Last updated: 22 October 2026. I’ll update this guide as the PHP project and security agencies publish new information.
PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, patched on 21 October 2026. They can let an attacker run code on a web server without logging in, and they affect almost every PHP version. Every WordPress site runs on PHP, so the fix is to update PHP itself: to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or your host’s patched build.
This guide covers how to check your PHP version in WordPress, how to update PHP for each type of hosting, what to do if you’re on PHP 8.1 or older, and how to check whether your site was touched before you patched. Everything here is based on the official PHP security advisory and the CISA alert, linked throughout.
What is the PHP2Shell vulnerability?
PHP2Shell is a critical PHP vulnerability made of two flaws in the PHP engine, found by Wiz and Calif researchers with AI-assisted analysis and published on 21 October 2026. CVE-2026-109618 abuses how PHP handles running out of memory, and CVE-2026-109619 abuses data left over between requests. Both allow PHP RCE (remote code execution) without logging in.
The flaws sit below your website’s code. Wiz says exploitation “does not depend on a flaw in the application’s code”, PHP rates each flaw 9.2 on CVSS v4, and Wiz demonstrated remote code execution on the official WordPress container image. The PHP project lists every server setup as at risk (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed) and considers mod_php the highest risk.
Wiz also reports that the same flaws can expose data held in PHP’s memory, which “may contain passwords, authentication tokens, API keys and certificates”. That’s why the checklist below includes changing passwords and keys after you patch.
Is my WordPress site vulnerable to PHP2Shell?
Your WordPress site is vulnerable to PHP2Shell if its server runs an unpatched PHP version, whatever WordPress version, theme or plugins you use. Updating WordPress or a plugin won’t fix it, because the bug is in PHP. You are protected once your host or server runs PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a vendor build with the fixes backported.
Exploitation status is still changing. CISA’s alert on 21 October said it had “not observed exploitation” at that point. Security firms have since reported attack attempts against unpatched servers. Treat it as urgent either way: CISA, the FBI and other national agencies advise taking PHP sites offline if you can’t patch them.
Which PHP versions fix PHP2Shell?
The PHP versions that fix PHP2Shell are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP 8.1 and older get no official release because those branches are end of life. Linux distributions such as Ubuntu and Debian received the patches in advance and ship their own fixed packages, which often keep an older-looking version number.
| PHP branch | Fixed PHP release | Security support until | What to do |
|---|---|---|---|
| 8.5 | 8.5.12 | 31 Dec 2029 | Update to 8.5.12 or your vendor’s patched build |
| 8.4 | 8.4.27 | 31 Dec 2028 | Update to 8.4.27 or your vendor’s patched build |
| 8.3 | 8.3.36 | 31 Dec 2027 | Update to 8.3.36 or your vendor’s patched build |
| 8.2 | 8.2.35 | 31 Dec 2026 | Update now, and plan a move to 8.3 or newer before support ends |
| 8.1 and older | No official release | Ended (8.1 on 31 Dec 2025) | Use a vendor backport if your host has one, otherwise upgrade |
Support dates come from PHP’s supported versions page. For the WordPress PHP version, WordPress itself recommends PHP 8.3 or greater, so if you have to upgrade anyway, 8.3 or 8.4 is a sensible target.
Why your PHP version can look old and still be patched
Ubuntu, Debian and other Linux distributions often fix security bugs inside the version they already ship. Ubuntu’s security notice USN-8948-1 lists the patched packages, for example:
- Ubuntu 24.04 LTS: PHP 8.3 package version
8.3.6-0ubuntu0.24.04.13 - Ubuntu 22.04 LTS: PHP 8.1 package version
8.1.2-1ubuntu2.28 - Ubuntu 26.04 LTS: PHP 8.5 package version
8.5.4-0ubuntu1.5
On those servers, PHP reports itself as 8.3.6, 8.1.2 or 8.5.4 and is still fixed. Check the full package version, as shown below. Older Ubuntu releases (14.04 to 20.04) only get the fix through Ubuntu Pro.
How to check PHP version in WordPress
To check PHP version in WordPress, log in to the dashboard, go to Tools > Site Health > Info and open the Server section. The PHP version line shows the version your site runs. Compare it with the fixed releases above. If it shows a distribution version such as 8.3.6, confirm the package version with your host.
Site Health shows the PHP that actually serves your website, which is the one that matters. A server can have more than one PHP version installed, and the version used on the command line is sometimes different.
How to check PHP version in cPanel
In cPanel, open MultiPHP Manager (or Select PHP Version on some hosts) to see which PHP version each domain uses. That screen shows the branch, such as PHP 8.3, but usually not whether your host has installed the patched build. Ask your host directly whether their PHP packages include the 21 October 2026 fixes for CVE-2026-109618 and CVE-2026-109619.
How to check PHP version on Linux or Ubuntu
On a Linux server, run php -v to see the command-line PHP version, then check the installed packages to confirm the patched build. On Ubuntu or Debian, list PHP packages with dpkg and read the newest changelog entry, which should mention both CVE numbers. Remember that the PHP-FPM or Apache module serving your site is what needs the fix.
php -v
dpkg -l | grep -E 'php[0-9.]+-(fpm|cli)|libapache2-mod-php'
apt changelog php8.3-fpm | head -20Replace php8.3-fpm with your PHP version. If you created a phpinfo() file to check the version, delete it afterwards, because it shows attackers your exact setup.
