PHP2Shell, how to check and patch your WordPress site

# TagsSecurityWordPressPHP

The WPhost team22 Oct 202610 min read

PHP2Shell is the name the researchers who found them gave to two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. The PHP team fixed them on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both can let an attacker run their own code on the server without logging in to the site. Every WordPress site and every WooCommerce shop runs on PHP, so each one is exposed until its server gets the fix.

Below you will find which PHP versions are safe, how to check your site and exactly what to ask your host. What was announced before the release, and how long each PHP version is supported, is in our post from 21 October.

What PHP2Shell is

Both flaws sit in the core of PHP, underneath WordPress, the theme and the plugins. The first is triggered when PHP runs out of memory in the middle of a request and then treats half-prepared internal data as valid. In the second, data from one request stays behind in the process, and the next request handled by that process can use it.

The PHP team rates both 9.2 on CVSS v4.0, and NVD also gives them 9.8 on the older version 3.1 of the scale. Every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest for mod_php, where an attack has been demonstrated that an unauthenticated request triggers before any application code runs. For WordPress, that means a security plugin cannot stop it, because WordPress has not even loaded yet.

As of 22 October, php.net, NVD and CISA report no confirmed attacks. The write-ups of the flaws and the code changes are public now, though, so do not wait for the first attacks before you update.

Is your site affected?

Every version before the fixed ones is affected.

PHP branch	Fixed version	Last version without the fix
8.5	8.5.12	8.5.11
8.4	8.4.27	8.4.26
8.3	8.3.36	8.3.35
8.2	8.2.35	8.2.34
8.1 and older	none	no longer supported by the PHP team

PHP 8.6.0 RC4 also contains the fixes, but it is a test release and not meant for live sites.

The number alone does not tell the whole story. Linux distributions often build fixes into their own packages and keep the old version number. CloudLinux also supplies security patches for older ea-php versions that cPanel no longer supports. So a site that looks vulnerable by its number may already be protected, and only your host knows for certain.

Check your site with our free checker

Enter your site's address on our PHP version checker. It sends one ordinary request, the same kind any browser makes, and reads the PHP version the server itself announces in the X-Powered-By header. It does not attack the site or test the flaw. You get one of five results.

This version is affected. The number is older than the fixed one for its branch. Ask your host whether the package already includes the fix, since it may have been applied without changing the number.
This version has the fix. The number matches the fixed version for its branch or is later.
This version no longer gets fixes. The site runs PHP 8.1 or older, which the PHP team no longer fixes.
The version is hidden. The server does not announce its version, and many servers are set up that way. The checker cannot tell you more in that case, so look the version up in WordPress or cPanel.
The number is not enough to tell. The server announces a branch where the number does not show whether the fix is applied, such as the 8.6 test releases. Ask your host in that case.

How to see the version in WordPress and cPanel

If the checker shows a hidden version, or you want to confirm the result, open Tools > Site Health in the WordPress admin, then the Info tab and the Server section. The PHP version row shows the full number, for example 8.4.27.

In cPanel, the selected branch is shown in MultiPHP Manager or Select PHP Version, depending on the server. It usually shows only the branch, such as 8.4, so rely on Site Health for the full number. Both places, and how to switch versions, are covered in the PHP version guide.

How to get the fix

On shared hosting you cannot update PHP yourself. Write to your host and ask specifically whether the fixed PHP packages for CVE-2026-109618 and CVE-2026-109619 are installed on your server. On cPanel servers these are the EasyApache 4 ea-php packages, and on CloudLinux servers the alt-php packages as well. Asking by CVE number lets your host give you a precise answer even if its package still carries the old version number.

If the site is on its own server or a VPS, whoever looks after it needs to install the updated packages from the distribution and restart PHP-FPM or Apache so the new version takes effect. The distributions received the patches in advance, so check for updated packages today.

If the site runs 8.1 or older, move to 8.3 or 8.4. The PHP team published minimal source backports for 7.4, 8.0 and 8.1, but they are for people who compile PHP themselves and are not something you pick in cPanel. Take a backup first, following the backup guide, and after the switch go through the forms, the cart and checkout.

If you run a server and cannot update straight away, php.net lists temporary settings such as memory_limit=-1 set by the administrator, a low post_max_size, session.upload_progress.enabled=0 in php.ini and, on PHP 8.5, fatal_error_backtraces=0. They close specific attack paths only and do not replace the update. This is a job for your host, and there is nothing to change in WordPress.

What to do

Check your site with the PHP version checker, or look the version up in Site Health.
Compare the number with the table above.
If the number is older than the fixed one, write to your host and ask about the fix by CVE number.
If the site runs 8.1 or older, take a backup and plan the move to 8.3 or 8.4.
Once your host confirms, check again.

What we do

With WordPress maintenance we update PHP on the server when we look after the server too, and we change the site's PHP version with a backup, trying it in staging first. On shared hosting the PHP packages themselves are updated by the host. If you notice unfamiliar administrators or files on your site, work through the guide for a hacked site or see emergency help.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the name the researchers gave to two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. Both can let an attacker run their own code on the server without logging in to the site. The PHP team rates them 9.2 on CVSS v4.0, and NVD also gives them 9.8 on the older version 3.1.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released by the PHP team on 21 October 2026. Every earlier version in those branches is affected. PHP 8.1 and older branches have no fixed version, because the PHP team no longer supports them.

Is every WordPress site affected by PHP2Shell?

Every WordPress site and every WooCommerce shop runs on PHP, so each one is exposed until its server gets the fix. The risk covers every installation serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It is highest for mod_php, where an attack has been demonstrated that fires before any application code runs.

Can a security plugin stop PHP2Shell?

No. With mod_php the attack is triggered by an unauthenticated request before any application code runs, in other words before WordPress has even loaded. So a WordPress security plugin cannot stop it, and the only real protection is a patched PHP.

Why does my site look vulnerable by its PHP number when my host says it is not?

Linux distributions often build fixes into their own packages and keep the old version number. CloudLinux also supplies security patches for older ea-php versions that cPanel no longer supports. So a site that looks vulnerable by its number may already be protected, and only your host knows for certain.

How do I check my site's PHP version?

Enter the site's address on WPHost's PHP version checker, which sends one ordinary request and reads the version from the X-Powered-By header without attacking the site. The full number, for example 8.4.27, is also shown in wp-admin under Tools > Site Health, the Info tab and the Server section. In cPanel, MultiPHP Manager or Select PHP Version usually shows only the branch, such as 8.4.

What should I ask my host about PHP2Shell?

Ask specifically whether the fixed PHP packages for CVE-2026-109618 and CVE-2026-109619 are installed on your server. On cPanel servers these are the EasyApache 4 ea-php packages, and on CloudLinux servers the alt-php packages too. Asking by CVE number lets your host give a precise answer even if its package still carries the old version number.

What if my site runs PHP 8.1 or older?

Move to PHP 8.3 or 8.4. The PHP team published minimal source backports for 7.4, 8.0 and 8.1, but they are for people who compile PHP themselves and cannot be picked in cPanel. Take a backup before the switch, and afterwards go through the forms, the cart and checkout.

Sources