PHP2Shell: Umbraco sites unaffected, PHP sites already protected

What is PHP2Shell?

PHP2Shell is a pair of remote code execution vulnerabilities in the PHP core, each rated 9.2 out of 10 under CVSS v4.0. In the worst case, an attacker can run their own code on a vulnerable server without logging in to anything.

The most widely discussed attack path abuses PHP's session upload progress feature. It is switched on by default in almost every PHP installation since PHP 5.4 (released in 2012), and it does its work while PHP is still reading an incoming request, before your website's own code has even started. That is what makes this one serious: a perfectly patched WordPress site can still be exposed if the PHP underneath it isn't.

Affected versions: PHP 5.4.0 up to and including 8.5.11.

Fixed versions: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released on 21 October 2026.

PHP 8.1 and older are end of life and will not receive official fixes. If you are still running one of these anywhere, this is a very good reason to upgrade.

It is worth knowing that disabling session upload progress only closes some of the attack paths. The PHP security team has been clear that updating PHP is the only complete fix, so treat any workaround as a stopgap.

Umbraco and .NET hosting: not affected

Umbraco is built on .NET, not PHP. None of the servers behind our Umbraco hosting, including our shared and dedicated Windows platforms and our GreenStack Docker platform, run PHP at all. The same applies to the Kentico, Optimizely and native .NET applications we host.

There is simply no vulnerable PHP runtime there to attack, so no action is needed for any Umbraco or .NET site hosted with UmbHost.

Extra protection at the edge with Cloudflare WAF

Even though our .NET platforms can't be exploited this way, our hosting platforms are fronted by Cloudflare, and Cloudflare has been part of the coordinated industry response to PHP2Shell from the start. Its WAF protections went live at 03:02 UTC on 21 October, around nine hours before the vulnerabilities were made public, and they are switched on by default for every Cloudflare plan that uses the WAF, including the free plan.

The new rules use a Cloudflare capability called full transaction detection, which looks at both the incoming request and the server's response. That lets Cloudflare tell real exploit attempts apart from normal traffic more reliably, and block a malicious response before it ever reaches the attacker. Cloudflare has also reported attackers tweaking their payloads to try to slip past detection, and is updating the rules as new variations appear.

We run Cloudflare's Managed Ruleset in block mode, so these protections were already active at our edge before PHP2Shell became public knowledge. For our Umbraco customers, that simply means exploit traffic is turned away by Cloudflare and never reaches our servers. Like Cloudflare, though, we see a WAF as an extra layer of defence rather than a replacement for patching, which is why the PHP updates below still matter. You can read more in Cloudflare's announcement.

PHP and WordPress hosting: protected and patched

For customers on our Linux, WordPress and other PHP hosting, protection was already in place before today's release:

• Session upload progress is disabled by default across the platform, closing off the primary attack path.
• StackProtect WAF rules block any request containing PHP_SESSION_UPLOAD_PROGRESS payloads, so exploit attempts are rejected before they reach your site.
• The official PHP security updates are being rolled out to every server automatically, with backported fixes applied where needed for older PHP versions.

You don't need to change any settings or request an update. It is all handled at platform level, and we are continuing to monitor the situation.

Do you need to do anything?

If all of your sites are hosted with UmbHost: no.

If you also run PHP sites elsewhere, we would recommend:

• Checking which PHP version each site runs and updating to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or newer) as soon as possible.
• Planning an upgrade for anything still on PHP 8.1 or older, as these versions won't receive official fixes.
• Asking your host what they have done about PHP2Shell, if they haven't already told you.

As always, if you have any questions or want us to check something for you, just get in touch with our support team.