Two critical bugs in PHP, the language almost every WordPress site runs on, were made public this week. If you own a WordPress site, the fix is not a plugin or a WordPress update. It is the PHP version on your server, and you need to know which one you are running.
Not sure if your site is patched? I’ll check your PHP version and hosting setup and tell you exactly what needs doing. Get in touch.
What happened
On October 21, 2026, the PHP project released fixes for two vulnerabilities nicknamed php2shell (CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10). In plain terms: a stranger can send one specially built request to a vulnerable server and run their own code on it, without logging in and before WordPress even loads. That can mean a defaced or hijacked site, stolen data, or a site that simply falls over. Proof-of-concept code is already public, and Cloudflare reports seeing attack traffic aimed at its customers.
The US cybersecurity agency CISA says to patch immediately, and to take systems offline if they cannot be updated.
Is my WordPress site affected?
Almost certainly, unless your host has already updated PHP. The bugs affect every PHP version from 5.4 through 8.5.11 that serves web pages, which covers essentially every WordPress site on the internet.
WordPress itself is not the problem. WordPress.org confirms no WordPress update is required or planned. The bug lives in the PHP software underneath, so the people who control your server have to update it. On managed hosting, that is your host. If you run your own server or VPS, that is you.
How to check your PHP version
Inside WordPress, this takes under a minute:
- Log in to your WordPress dashboard as an administrator.
- Go to Tools → Site Health.
- Click the Info tab, then open the Server section.
- Find the line that says PHP version. You want the full number, such as 8.2.35, not just 8.2.
Most hosting dashboards also show it. Look for “PHP version”, “PHP settings”, or in cPanel, “MultiPHP Manager” or “Select PHP Version”. Those screens often show only the branch (8.2, 8.3), so Site Health is the better place to read the exact version.
One wrinkle: some hosts and Linux distributions patch PHP without changing the version number you see. If your number looks old but your host says you are covered, ask them in writing whether the fix for CVE-2026-109618 and CVE-2026-109619 is applied to your server.
What “patched” looks like
Your site is on a fixed release if its PHP version is at least the number below for its branch:
| Your PHP branch | Fixed version (or newer) |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 or older | No official fix. Upgrade the branch. |
Still on PHP 8.1 or older?
PHP 8.1 and earlier are end of life, so the PHP project is not shipping an official release for them. Some hosts and Linux vendors may backport a fix, but you should not count on it. The real answer is to move to PHP 8.2 or newer.
Do not flip that switch on your live site blind. Older themes and plugins are the usual reason a site is still on an old PHP version, and a jump of several versions can break them. Copy the site to staging, switch staging to the new PHP version, click through the pages that matter (forms, checkout, anything that makes you money), then update live.
If your host cannot offer a supported PHP version at all, that is your sign to move. A WordPress migration to a host that keeps PHP current is often faster than fighting an old server.
Does a firewall protect me?
It helps, but only for now. Cloudflare turned on blocking rules for php2shell for every plan, including Free, on October 21. Other web application firewalls (WAFs) and many managed hosts have done similar things.
A firewall only filters the traffic that goes through it. If your site isn’t proxied through it, or an attacker can reach your server directly, the rule does nothing. And attackers keep changing their requests to slip past rules. Treat a WAF as a seatbelt while you get PHP updated, not as the fix.
Signs something already went wrong
Patching stops new attacks. It does not undo one that already happened. Look for:
- Administrator accounts in Users that nobody on your team created
- New or recently changed PHP files you did not add, especially in the uploads folder
- Visitors (or Google) being redirected to unrelated sites, often only on mobile
- Spam pages in search results for your domain, such as pharmacy or casino pages
- Warnings from your host, Google Search Console, or your browser about malware
- A sudden spike in server load or outgoing email
If you see any of these, don’t just delete the obvious file and move on. Change passwords, restore from a clean backup if you have one, and get a proper cleanup. Bad form submissions are a related but different problem; I covered those in how to stop WordPress form spam.
A short checklist
- Check your exact PHP version in Tools → Site Health → Info → Server.
- Compare it to the table above. If it’s lower, ask your host to update now, or update it yourself.
- On PHP 8.1 or older, test PHP 8.2 or newer on staging, then upgrade live.
- Keep your firewall or Cloudflare protection on while you patch.
- Look for the warning signs above, even after patching.
- Confirm you have a recent backup you can actually restore.
FAQ
If it runs PHP 5.4 through 8.5.11 and your host has not applied the fix, yes. Check the exact version under Tools → Site Health → Info → Server and compare it to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 for your branch.
Not for this. WordPress.org says no WordPress update is required for php2shell, because the bug is in PHP itself. Keep WordPress and plugins updated anyway, but the fix here is updating PHP.
Confirm it. Check your PHP version in Site Health, and if the number looks older than the fixed versions, ask your host in writing whether the fix for CVE-2026-109618 and CVE-2026-109619 is applied. Then check for the warning signs of a compromise.
Keep a firewall in front of the site as a short-term measure and plan a move. A host that can’t run a supported, patched PHP version is a security risk beyond this one bug.
Want someone to just handle it?
Bugs like this are why I run WordPress care & security retainers. When something critical lands, retainer clients get checked and patched first, without the scramble.
Not sure if your site is patched? I’ll check your PHP version and hosting setup and tell you exactly what needs doing. Get in touch.
Sources: CISA, CERT-EU, WordPress.org, Cloudflare.