Quick answer: On 21 October 2026 the PHP project fixed two critical flaws, CVE-2026-109618 and CVE-2026-109619 (nicknamed “PHP2Shell”), that can let an attacker run code on a server without logging in. Because WordPress runs on PHP, almost every WordPress site is potentially exposed. Updating WordPress or plugins does not fix it — the PHP software on your server must be updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a patched build from your host). Ask your host to confirm the patch today, then check your site for signs of compromise.
This is one of the most serious web security events in years. PHP powers roughly 70% of websites, and WordPress alone runs more than 40% of the web. Attacks started before the official patch was even released. The good news: for most WordPress owners on managed or shared hosting, the fix is in your host’s hands, and many hosts patched within hours. Below we explain what happened in plain English, how it affects WordPress specifically, and exactly what to do depending on your type of hosting.
What happened?
PHP is the programming language WordPress is written in. Every time someone visits a WordPress page, a PHP process on the server builds that page. On 21 October 2026, the PHP project published an emergency security advisory and new releases fixing two vulnerabilities rated 9.2 out of 10 on the CVSS v4.0 severity scale. You can read the official notice in the PHP.net news archive.
- CVE-2026-109618 — remote code execution through corrupted memory left behind when an out-of-memory error interrupts a request.
- CVE-2026-109619 — remote code execution through “stale” data that survives after a request ends and is then reused by the next request handled by the same PHP worker.
Security firm Wiz, one of the groups that found the bugs, published a technical write-up calling them PHP2Shell. According to Wiz, the flaws affect PHP versions going back many years, and researchers demonstrated attacks that work before any application code runs — including against test installations of WordPress, Drupal and Joomla. Several research teams reportedly used AI tools to find the bugs and reported them to PHP’s security team in August, which led to the coordinated fix.
Why this matters so much for WordPress
Most WordPress security problems come from a single plugin or theme. You update that plugin and you’re safe. PHP2Shell is different for three reasons:
- It sits below WordPress. The flaw is in PHP itself, so it affects every WordPress site running an unpatched PHP version — no matter how well you maintain your plugins.
- No login is needed. An attacker can send a specially crafted request to any PHP page. Your strong admin passwords and two-factor authentication don’t stop it.
- Attacks began fast. News reports say exploitation attempts started before the patch was public, and network providers saw huge numbers of attack attempts within hours of disclosure. Some government bodies even took websites offline as a precaution.
If an attacker succeeds, they can run their own code on your server. In practice that usually means installing a backdoor, creating hidden admin users, injecting spam or redirect code, stealing database contents or using the server to attack others.
Which versions are affected and which are fixed?
| PHP branch | Fixed version | Status |
|---|---|---|
| 8.5 | 8.5.12 | Supported |
| 8.4 | 8.4.27 | Supported |
| 8.3 | 8.3.36 | Supported |
| 8.2 | 8.2.35 | Security fixes end 31 December 2026 |
| 8.1 and older (including 7.4) | No official release | End of life — upgrade, or use a vendor backport |
PHP’s advisory notes that mod_php setups face the highest risk, but PHP-FPM, php-cgi, FrankenPHP and LiteSpeed environments are also affected. In short: assume your WordPress site is affected until your host confirms otherwise.
Step 1: Find out what PHP version your site uses
- Log in to WordPress and go to Tools → Site Health → Info.
- Open the Server section and look at PHP version.
Important: the version number alone can be misleading. Some hosts apply security backports without changing the version number (for example, a CloudLinux-patched build may still show 8.5.11). If your host says they’ve backported the fix, ask for the build date — it should be 21 October 2026 or later.
Step 2: Act based on your type of hosting
| Your hosting | Who patches PHP? | What you should do |
|---|---|---|
| Managed WordPress hosting | Your host | Check your host’s status page or email; confirm the patch is applied |
| Shared hosting (cPanel, hPanel, etc.) | Your host | Confirm with support; if you can choose your PHP version, select a supported one (8.3+) |
| Managed cloud platforms | Usually the platform — check | Confirm patch status; restart PHP services if the panel asks |
| VPS or dedicated server you manage | You | Back up, update PHP packages, restart PHP-FPM and the web server, verify the version |
| WordPress.com | Automattic | Nothing to do on your side |
Many large hosts announced within hours that they had patched their shared and managed WordPress platforms. If you haven’t heard from yours, contact support and ask a simple question: “Has the PHP security fix for CVE-2026-109618 and CVE-2026-109619 been applied to my account, and have PHP workers been restarted?”
