On 21 October 2026, PHP released fixes for two critical security flaws, now being called PHP2Shell. If you have seen posts telling you to patch within 15 minutes or get hacked, take a breath. Most of the work sits with your hosting company, and you can check your own site in about 2 minutes.
Here is what happened in plain English, who actually had to act, and what to do if your site runs an older version of PHP.
What happened with PHP2Shell?
PHP is the programming language WordPress runs on. It sits on the server, underneath WordPress, your theme and your plugins. On 21 October the PHP team released fixes for CVE-2026-109618 and CVE-2026-109619. Both are rated critical. Both are remote code execution flaws, which means an attacker could in theory run their own commands on a server without logging in.
The key detail: these flaws are in PHP itself, not in WordPress. Every PHP version from 5.4 upward was affected. The fixed versions are:
- PHP 8.2: 8.2.35
- PHP 8.3: 8.3.36
- PHP 8.4: 8.4.27
- PHP 8.5: 8.5.12
PHP 8.1 and older got no official release. The PHP team published source code fixes for people who build PHP themselves, and some hosts and vendors ship their own patched builds, known as backports. More on that below.
Who actually had to act?
This is a server level fix. Your host installs the new PHP version and restarts PHP on the server. Updating WordPress, your theme or your plugins does not fix it. Clicking Update in your dashboard does nothing for PHP2Shell.
- Managed hosting: your host or your agency does the update. Your job is to confirm it was done.
- Shared hosting: the host updates the server for every customer on it. Most large hosts move quickly on anything rated critical.
- Your own server: whoever manages that server has to update PHP and restart it. If nobody is sure who that is, that is the real problem.
For what it is worth, we spent 21 October updating PHP across every client site we look after, on 3 servers. It was a long day of routine work, not a crisis.
How worried should you be?
Calm, not complacent. At release, the PHP team, the US cyber security agency CISA and the security firm watchTowr all reported no confirmed attacks using these flaws in the wild, according to The Hacker News. Cloudflare saw early attempts and switched on firewall rules for every plan, including the free one, as Help Net Security reported.
That will change. Once details are public, attackers start scanning for servers that have not updated. So the fix matters, and the time to apply it is this week. But “patch in 15 minutes or you are hacked” is not what the evidence says. The sites at real risk are the ones nobody is minding.
Why old PHP is the real risk
PHP2Shell is a single event. Old PHP is an ongoing problem. At the last WordPress.org count in late September 2026, about 38% of WordPress sites were running PHP 8.1 or older, and PHP 7.4 alone made up around 17%, as Xictron reported.
Those versions are past end of life. They got no official fix this time, and they will get no official fix next time either. A site on PHP 7.4 relies entirely on its host to backport security fixes, and many budget hosts do not.
PHP 8.2 reaches end of life on 31 December 2026 as well. If you are moving anyway, PHP 8.3 or newer is the sensible target.
The 2 minute check
You do not need technical skills for this. You need a WordPress admin login.
- Log in to WordPress.
- Go to Tools, then Site Health.
- Click the Info tab.
- Open the Server section and find PHP version. Note the number.
If it shows 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer, you are on a fixed release. If it shows something lower, that does not automatically mean you are exposed, because some hosts patch older versions without changing the number. Send your host this question:
“Are you on 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or a vendor backport of the PHP2Shell fixes, and have PHP workers been restarted?”
The restart part matters. PHP keeps running the old code in memory until it restarts. A good host will answer in one line. If you get a vague reply, or no reply, that tells you something too.
What to do if you are on PHP 8.1 or older
- Ask your host directly whether they ship a backported fix for your version. Get the answer in writing.
- Take a full backup first, files and database, and make sure it can be restored.
- Update WordPress, the theme and plugins before you change PHP. Most problems come from plugins nobody has updated in years.
- Remove what you do not use. Every unused plugin is one more thing that can break.
- Plan the move to PHP 8.3 or newer. Do not just flip the switch. Older themes and plugins can break on a newer version, so test on a staging copy first.
If your host cannot give you a straight answer, or the site has not been touched in a year, that is a sign to move it somewhere it will be looked after. This is general guidance based on the published advisories, not a full security audit.
Free migration onto our maintenance plan
If your site is on PHP 8.1 or older, or on hosting nobody is minding, we will migrate it onto our website maintenance plan free of charge. We move the site, bring it up to a supported PHP version and test it. From then on, the plan covers monthly updates, backups, security scans and monitoring. That routine is why 21 October was a normal working day for us rather than a scramble.
Not sure where your site stands? Book a free 15 minute call and we will tell you straight.
FAQ
Does updating WordPress fix PHP2Shell?
No. The flaws are in PHP on the server, not in WordPress. Keep WordPress updated anyway, but the PHP2Shell fix comes from your host.
My PHP version number has not changed. Am I exposed?
Not necessarily. Some hosts and vendors apply backported fixes without changing the version number shown in Site Health. Ask your host the question above to be sure.
Does Cloudflare protect me?
If your site runs through Cloudflare, its firewall rules add a useful layer while servers are updated. They are a stopgap, not a fix. The server still needs the updated PHP.
Sources and further reading
- News Archive 2026, PHP.net
- Report on PHP emergency patches for CVE-2026-109618 and CVE-2026-109619, The Hacker News
- Report on the PHP2Shell vulnerabilities and Cloudflare protection, Help Net Security
- PHP 8.2 end of support and WordPress PHP version share, Xictron
- Supported Versions, PHP.net