What is the PHP vulnerability everyone is talking about?

It’s PHP2Shell, two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619) made public on October 21, 2026. They could let an attacker take control of a web server with a single request. Fixed PHP versions were released the same day.

Why did Pokémon apps, Uma Musume and Granblue Fantasy go offline?

Their operators put them into emergency maintenance on October 21 to patch or protect their servers against PHP2Shell. These were precautionary shutdowns, not confirmed hacks. See the full list of games and sites.

Do I need to do anything if I just browse websites?

No. The flaws affect web servers, not visitors’ computers or phones.

Does PHP2Shell affect WordPress?

Yes, if the server runs an affected PHP version. The flaws are in PHP itself, not in WordPress, so updating WordPress or plugins doesn’t fix them. PHP needs to be updated, either by you or by your host.

Does Windows Update fix PHP?

No. PHP is separate software. If you installed it yourself on IIS, you need to update it yourself.

I’m on PHP 8.1. Is there a Windows fix?

Not an official one. PHP 8.1 is end of life, and the PHP project only published minimal source-code fixes, with no ready-made Windows builds. Upgrading to PHP 8.4 or 8.5 is the safest option. Test your site first, since some older plugins and code may need updates.

Is changing php.ini settings enough?

No. The PHP project says no configuration change fully protects you. Treat those settings as a short-term measure until you can update.

Want more control over your servers?

Winserver offers Windows VPS and dedicated servers from our data center in Osaka, Japan, with full administrator access so you can apply updates as soon as they’re released. Compare plans to find a setup that fits your sites.

Compare Windows Server Plans