How to update PHP version in WordPress
How you update PHP version in WordPress depends on your hosting. On managed hosting, your host patches PHP and you confirm it with them. On cPanel hosting, your host installs patched builds and you pick the version in MultiPHP Manager. On your own VPS, you install the updated packages and restart PHP. WordPress itself needs no change.
Managed WordPress hosting
Managed hosts update PHP on their own servers, but don’t assume it has happened yet. Send your host a short message and keep their reply on file:
Hello, my site example.com runs PHP [your version]. Can you confirm that the PHP build serving my site includes the 21 October 2026 fixes for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), and that PHP has been restarted since the update?
If your site still runs PHP 8.1 or older, ask what patched or newer version they can move you to, and when.
How to update PHP version in cPanel
To update PHP version in cPanel, open MultiPHP Manager, select your domain and choose a supported version such as PHP 8.3 or 8.4. That only switches which installed PHP your site uses. The PHP2Shell fix arrives when your host updates the PHP packages on the server, usually through EasyApache 4, so ask your host to confirm it.
If you run your own WHM server, update the PHP packages through EasyApache 4 or your normal system updates, then restart Apache and PHP-FPM.
Ubuntu or Debian VPS
On a VPS you manage yourself, install the updated PHP packages, restart PHP so every worker loads the fixed code, then confirm the version. This works for Ubuntu’s own packages and for the widely used ondrej/php repository, which has also published patched builds.
sudo apt update
sudo apt upgrade
sudo systemctl restart php8.3-fpm # use your PHP version
sudo systemctl restart apache2 # or nginx, if you use it
php -vIf you’re still on an old branch, my step-by-step guides cover upgrading to PHP 8.4 on Ubuntu and upgrading to PHP 8.5 on Ubuntu. Test the upgrade on a staging site first if you’re changing branch.
Docker and container hosting
A running container keeps its old PHP until you replace it. Pull the updated base image, rebuild any image you build yourself, and recreate the containers. For Docker Compose that means docker compose pull, docker compose build --pull for custom images, and docker compose up -d. Then check the PHP version inside the running container.
What if your WordPress site runs PHP 8.1 or older?
If your WordPress site runs PHP 8.1 or older, the PHP project will not release a fix, because those versions are end of life. Either confirm your host or Linux vendor ships a backported fix (Ubuntu 22.04’s PHP 8.1 package does), or upgrade to PHP 8.3 or newer. CISA advises taking unpatched PHP 8.1 and older systems offline until then.
Upgrading from PHP 7.4, 8.0 or 8.1 can break old themes and plugins, so update WordPress, your theme and plugins first, then test the new PHP version on staging before switching the live site. My guide on why and how to upgrade PHP on WordPress covers the compatibility checks.
Is there a temporary fix if you can’t update PHP today?
There is no complete temporary fix. The PHP project says updating “is the only safe choice”. Its advisory lists settings that block the confirmed attack paths, such as setting session.upload_progress.enabled to 0 in php.ini and restarting every worker, and a web application firewall may help. These reduce risk without removing it, so the safest stopgap is taking the site offline.
The other mitigations in the PHP advisory are server-level changes to memory and request limits, and they can cause problems if applied carelessly. They are a job for your host or server administrator. A plugin cannot apply them, because they need to take effect before WordPress loads. If you can’t patch, maintenance mode at the server or CDN level is safer than staying online unpatched.
How to check if your WordPress site was hacked through PHP2Shell
After patching, check for signs of compromise from before the update: new administrator accounts, unknown PHP files in wp-content/uploads, changed core files, edited .htaccess or wp-config.php files, and unfamiliar scheduled tasks. Ask your host whether server logs show PHP processes starting shells or downloading tools, which is what CISA tells administrators to watch for. Then change passwords and keys.
- Review Users in the WordPress dashboard and remove any administrator you don’t recognise.
- Verify WordPress core files against the official checksums with WP-CLI:
wp core verify-checksums, and for pluginswp plugin verify-checksums --all. - Look for PHP files inside
wp-content/uploads, where WordPress should only store media. - Check
.htaccess,wp-config.phpand your server’s cron jobs for changes you didn’t make. - Ask your host about signs Wiz describes: repeated memory-limit errors or HTTP 500 responses, unusually large session cookies, and PHP workers restarting without explanation.
- Because the flaws can expose data in memory, change your WordPress admin passwords, database password, security keys (salts) in wp-config.php, and any API keys stored on the site.
If you find anything suspicious, follow my WordPress hacked site recovery checklist before you clean up, so you don’t destroy the evidence of how the attacker got in.
PHP2Shell checklist for WordPress site owners
Work through this PHP2Shell checklist in order: check the PHP version in Site Health, confirm it’s a patched build, update and restart PHP if it isn’t, move off PHP 8.1 or older, take the site offline if you can’t patch today, check for signs of compromise, and change your passwords and keys.
- Check your PHP version in Tools > Site Health > Info > Server.
- Confirm the build includes the 21 October 2026 fixes, with your host or the package changelog.
- Update PHP to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or your vendor’s patched build, and restart PHP.
- If you’re on PHP 8.1 or older without a vendor backport, upgrade to PHP 8.3 or newer.
- If you can’t patch today, take the site offline at the server or CDN level.
- Check users, files and scheduled tasks for signs of compromise.
- Change admin and database passwords, WordPress security keys and stored API keys.
Need help patching PHP on your WordPress site?
If you’re not sure how your site’s PHP is set up, or your host can’t confirm it’s patched, I can check and update it. My WordPress bug fix and rescue service covers urgent patching and compromise checks. For ongoing protection, WordPress maintenance and care plans include PHP and server updates, so the next emergency patch is handled for you.
