PHP2Shell and WordPress: How to Protect Your Site Today.

PHP2Shell is a pair of critical PHP flaws that attackers have been trying to exploit since October 17, 2026. It has already pushed governments in Europe to take websites offline. Every WordPress site runs on PHP, and updating WordPress or your plugins won't fix it.

This PHP2Shell WordPress guide explains what the flaw is, which PHP version is safe and how to update PHP on your hosting account.

Quick summary

• The problem: two critical PHP vulnerabilities let attackers take over a server without a login or password.
• Who is affected: any site on an unpatched PHP version, including WordPress sites.
• The fix: update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. PHP 8.3 or newer is the better choice.
• Where to do it: in your hosting control panel, not inside WordPress.

What is PHP2Shell?

PHP2Shell is the name given to two PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Each one is rated 9.2 out of 10 for severity.

Both allow remote code execution: an attacker can run commands on the server without logging in. From there they can change the site, plant malicious files and read data from server memory, such as passwords, tokens and API keys.

The flaws were found independently in August by the security firm Calif and by OpenAI. The official PHP security release came out on October 21, 2026.

The reach is huge because PHP powers about 69% of websites whose server-side language is known, according to W3Techs. That includes every WordPress site.

PHP2Shell is already being exploited

• Amazon saw the first exploitation attempt on October 17, four days before public disclosure.
• On release day, Cloudflare and watchTowr were already seeing exploitation attempts.
• Researcher Silas Cutler estimates more than 1.3 million internet-exposed servers may be vulnerable.
• France, the Netherlands and Finland took government websites offline as a precaution while they patched.

If your site went down this week, your host may have been applying the emergency update. Your host's support team can confirm.

Does updating WordPress fix PHP2Shell?

No. The flaw is in PHP itself, the server software that runs your site. WordPress, your theme and your plugins all run on top of it, so no update inside WordPress can fix it, and security plugins can't block it.

The fix depends on the PHP version installed on your server. The PHP security team says updating is the only complete protection.

Which PHP version is safe?

These PHP releases are patched against PHP2Shell:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

PHP 8.1 and older did not get an official patched release. PHP 8.2 loses security support on December 31, 2026. My recommendation is to move straight to PHP 8.3 or newer.

How to check your PHP version in WordPress

In your WordPress dashboard, go to Tools › Site Health › Info › Server. The PHP version is listed there. In cPanel, you can also see it under MultiPHP Manager.

How to update PHP on your host

First, take a full backup of your files and database. Then follow the path for your control panel:

• cPanel (HostGator, GoDaddy and many others): MultiPHP Manager › select your domain › choose the PHP version › Apply.
• Hostinger: hPanel › Advanced › PHP Configuration › choose the version › Save.
• Plesk: Websites & Domains › PHP › choose the version › Apply.
• Managed WordPress hosting: the host usually updates PHP for you. Ask support to confirm the patched build is live.

After switching, test your forms, login, checkout and outgoing email.

Keep in mind that picking 8.3 in the panel doesn't guarantee the fix. Your host must have installed the patched build, which is 8.3.36 or newer. If in doubt, ask support.

If the patched version isn't available, open a ticket

Contact your host's support today. Here is a message you can copy:

Please update PHP for [your domain] to a release patched against PHP2Shell (CVE-2026-109618 and CVE-2026-109619), version 8.3.36 or newer.

Temporary protection until PHP is updated

These steps lower the risk but don't replace the update:

• Cloudflare: if your site runs through Cloudflare, turn on the WAF rules it released for PHP2Shell. They are available on the free plan too.
• PHP setting: ask support to disable session.upload_progress.enabled.
• High-risk sites: if the site holds sensitive data and your host has no patch date, consider putting it in maintenance mode until it's updated.

After you update PHP

As a precaution, change your WordPress admin password, your database password and any API keys the site uses. Do this only after PHP is patched.

Also check for admin users you don't recognize and for .php files inside wp-content/uploads, a folder that normally holds only images.

PHP2Shell WordPress FAQ

What is PHP2Shell?

It's the name for two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that let attackers run code on a server without logging in. The fix was released on October 21, 2026.

Will updating my WordPress plugins fix it?

No. The flaw is in the server's PHP. The fix is done at your host by switching to a patched version.

Which PHP version is safe?

8.2.35, 8.3.36, 8.4.27 or 8.5.12. Since 8.2 reaches end of support at the end of 2026, 8.3 or newer is the better choice.

My site went offline. Is it related?

It may be. Many hosts and public agencies put sites in maintenance mode to apply the emergency update. Your host's support can confirm.

Do website visitors need to do anything?

No. The fix is the responsibility of whoever runs the site and the server.

Need help updating PHP?

If you're not sure where to start, I can check your site's PHP version and walk you through the update. Just get in touch.

And if you know someone who runs a website, send this article to their IT team or whoever manages their hosting.

Sources: Tenable, The Hacker News, Help Net Security, Malwarebytes and xCloud.