PHP2Shell: Is Your WordPress Website Safe From the Latest PHP Vulnerabilities?

Is your site safe from the PHP vulnerabilities affecting WordPress websites? Are you compliant? I can help scan your site and determine what, if any, updates need to be completed to bring it up to the most current and safe version of PHP.

Don’t understand any of this? Don’t worry. I do.

What Is PHP2Shell?

PHP is the programming language that powers WordPress. It runs on the web server behind every WordPress website. On October 21, 2026, the PHP project released emergency security updates for two critical flaws now known as “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). Both are rated critical (CVSS 9.2) and can allow an attacker to run their own code on a web server without ever logging in.

Attacks began almost immediately, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its catalog of known exploited vulnerabilities.

Why It Matters for WordPress Websites

It’s not a WordPress bug. The problem is in PHP on the server, so updating WordPress, your theme or your plugins won’t fix it.
Security plugins can’t stop it. The attack happens before WordPress even loads, so security plugins running inside WordPress never get a chance to block it.
Older PHP versions carry more risk. Official fixes were released for PHP 8.2, 8.3, 8.4 and 8.5. Sites still running PHP 8.1, 8.0 or 7.x depend on their hosting company to apply a patch, or need to be upgraded.
The version number doesn’t always tell the whole story. Many hosts apply the fix without changing the PHP version number, so confirming your site is protected takes more than a quick look at your dashboard.

Which PHP Versions Are Fixed?

The patched releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or a hosting provider’s build with the fix applied. Keep in mind that PHP 8.2 stops receiving security updates on December 31, 2026, so sites on 8.2 should plan a move to PHP 8.3 or newer soon.

How I Can Help Keep Your Business Website Safe

1. Assess

I review your site’s hosting environment and PHP version, confirm with your host whether the PHP2Shell fixes have been applied, and check your WordPress core, theme and plugins for compatibility with current PHP versions.

2. Determine Solutions

You get a plain-English summary of where your site stands and what needs to happen. That might be a simple confirmation from your host, a PHP upgrade, updating or replacing outdated plugins and themes, or moving to a more secure hosting environment.

3. Implement Improvements

I take a full backup first, test the PHP upgrade on a staging copy of your site, update or replace anything that isn’t compatible, then upgrade your live site and verify that everything works as it should.

4. Check for Signs of Trouble

I look for warning signs such as unknown admin users, unfamiliar plugins, suspicious files and modified core files. If anything looks off, I clean it up and reset passwords and security keys.

5. Keep It Safe Going Forward

Security isn’t a one-time fix. With ongoing WordPress maintenance and support, I keep your site’s software, plugins and PHP version current, with regular backups and monitoring.