PHP2Shell is a serious security flaw in PHP, the software that runs most WordPress websites. A fix was released on 21 October 2026, but it has to be installed on the server by your hosting company. Updating WordPress itself will not fix it. If your website runs on WordPress and you are not sure whether your host has applied the update, this is the one question to ask them this week.
There is a lot of worrying coverage at the moment, so I wanted to explain what has happened in plain English, without the panic.
What is PHP2Shell?
PHP is the programming language that sits underneath a huge number of websites, including every WordPress site. Two flaws were found in PHP itself (CVE-2026-109618 and CVE-2026-109619), and both are rated 9.2 out of 10 for severity. In the worst case, they could let an attacker run their own code on a server without needing to log in.
PHP released fixed versions on 21 October: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Security researchers agree that installing the update is the only complete fix.
Is it being attacked right now?
Honest answer: it depends who you ask, and that is why I'd avoid anyone who tells you your site is about to be hacked.
- Attack attempts have been reported, including before the fix was published.
- Rapid7 says it has not itself seen exploitation in the wild, but expects it given how widely PHP is used.
- Sansec says the public exploits do not work against a default PHP install, and that mass exploitation looks less likely than first feared.
None of that is a reason to ignore it. The flaws exist in normal setups, and attackers move quickly once a fix is public. The sensible response is simple: get the update installed.
Why updating WordPress does not fix it
This catches people out. WordPress, your theme and your plugins are all programs that run on top of PHP. The flaw is in PHP, which belongs to the server, not to your website. So clicking "Update" in your WordPress dashboard does nothing for this particular problem.
PHP is installed and updated by whoever runs your hosting. Many good hosts will already have done it. Some will do it automatically. A few will not have, particularly on older or cheaper plans.
The one question to ask your host
Send your hosting company a short message:
"Has my server been updated to fix PHP2Shell (CVE-2026-109618 and CVE-2026-109619)? Which PHP version am I running now?"
What you want to hear is a PHP version of 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer.
If they tell you you're on PHP 8.1 or older, ask a follow-up. The PHP team does not publish routine updates for those versions, so you need to know whether your host has applied a backported fix, or can move you to a newer version. This is worth asking about regardless of PHP2Shell.
What if I am on Wix, Squarespace or Shopify?
Then you can relax. Those services run and update their own servers, so there is nothing for you to install.
How do I know what my website runs on?
If you are not sure whether you are on WordPress, or who your host even is, send me your web address. I can usually tell you what it is built with from the outside, and I will tell you what to ask your host. That is free and there is no sales pitch attached.
I cannot tell you whether your host has patched the server, because only they can see that. But I can tell you whether it is something you need to ask.
What about the websites I build?
The websites I build at WebFuZsion are made with Next.js or hand-written HTML and CSS, not WordPress, so they do not run on PHP and PHP2Shell does not apply to them. That is not a promise that any website is unhackable, because nothing is, but it does mean this flaw is not one my clients need to worry about. If you would like to know more about the difference, I have written about why bespoke sites avoid WordPress bloat and Next.js vs WordPress.
A quick checklist
- Find out who hosts your website.
- Ask them the question above.
- Make sure the PHP version is one of the fixed ones, or newer.
- Keep WordPress, themes and plugins updated as well. That is still important, it just does not solve this one.
- Not sure about any of it? Ask me.
If keeping a site updated is something you would rather not think about at all, my website maintenance packages cover updates and security monitoring.
Not sure what your website runs on?
Send me your web address and I will tell you what it is built with and exactly what to ask your host. Free, with no obligation.
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the name given to two serious flaws in PHP (CVE-2026-109618 and CVE-2026-109619) that could let an attacker run code on a server without logging in. PHP released fixed versions on 21 October 2026.
