PHP2Shell: Is Your WordPress Site Safe? Check and Patch It in 10 Minutes

On 21 October 2026, PHP released emergency patches for two critical flaws called PHP2Shell. Both score 9.2 out of 10. Both allow an attacker to run code on a server without a password or an account. Exploitation was reported the same day, and Cloudflare recorded attempts rising from thousands before disclosure to millions after it.

If you own a WordPress site, read this as a patch notice, not as news. Your next step takes 10 minutes.

What to do today

• Check your PHP version in WordPress under Tools, Site Health, Info, Server.
• Compare the full version number with the fixed versions table below.
• Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, matching your current branch.
• Restart PHP workers, then confirm the new version is live.
• If you are on PHP 8.1 or older, start an upgrade plan now. There is no normal official fix for those branches.

Updating WordPress, your theme or your plugins does not fix PHP2Shell. WordPress confirmed no core update is required or planned for this issue, because the flaw sits in PHP itself.

What happened

• 20 October 2026: Details leaked online before the planned disclosure, before a patch existed.
• 21 October 2026 at 14:00 UTC: PHP moved the release forward and shipped fixes for branches 8.5, 8.4, 8.3 and 8.2.
• 21 to 22 October 2026: The UK National Cyber Security Centre, CERT-EU and the US National Security Agency advised organisations to patch immediately, or take internet facing PHP systems offline until they could.
• Government sites in Europe took precautionary downtime while they patched.
• The flaws had remained undetected for more than a decade. AI assisted research by Wiz and Calif helped locate them, and the findings were coordinated with the PHP team before disclosure.

Why this flaw affects so many sites

PHP powers about 75 percent of websites whose server language can be identified. WordPress alone powers about 43 percent of all websites. The flaws affect versions dating back to PHP 5.

The affected setups include WordPress, WooCommerce, Drupal, Joomla, Magento, Laravel, Symfony and custom PHP applications. They also include PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.

A security plugin cannot patch the PHP engine. A plugin runs on top of PHP. The fix has to happen at server level, by your host or by you if you manage your own server.

The two flaws are:

• CVE-2026-109618: Remote code execution through out of memory corruption. A memory error can leave partly initialised internal data behind, which PHP later treats as valid.
• CVE-2026-109619: Remote code execution through stale global state. A fatal error at the wrong point can leave internal state pointing to memory from a previous request.

Check your PHP version in 2 minutes

Use the version that serves your website, not the version on your local computer.

Method 1, WordPress: Go to Tools, Site Health, Info, Server. Note the full number, for example 8.3.36, not just 8.3. The final part shows the patch level, and that part tells you whether the October fix is installed.

Method 2, hosting panel: Look for PHP version, Select PHP Version or MultiPHP Manager in cPanel, Plesk or your host dashboard. It shows the version per domain.

Method 3, ask your host: Do not rely only on php -v in a terminal. Terminal PHP can differ from website PHP. Send your host this exact question: "Is the PHP service serving my site patched for CVE-2026-109618 and CVE-2026-109619, and has PHP been restarted?"

One nuance matters. Some hosts backport the fix without changing the version number. Some Hostinger sites still showed 8.5.11 after patching, because the fix was in the build. If the build date is 21 October 2026 or later, or your host confirms the package revision in writing, that can mean patched. If you cannot get that confirmation, treat the site as unpatched.

Fixed PHP versions

• PHP 8.5: fixed in 8.5.12
• PHP 8.4: fixed in 8.4.27
• PHP 8.3: fixed in 8.3.36
• PHP 8.2: fixed in 8.2.35. Security support for 8.2 ends 31 December 2026, so plan a move to 8.3 or 8.4 now.
• PHP 8.1 and older: no official fix. Use a vendor backport if your host or Linux distribution provides one, or upgrade.

WordPress data from 22 October 2026 puts 36.4 percent of WordPress sites on 8.1 or older and 23.8 percent on 8.2. Together, that is about 60 percent of sites on a branch that is either already unsupported or losing security support within weeks. That is the real exposure behind the headlines.

