In late October 2026, two critical vulnerabilities were disclosed in PHP, the programming language WordPress runs on. Nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), they allow an attacker to run their own code on a web server that has not been patched. Both are rated 9.2 out of 10 for severity.
Because PHP runs underneath every WordPress site, this is not a WordPress bug and not a plugin bug. It affects the server your site runs on.
Why this one is different
Most WordPress security problems come from an outdated plugin or a weak password. PHP2Shell is different: the malicious request is handled by PHP before WordPress loads. That means security plugins, login protection and strong passwords inside WordPress cannot stop it. The fix has to happen on the server.
The timeline
- October 17: security researchers reported the first attempts to exploit the flaws, before they were public.
- October 20: details leaked ahead of the planned release, and PHP confirmed an upcoming security update.
- October 21: PHP published fixed versions. Automated scanning for vulnerable servers began within hours.
Which versions are fixed
The patched releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Any web server running an earlier release on those branches is affected, whether it uses Apache, PHP-FPM, LiteSpeed or another setup. Older versions of PHP (8.1 and earlier) are past the end of their normal support, which makes running them even riskier.
One catch: many hosts apply the fix to their own builds of PHP without changing the version number. Your site might report 8.3.35 and still be patched, or report a fixed number on an old build. The version number alone does not tell you for sure; your host’s announcement does.
What to do now
- Find out which PHP version your site uses. In WordPress, go to Tools → Site Health → Info → Server.
- Confirm with your host that it is patched for CVE-2026-109618 and CVE-2026-109619. Ask in writing if you can.
- Move off old PHP. If your site is on PHP 8.1 or older, plan an upgrade to a supported version. PHP 8.2 reaches its end of life on December 31, 2026, so 8.3 or newer is the better target.
- Check for signs of compromise, especially if your server was unpatched after October 17: admin users you don’t recognize, unfamiliar PHP files in your uploads folder, WordPress core files that have changed, and new scheduled tasks. A malware scan that compares files against known-good copies is the quickest way to check.
- If you find something, clean it up properly. Change passwords and security keys after the cleanup, not before, so you are not handing the new ones to an attacker who still has access.
What we did for the sites we look after
For our Care Plan clients, we confirmed the patched PHP build on their servers within a day of the fix and checked every site for signs of compromise from the days before the patch. This is the kind of thing a maintenance plan is for: most site owners never heard about PHP2Shell, and they did not need to.
If you are not sure whether your server is patched, ask us for a free health check. We will tell you which PHP version your site is running and what to do next.
Sources: Datadog Security Labs, VulnCheck, watchTowr.