WordPress problem fix
Updating WordPress does not fix this one. The fix lives on your server, and your host has to apply it. Here is exactly what to check and what to ask for.
PHP2Shell is the name for two critical flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619 and patched on 21 October 2026. PHP is the language your WordPress site runs on, so this sits underneath WordPress, your theme, and every plugin. Both flaws can let an attacker run their own code on the web server without a password. The PHP team says it affects every PHP install that serves web pages, including Apache with mod_php, PHP FPM, php cgi, FrankenPHP and LiteSpeed, with mod_php the highest risk. The safe versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get official fixes. To check, open WordPress, go to Tools, then Site Health, then Info, then Server, and read the PHP version. If it is lower than the safe number for your branch, ask your host to patch today. If the server was exposed for days before patching, check it for a break in as well, because patching closes the door but does not remove anything already inside.
If any of these match, you are on the right page.
Site Health shows a PHP version below 8.5.12, 8.4.27, 8.3.36 or 8.2.35
Your site runs PHP 8.1, 8.0, 7.4 or older
Your host has not emailed you about the October 2026 PHP security release
New PHP files you did not upload appear in wp-content or uploads
Your server is slow or your host reports unusual processes
WordPress is an application that runs on top of PHP. PHP2Shell is a flaw in PHP itself, so it is fixed by updating the PHP software on the server. On shared or managed hosting, only your host can do that. On your own server, you or your developer have to do it.
When CISA published its alert it said it had not yet seen successful attacks. CERT EU then reported that technical details and early proof of concept code were circulating, which usually means attacks follow quickly. Treat an unpatched server as at risk now.
The PHP project no longer releases official fixes for 8.1 and older. It published small source patches for 7.4, 8.0 and 8.1 as a courtesy, and some hosts backport fixes. Ask your host in writing whether they applied a backport. If they cannot confirm it, moving the site to a supported PHP version is the real fix.
Not fully. A firewall in front of the server may block some attempts, and the PHP team and CISA both mention that, but the flaw is triggered before WordPress code runs. A plugin inside WordPress cannot reliably stop something that happens underneath it.
The real method, in the order it works.
Read your PHP version in WordPress under Tools, Site Health, Info, Server.
Compare it with the safe versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
If it is lower, open a ticket with your host and ask them to confirm, in writing, that PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is patched on your server.
If you are on PHP 8.1 or older, plan a move to a supported version and test your theme and plugins on a staging copy first.
Check for signs of a break in: new PHP files in uploads, unknown admin users, edited core files, strange scheduled tasks.
If anything looks wrong, change hosting, database and admin passwords after the cleanup, not before, so the attacker cannot watch the new ones.
How we handle it
PHP2Shell is new, so this page is built from the official PHP, CISA, CERT EU and UK NCSC advisories, not from a past client case. On the WordPress sites we manage, the first job is the same every time: read the exact PHP version on every server, match it against the fixed releases, and get the host to confirm the patch in writing. Where a server ran an old version for days, we also look for the usual signs of an attacker getting in, like PHP files hiding in uploads and admin users nobody created.
Written by Ali Yasin Jatoi
Founder of WebCare Studios. Ali has worked with WordPress for more than 10 years, including managing a Pearl Lemon internal fleet of 150+ sites with WP-CLI automation for updates, security cleanup, and malware removal. He has hands on experience across major hosts including Cloudways, A2 Hosting, Hostinger, and Bluehost.
Site down, hacked, or broken checkout gets a senior engineer within 4 hours. No ticket queues, no bots.
Flat quote up front. If we cannot get you back online, you do not pay. Risk sits with us, not you.
We work on a snapshot first and never touch your live database until the fix is verified safe.
Our founder managed 150+ Pearl Lemon internal WordPress sites. The errors you are seeing are ones we have closed hundreds of times.
Site Health shows the full PHP version, for example 8.3.36. If it matches or beats the safe number for your branch, the patch is in. If your host backports fixes without changing the number, ask them to confirm in writing.
Yes. Any website or app that runs on PHP is in scope, including WooCommerce, Joomla, Drupal, Magento and many custom builds. Some products include PHP quietly, so ask your developer or host if you are not sure.
Yes. Send us the address and we reply within 8 to 12 hours with your PHP version, the patch status and a plain answer on whether anything looks like a break in. If cleanup is needed, emergency work starts from $249.
Moving to a patch release on the same branch, like 8.3.35 to 8.3.36, is very low risk. Jumping branches, like 7.4 to 8.3, can break old plugins, which is why we test on a staging copy first.
Two fields. Email and your URL. A senior WordPress engineer reads it within minutes and replies on email and WhatsApp with what is wrong and what we will do next.
Real proof and field guides tied to "PHP2Shell PHP vulnerability".
