PHP2Shell and your WordPress site: how to check and update PHP

The short answer

PHP2Shell is a flaw in PHP, the software your web host runs underneath WordPress, so updating WordPress, your theme or your plugins does not fix it. Your site is covered once the server runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, or a build your host has patched, and the only way to be sure of the second case is to ask your host in writing.

Most owners need four steps, in this order:

• Know what PHP2Shell is. Two bugs in PHP itself, fixed on October 21, 2026.
• Check your PHP version. WordPress shows it under Tools, then Site Health.
• Confirm the fix with your host. A version number alone does not prove the patch is in.
• Update PHP if you are on 8.1 or older. Those versions get no official fix.

Then two things that save you a second scare: PHP2Shell is not the same as wp2shell, and PHP is one of three layers on a WordPress site that each need their own updates.

What PHP2Shell is, in plain English

WordPress is written in PHP, and PHP is installed on your host's server, not inside your WordPress dashboard. On October 21, 2026, the PHP project released fixed versions for two critical bugs, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 (PHP security advisory). Researchers named the pair PHP2Shell.

In short, a specially built web request can make PHP run out of memory while it is setting the request up, and PHP's cleanup then trusts data that was only half built. An attacker who gets that right can run their own code on the server, without logging in (Huntress). Because the flaw sits below WordPress, a site with perfectly kept plugins is still exposed: Wiz showed it working against the standard WordPress, Drupal and Joomla containers (Wiz).

It is not theoretical. On October 26, CISA, the US government's cybersecurity office, added both bugs to its list of vulnerabilities attackers are actively using (CISA). The good news is that the fix is a normal PHP update, and some hosts, Kinsta among them, applied it within a day.

Check your PHP version

You can see which PHP your site runs without any plugin:

1. Log in to WordPress as an administrator.
2. Go to Tools, then Site Health, then the Info tab.
3. Open the Server section and read the line PHP version.

Compare it with this table, built from the PHP security advisory:

If Site Health shows only "8.3" or a number below the fixed release, do not assume the worst yet. Hosts often patch PHP without changing the number you see, which is the next step.

Confirm the fix with your host

Kinsta, a managed WordPress host, patched PHP across its platform and marked the incident resolved on October 22, but it also warns that the PHP version shown in its dashboard "doesn't confirm whether a security patch is applied" (Kinsta). That is true of most hosts, because they often backport a fix into the version you already run. So the reliable check is a written answer from your host.

Send this from your hosting account's support form or email:

Hello, my site is [your domain]. Has the PHP running it been patched for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)? If not, when will it be, and do I need to change anything on my plan? Thank you.

Keep the reply. If the answer is yes, you are done with PHP2Shell. If the host cannot patch your plan or your PHP version, the next step applies. If the host offers interim settings in the meantime, take them, but know that the PHP project says "updating is the only safe choice" (PHP security advisory).

Update PHP if you are on 8.1 or older

PHP 8.1 and older get no official PHP2Shell release, and they are common: Modat counted about 79% of the PHP services it could read a version from running a branch PHP no longer supports (Notebookcheck, citing Modat). WordPress itself recommends PHP 8.3 or greater (WordPress requirements).

WordPress's own guide to updating PHP (WordPress.org) gives the safe order:

1. Back up the site first, files and database, and know how to restore it.
2. Update WordPress, the theme and every plugin, then check the site still works.
3. Check compatibility. The PHP Compatibility Checker plugin flags code that may break; it is not perfect, so treat it as a first look.
4. Change the PHP version in your hosting panel, usually a menu called PHP version or PHP settings, or ask the host to do it. Pick 8.3 or 8.4 rather than 8.2, so you are not doing this again in two months.
5. Test the pages that matter. The home page, a contact form, any checkout or booking page, and the admin login.
6. If something breaks, switch the PHP version back and contact the plugin's developer. Your backup covers the worst case.

A plugin that stops working on a current PHP version is a plugin nobody is maintaining, which is worth knowing whatever happens with PHP2Shell.

PHP2Shell is not the same as wp2shell

Two bugs with nearly the same name hit WordPress sites four months apart, and they need different fixes:

wp2shell (CVE-2026-63030 and CVE-2026-60137) was a WordPress flaw that attackers used to install hidden files and rogue admin accounts (BleepingComputer). If your WordPress is on one of those fixed releases or newer, that one is handled. It tells you nothing about PHP2Shell, and the reverse is also true.

Why this keeps coming back

A WordPress site has three layers that each need their own updates, and each has a different owner:

• PHP, updated by your host, or by you on a server you manage.
• WordPress core, updated automatically for security releases, by you for the rest.
• The theme and plugins, updated by you, one by one. Patchstack counted 11,334 new WordPress vulnerabilities in 2025, 91% of them in plugins (Patchstack, State of WordPress Security 2026).

PHP2Shell was the bottom layer's turn. The habit that covers all three is a monthly check: the PHP version against the table above, WordPress and plugin updates, and a test of every form. Our guide to WordPress care plans covers what paying someone for that work buys, and what it doesn't. When a form is the thing that breaks, this fix for a contact form that stopped sending email walks through it.

When moving is the better fix

If your site is mostly pages and posts, another way out of the three-layer routine is a site built on fewer layers. EmDash, the open-source CMS from Cloudflare that its makers call "the spiritual successor to WordPress" (emdashcms.com), is built on Astro and runs on Cloudflare Workers or Node.js (EmDash docs). There is no PHP interpreter in it, so PHP2Shell had nothing to attack on an EmDash site. That is a fact about the software, not a promise that a site can't be broken into: EmDash has its own code to update, and its registry plugins are sandboxed and permission-gated rather than risk-free.

Stay on WordPress if your host already confirmed the patch and you rely on plugins with no equivalent elsewhere, such as a large online store, a membership site, or a booking system tied into other tools. For those sites, the monthly check above is the right answer.

Bring your WordPress site into the AI era on EmDash and Astro. We check every URL, redirect, form and search detail against your live site before anything changes, and switch only after you approve the preview, with the rollback written down. After launch we host the site and email you a monthly certificate listing the checks we ran and what changed. A free, read-only check of your public pages shows whether your site is a good fit and the exact price before you ask.

Want to know where your site stands? Check your site for free.

Frequently asked questions