PHP2Shell: the critical PHP flaw every WordPress owner should check today
23 Οκτωβρίου 2026 · 2 min read
Updated: 23 October 2026. On 21 October PHP shipped an emergency security release for two critical flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). They let an attacker run code on the server without any login, and attacks have already been observed. If your website or shop runs on PHP, as almost every WordPress and WooCommerce site does, this affects you.
What happened, in plain words
PHP is the language WordPress runs on, on the server. Both flaws are in PHP itself, not in WordPress, a plugin or your theme. That means:
- updating WordPress or plugins does not fix them,
- the only real fix is updating PHP on the server.
Both are rated 9.2 out of 10 (CVSS v4.0). Details leaked before the planned disclosure, and attacks were seen from the morning of 21 October.
Which versions are safe
| PHP branch | Fixed in |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1, 8.0, 7.4 | No official release: safe only if your host applied its own fix |
| 7.3 and older | No fix: upgrade required |
Every way of running PHP on a web server is affected (PHP-FPM, Apache mod_php, LiteSpeed, CGI). Apache with mod_php carries the highest risk.
What to do today
- Check which PHP you run. In WordPress: Tools → Site Health → Info → Server. Or in your hosting control panel.
- Don’t rely on the number alone. Many hosts and Linux distributions apply the fix without changing the version number. Ask your host directly: “Have you applied the 21 October PHP fix (CVE-2026-109618 / 109619)?”
- Own VPS or server: install the updated PHP packages and restart every PHP process (e.g. php-fpm) so the new version is actually running.
- On PHP 8.1 or older: plan the move to 8.2 or newer. Take a full backup, test on staging, and check forms, cart and payments after the switch.
- Behind Cloudflare: managed firewall rules help, but they are an extra layer, not a fix.
How do I know if my site was already hit?
There is no single sure sign, but watch for unknown admin users in WordPress, unknown .php files in the uploads folder, redirects to unrelated sites, sudden server load, or “dangerous site” warnings from Google. If you see any of these, updating PHP is not enough: the site needs cleaning, new passwords and a file review.
Our clients’ sites
Our hosting provider has informed us that its servers are already protected: it applied additional security rules (ModSecurity/Imunify360) and PHP’s recommended interim settings, and installed the fixed PHP builds as soon as the vendors (CloudLinux, cPanel, Plesk) released them. Because some fixes ship as security backports, the PHP version shown in WordPress may differ from the official php.net number without the fix being missing.
If you are not a client and don’t know what your site runs on, send us the address and we’ll tell you what it needs.