Step 3: If you manage your own server
- Take a snapshot or full backup of files and database (see our backup guide).
- Update PHP through your distribution’s package manager or your control panel to a fixed release.
- Restart every PHP worker (PHP-FPM pools, Apache with mod_php, LiteSpeed) so they load the patched code. Old workers keep running the vulnerable version until restarted.
- Verify with Site Health or a phpinfo check, then delete any phpinfo file you created.
- Plan an upgrade if you’re on PHP 8.2 (end of life soon) or 8.1 and older. Test on a staging site first.
Temporary mitigations (only if you can’t patch yet)
PHP published partial mitigations for servers that can’t be updated immediately. They reduce risk but do not make you safe, and some can affect uploads or memory-heavy plugins, so test carefully:
- Turn off session upload progress: set
session.upload_progress.enabled=0in php.ini or the FPM pool configuration, then restart workers. Setting it in a plugin, .user.ini or with ini_set does not count. - Tighten request size limits such as
post_max_sizeandupload_max_filesizeas described in the official advisory. - Put the site behind a web application firewall. Large edge providers rolled out rules to block known attack patterns.
If none of this is possible, the PHP project’s own advice is blunt: patch now or take the site offline until you can.
Step 4: Check your WordPress site for signs of compromise
Because attacks started before many servers were patched, it’s worth checking your site even after the fix is applied. Look for:
- New or unknown administrator accounts under Users.
- Unfamiliar PHP files in the site root, wp-content or wp-content/uploads (uploads should never contain PHP files).
- Modified core files — a security plugin can compare core files against official copies.
- Redirects or spam when visiting from Google on a phone. See our guide to a WordPress site redirecting to spam.
- Server signals your host may see: bursts of HTTP 500 errors, memory-limit errors after multipart requests, unusually large session cookies and frequent PHP worker restarts.
If anything looks wrong, change all passwords (WordPress, hosting, SFTP, database), regenerate your security keys in wp-config.php and restore a clean backup from before 20 October, or use a professional malware removal service.
What PHP2Shell does not mean
- It doesn’t mean WordPress is insecure. WordPress core wasn’t the problem; the flaw is in the language runtime used by most of the web.
- It doesn’t mean you must rebuild your site. Most sites only need a patched server.
- Security plugins alone can’t fix it. Some can help detect a compromise, but the flaw can be triggered before WordPress or any plugin loads.
Lessons for every WordPress site owner
This event is a reminder that WordPress security has layers — core, plugins, themes, PHP, the web server and the hosting company itself. A few habits make a big difference when the next emergency arrives:
- Choose a host that patches fast and communicates clearly. Compare options in our best WordPress hosting guide.
- Stay on a supported PHP version. End-of-life versions get no official fixes.
- Keep off-site backups going back at least 30 days so you can restore a clean copy.
- Follow trusted security news — see where to track WordPress vulnerability news.
- Work through a regular checklist like our WordPress security checklist.
FAQ
Do I need to update WordPress or my plugins to fix PHP2Shell?
No. Keep them updated anyway, but this fix happens at the server level. Only a patched PHP version protects you.
My site shows an older PHP version number. Am I still vulnerable?
Not necessarily. Some hosts backport fixes without changing the version number. Ask your host to confirm the build date is 21 October 2026 or later.
Is my site safe on WordPress.com or a big managed host?
Large managed platforms patch their own servers, and many confirmed this within hours. Check your host’s announcements to be sure.
Should I take my site offline?
Only if you can’t patch and your host can’t either. Taking the site down temporarily is safer than running an exposed server.
Was my site hacked?
Most sites weren’t, but because exploitation began early, run the checks in Step 4. If you find anything suspicious, treat it as a full security incident.
This article reflects the official PHP advisory and published research as of 23 October 2026. We will update it as hosts, the PHP project and security researchers share more details.
WordPressPrime.com is an independent guide and is not affiliated with the WordPress Foundation, WordPress.org or Automattic. Always back up your website before making changes, and check official sources for the latest details.
