If your WordPress site runs on PHP, and every WordPress site does, PHP2Shell is the security story of October 2026 worth ten minutes of your day. The fix is not a plugin and not a WordPress update. It lives on your server, which is exactly why so many site owners are unsure whether they are covered.
Here is the short version for PHP2Shell and WordPress: on October 21, 2026 the PHP project shipped emergency releases (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35) for two critical flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. They can let an attacker run code on a server without logging in. If your host has installed one of those versions and restarted PHP, you are covered. If not, you are not, no matter how up to date your plugins are.
What PHP2Shell actually is, in plain words
PHP is the language WordPress is written in. Your host runs it on the server, separately from WordPress itself. PHP2Shell is the nickname for two bugs in how PHP handles incoming requests. One can be triggered when PHP runs out of memory part way through reading a request. The other leaves bits of a previous request lying around for the next one to trip over. Either can be pushed into running an attacker’s commands.
According to the official PHP security advisory, every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, LiteSpeed and FrankenPHP. The PHP team rates the risk highest on Apache with mod_php, where a single request can trigger the attack before WordPress even loads.
Is my WordPress site at risk from PHP2Shell?
The honest answer depends on two things: your PHP version and whether your host has patched it. So far the news is calmer than the headlines. Wordfence, which protects more than 5 million WordPress sites, reported on October 28 that it is not aware of any WordPress site compromised through PHP2Shell. It is, however, still seeing tens of thousands of scanning and exploit attempts, many of them trying to read wp-config.php, the file that holds your database password.
Attempts are not break-ins. But “nobody has been hit yet” is a poor reason to leave a server unpatched while bots are actively knocking.
The sites with a real problem: PHP 8.1 and older
PHP 8.1 and every older version no longer receive updates from the PHP project. Some hosts and Linux vendors backport fixes on their own, and the PHP team published minimal source patches for 7.4, 8.0 and 8.1 because of the severity, but most site owners have no way to confirm their host applied them. If your site is still on PHP 8.1 or older, this is the push to move to a supported version. We already moved every site we host to PHP 8.4 this month, and most modern themes and plugins are happy there.
How to check your PHP version in WordPress
This takes under a minute and needs no technical skills.
- In your WordPress dashboard, go to Tools, then Site Health, then the Info tab, and open the Server section. Note the PHP version.
- If it shows 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer, you are on a patched release.
- If it shows an older number in the same family, ask your host whether the October 21 fix is installed. Some hosts patch through their own packages without changing the number you see.
- If it shows 8.1, 8.0 or anything starting with 7, plan an upgrade to PHP 8.3 or newer, and test your site first.
One detail that trips people up: updating WordPress, or installing a security plugin, does not update PHP. Only the server can be fixed, and the PHP team notes that every PHP worker has to be restarted after the update for it to take effect.
What to ask your host, word for word
Hosting support gets a lot of vague tickets this week. A precise one gets a precise answer. Try something like: “Has PHP on my plan been updated to a release that fixes CVE-2026-109618 and CVE-2026-109619, and have the PHP workers been restarted?” If the reply is anything other than a clear yes, ask when it will be, or whether they can move you to a patched version today.
If your host cannot patch quickly, the PHP advisory lists temporary measures, such as turning off session upload progress in your PHP settings. They reduce exposure but the PHP team is clear that they do not make a server safe. Treat them as a stopgap, not a fix.
Why this keeps happening, and how to stop worrying about it
PHP2Shell is not a one-off. PHP 8.2 itself stops receiving security fixes on December 31, 2026, so another version upgrade is already on the calendar for many sites. Server-level updates like this are easy to miss because they sit outside the WordPress dashboard, and nobody gets an email about them.
That gap is the reason our care and maintenance plans include hosting on supported PHP versions, uptime checks every five minutes and daily security scans. When a release like this lands, it is our job to check and patch it, not yours.
Not sure where your site stands? Send us your URL and we will tell you which PHP version it runs and what, if anything, needs doing. You can book a free 30-minute call or have a look at our pricing first.
