PHP2Shell: What It Means for Your WordPress Website

If your website runs on WordPress, there is a good chance you’ve seen “PHP2Shell” in the news this week. Governments took sites offline, hosting companies rushed out patches, and a few clients have already asked me if their website is safe.

Here is what happened in plain English, and exactly what to check.

What is PHP2Shell?

PHP2Shell is the name given to two serious security flaws in PHP, the programming language that WordPress runs on. They are tracked as CVE-2026-109618 and CVE-2026-109619, and they affect PHP versions 5.4 through 8.5. That covers almost every version in use.

Both flaws allow something called remote code execution. In simple terms, an attacker can run their own code on your web server without ever logging in. That is as bad as it sounds.

The name comes from security firm Wiz, and it’s a fair one: the flaws could be used to run shell commands on the server.

Why this one is a big deal

Most security problems I write about affect one plugin or one theme. This one is in PHP itself, so it doesn’t matter how carefully you kept your plugins updated or how strong your password is.

About 69% of websites with a known server-side language use PHP. That includes WordPress, Drupal, Joomla and the hosting control panels like cPanel and Plesk.

Both flaws score 9.2 out of 10 on the CVSS 4.0 severity scale, and one of them scores 9.8 on the older CVSS 3 scale. Security firm watchTowr rated it a full 10.

The timeline

• August 2026: Two groups, one at Calif and one at Wiz, found the flaws independently. Both used AI models to help audit the PHP source code.
• 17 October: The first attempted attacks were spotted by Amazon, four days before the public announcement.
• 20 October: Details leaked early before the planned release.
• 21 October: PHP released patched versions, and watchTowr reported attacks happening in the wild.
• 22 and 23 October: cPanel and CloudLinux released their own fixes for hosting servers.

Some of the bug class had been known about for years but was thought too hard to exploit. That is no longer true.

Who took their sites offline?

Quite a few. Dutch, Danish, Finnish and French government sites went offline as a precaution, along with some Canadian government sites. The NSA advised taking sites offline if they couldn’t update straight away. The Wikimedia Foundation shut down several services, and the Internet Archive was briefly offline.

If organisations that size are pulling the plug, it’s worth taking seriously for your business website too.

What you need to do

Step 1: Check which PHP version you’re running

In your WordPress dashboard, go to Tools → Site Health → Info → Server. Look for the PHP version.

Step 2: Update to a patched version

The patched releases are:

• PHP 8.2.35
• PHP 8.3.36
• PHP 8.4.27
• PHP 8.5.12

If you are on PHP 7.4, 8.0 or 8.1, those versions are end of life. They only got source patches, with no official updates. The honest answer is to move up to a supported version, and to test your site when you do.

The people who maintain PHP were clear that the temporary workarounds are not complete. Updating is the only safe fix.

Step 3: Ask your host

If you are on shared hosting or a managed plan, you can’t update PHP yourself. Email your host and ask two questions:

1. Has the server been patched for CVE-2026-109618 and CVE-2026-109619?
2. Which PHP version is my site running?

If they can’t give you a straight answer, that tells you something too.

Step 4: Turn on Cloudflare’s protection

Cloudflare added WAF rules for the known attack patterns, and they are available to all customers, including the free plan. If your site is behind Cloudflare, make sure the managed rules are switched on. This is a safety net while you update. It is not a replacement for updating.

Step 5: Keep a backup and watch for anything odd

Make sure you have a recent backup that you can restore. The UK’s NCSC has warned organisations to watch for backdoors, which are hidden files an attacker leaves behind so they can come back later. Unfamiliar PHP files, new admin users you didn’t create, or a site that suddenly sends spam are all reasons to get in touch with me straight away.

What this tells us

The Guardian pointed out that the PHP Foundation has only 13 employees and runs on donations. The whole web leans on it. That’s worth remembering the next time someone says an old, cheap, unmaintained website “is fine”.

Final thoughts

Don’t panic, but don’t leave this one sitting in your inbox either. Check your PHP version, update to a patched release, and make sure your host has done the same.

If you are a Design My Website hosting or maintenance customer, I am already working through updating client sites, and you don’t need to do anything. If your site is hosted somewhere else and you’d like me to check it, get in touch and I’ll look at it for you.

Source: PHP2Shell on Wikipedia.