How to patch

Step 1, back up first: Take a full backup of files and database, and confirm you can restore it. Test the home page, login and checkout after the change, because a PHP version change can break old themes or plugins.

Step 2, managed or shared hosting: Check your host status page and open a ticket for your specific domain. Most major hosts patched managed servers by 22 to 23 October, but a general status update does not prove your domain is patched. Ask for the patched build in writing. In cPanel MultiPHP Manager you can select PHP 8.3 or 8.4, but the dropdown does not show the exact build, so host confirmation still matters.

Step 3, own server or VPS: Update the PHP packages for your branch, then restart PHP-FPM or your web server. Running PHP processes keep using old code until they restart, so this restart is required, not optional. If you use Docker, rebuild from an updated image. Restarting an old image does not patch it.

Step 4, verify: Check Site Health again and confirm the new version is live. Check every environment, not only the main site. Staging sites, test domains, old microsites and forgotten subdomains need the same check, because attackers scan those too.

If you cannot patch immediately

Use these steps only as temporary cover. None of them replaces the update.

• Disable session.upload_progress in your PHP configuration. PHP recommends this as a temporary mitigation. For most sites, upload progress bars stop working, while uploads themselves continue.
• Put a web application firewall in front of the site. Cloudflare deployed PHP2Shell rules, including on its free plan. A firewall blocks known patterns only. Attackers who reach your origin IP directly bypass it, and new variants may not match.
• Enforce request size limits at your proxy, and restrict internet access to PHP systems that do not need to be public.
• If patching is not possible, consider taking the system offline until it can be fully mitigated, as advised by the NCSC and NSA. A few days offline costs less than a compromised server and database.

If you patched late, preserve evidence

If your site was unpatched between 20 and 23 October, complete these checks before you assume it is safe.

• Preserve web server, PHP, firewall and system logs covering at least 48 hours before the 21 October release, through the time you patched and restarted.
• Review those logs for activity that is unusual for your site.
• A clean log review does not prove no exploitation happened, so stay cautious if the site was internet facing and unpatched for days.
• If you find signs of compromise, isolate the server, keep the logs, and get specialist help before rebuilding. Do not reinstall and hope the problem is gone.
• After isolation, change admin, hosting and database passwords.
• An attack attempt is not the same as a successful breach. With public exploit code circulating, assume internet facing PHP servers are being scanned.

A separate PHP issue from 23 October

On 23 October, PHP detailed a separate issue, CVE-2026-115560. It requires a very specific setup: an application sets the session serialisation handler to php_binary or php_serialize, switches it to php at runtime, and leaves session upload progress enabled. PHP called that setup unlikely in practice, and said a full advisory will come with the next release.

If you already disabled session upload progress, you need no further action for this specific issue. Do not confuse it with PHP2Shell. The urgent fix remains the 21 October update.

Questions owners ask most

Question: Does updating WordPress fix PHP2Shell?

Answer: No. WordPress updates do not replace the PHP runtime.

Question: Does a security plugin fix it?

Answer: No. Plugins cannot patch the engine underneath them.

Question: Does running PHP mean my site is hacked?

Answer: No. It means at risk until patched. Check the version, patch, verify, and review logs if you were late.

Question: Do visitors need to do anything?

Answer: No. Visitors are not being told to stop using the web. Owners and hosts carry the action. Visitors should still watch for password reset or phishing messages that exploit the news.

Question: Will changing PHP break my site?

Answer: It can, with very old themes or plugins. Back up first, test on staging if you have it, and check the home page, login and checkout after the change.

Free PHP Security Check from Webmarksy

If you are unsure which PHP version really serves your site, or whether your host actually patched it, use this check.

Send Webmarksy your website URL through the form below or message us directly on WhatsApp for a quick scan.

Free PHP Security Check on WhatsApp →

You will get a clear answer: your live PHP version, whether it is on a fixed release or needs a vendor backport, and the exact next step for your site.

If your site is already patched, you will be told that as well. No guesswork, no unnecessary work.