PHP2Shell: what WordPress site owners should do right now

PHP2Shell is the name security researchers gave to two critical flaws in PHP, the programming language WordPress is built on. They are tracked as CVE-2026-109618 and CVE-2026-109619. Both score 9.2 out of 10 on the CVSS v4.0 scale, and both can let an attacker run code on a server without logging in.

Here is how they work, without the jargon. The first flaw comes from how PHP behaves when it runs out of memory halfway through reading a request. The second lets data from one request stay in memory after PHP has released it, so a later request on the same worker can use it. The details leaked on 20 October, before a fix existed. PHP released patched versions on 21 October 2026.

WordPress itself is not the faulty part, but WordPress sites are affected because they run on PHP. WordPress published a note on 21 October saying it is not releasing an update for these flaws and none is planned. The fix is a newer PHP version on your server, which your host usually controls.

The flaws are in PHP, so they reach any PHP application. Huntress reports that researchers at Wiz showed the attack working against WordPress, Drupal and Joomla, and names Magento as another PHP platform. The PHP project says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php and php-cgi.

• 9.2

  CVSS v4.0 score of each PHP2Shell flaw, out of 10

  PHP project, 20 October 2026

• 4

  PHP releases carry the fix: 8.2.35, 8.3.36, 8.4.27, 8.5.12

  PHP project, 21 October 2026

• 39.6%

  of all websites use WordPress

  W3Techs, 22 October 2026

• 69.3%

  of sites with a known server-side language use PHP

  W3Techs, 22 October 2026

• 34.7%

  of PHP sites run PHP 7 or older

  W3Techs, 22 October 2026

• 5 hours

  weighted median time to first exploit, heavily exploited flaws

  Patchstack, State of WordPress Security in 2026

PHP fixed PHP2Shell in four releases on 21 October 2026: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. If your site runs one of those releases, or a later one in the same line, you have the fix. PHP 8.1 and older no longer get updates from the PHP project, so those sites need a different plan.

Reports of attacks on PHP2Shell have emerged, but accounts differ. watchTowr said on 21 October that it was observing active exploitation attempts of both flaws. Huntress said that at 4:30 pm US Eastern the same day it had not seen exploitation across its own partners, though it noted others reporting attacks. Treat it as urgent.

The reason to move quickly is history, not this one report. Patchstack puts the weighted median time from disclosure to first exploit at 5 hours for the WordPress vulnerabilities that attackers use most. The PHP2Shell details were public before the fix was, so waiting for a confirmed attack on your own site is the wrong test.

Today, ask your host to confirm PHP is on a fixed version, or check it yourself in WordPress under Tools, Site Health, Info, Server. Take a backup, then look for new administrator accounts and unfamiliar files. If you run your own server on PHP 8.1 or older, plan an upgrade now.

1. Check your PHP versionIn WordPress, open Tools, then Site Health, then Info, then Server. Your hosting control panel shows it too. Compare it with the table above.
2. Ask your host in writingWordPress says hosts may already be updating PHP and adding web application firewall rules. A firewall rule is not the same as a patched PHP, so ask which version your site runs now.
3. Take a backup before you change anythingKeep one copy of the files and the database as they are today, so you can go back if an update breaks a plugin.
4. Look for signs of troubleHuntress lists new accounts, new files in the web root and new scheduled tasks. WordPress adds new users you did not create, a host that has disabled your site and warnings from Google.
5. Update PHP, then keep everything else currentPlugins and themes can break on a newer PHP, so test first if you can. WordPress, plugins and themes still need their normal updates, because they are separate risks.
6. If you are on PHP 8.1 or older, make a plan this weekThe PHP project no longer supports those lines. WordPress notes that PHP 8.2 is the oldest line still getting security updates.

If you manage your own server on an older PHP and cannot upgrade quickly, WordPress's note quotes the UK National Cyber Security Centre's advice to consider taking the system offline until it is fully mitigated. That is a call for your developer or host. Weigh a day of maintenance page against the risk of leaving the flaw open.

Look for the signs WordPress and Huntress list: new administrator users you did not create, new files in your web root, unfamiliar scheduled tasks, and warnings from Google or your host. A site that sends spam or redirects visitors is also a sign. If you see any of them, follow our first-24-hours guide.

PHP2Shell shows that a website's risk includes the server underneath it, not only the plugins on top. A site built on PHP and a database needs patching at every layer. A site made of pre-built files has no PHP running when someone opens a page, so a flaw like this has nothing to run in.

Whatever you decide, someone needs to own the layer underneath. If that is your host, ask how quickly they apply PHP updates and get the answer in writing. If you want that responsibility off your plate completely, that is a fair reason to move.

That is how the sites we build and host work. Unpress, a modern, secure CMS, serves pre-built pages with no PHP and no database on the public site, so PHP2Shell is not a risk to them. How Unpress keeps a site secure has the detail, and if you would rather leave WordPress, we will move your site for you. Moving a site safely keeps its rankings, which is the job of our SEO work.