PHP2Shell: The Critical PHP Vulnerability Every WordPress Site Owner Needs to Know About (And How to Fix It)

On October 21, 2026, the PHP project released emergency security updates to fix two critical vulnerabilities, now nicknamed “PHP2Shell.” If your business website runs on WordPress, it runs on PHP, so this one matters to you, even if you’ve never thought about PHP before.

Here’s what happened, why it matters for your business, and the exact steps to make sure your site is protected.

What Happened?

PHP is the programming language that powers WordPress, WooCommerce, and a huge share of the web. Two flaws were found in PHP itself:

• CVE-2026-109618 (“RCE via OOM corruption”): If a web request pushes PHP to its memory limit at exactly the wrong moment, PHP can leave internal data half-built and later treat it as valid, corrupting memory.
• CVE-2026-109619 (“RCE via stale global state”): After certain errors, PHP can hang on to memory that has already been freed, and a later request handled by the same server process can reach that leftover memory.

Both are rated Critical, 9.2 out of 10 (CVSS v4.0). In plain English: in the worst case, an attacker with no login at all can send specially crafted web requests to your server and run their own code on it. They could plant malware, steal data, or take your site down.

This isn’t just theoretical:

• Hosting company Hostinger reported that details leaked before the planned release and exploit code was already circulating before the fix came out.
• On October 26, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities catalog. That means attackers are actively using them, and CISA is urging organizations to patch immediately.

Who Is Affected?

According to the official PHP security advisory, every PHP installation that serves web requests is at risk. That includes common server setups like Apache with mod_php (which PHP considers the highest risk), PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed.

Affected versions:

For WordPress sites specifically: this is a flaw in the server software, not in WordPress. Updating WordPress, your theme, or your plugins will not fix PHP2Shell. Only a patched version of PHP will.

Many large managed hosts patched their servers quickly. But if your site is on a VPS or self-managed server, or on an older PHP version, updating PHP is usually your responsibility (or your developer’s).

Why This Matters for Your Business

Your website is often the first impression customers have of your business. A compromised site can:

• Redirect visitors to scam or malware pages, damaging your reputation overnight
• Expose customer data like contact form submissions, orders, or account details
• Get your site flagged by Google with a “This site may be hacked” warning, hurting your search rankings
• Get blacklisted for sending spam, so your business emails stop reaching inboxes
• Cost you time and money in cleanup, downtime, and lost sales

Problems like this usually catch small businesses off guard. They’re not neglecting their sites. Keeping server software patched just isn’t something most business owners have time to watch.

How to Fix It: Step-by-Step

1. Back up your site first.
Before changing anything, take a full backup of your files and database. Most hosting panels have a backup tool, or you can use a reputable backup plugin. Store a copy somewhere other than your server.

2. Check which PHP version you’re running.
In your WordPress dashboard, go to Tools → Site Health → Info → Server and look at the PHP version. You can also find it in your hosting control panel (often under “PHP Version,” “Select PHP Version,” or “MultiPHP Manager” in cPanel).

3. Check whether your host has already patched it.
Many hosts published status updates about PHP2Shell. Look on your host’s blog or status page, or contact support and ask directly: “Has PHP on my server been patched for CVE-2026-109618 and CVE-2026-109619?” Hosts can sometimes apply backported fixes, so the version number alone may not tell the full story. Get a clear yes or no.

4. Update PHP to a patched version.
If you aren’t protected, update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (or newer). On a VPS, install your Linux distribution’s updated PHP packages and restart all PHP processes (for example, PHP-FPM and/or Apache) so the fix actually takes effect.

5. If you’re on PHP 8.1 or older, plan an upgrade now.
The PHP project no longer supports these versions and hasn’t released an official fix for them. Some hosts and vendors offer backported patches, but the safer long-term move is upgrading to a supported version. Note that PHP 8.2 reaches end of life on December 31, 2026, so if you’re upgrading anyway, consider going straight to 8.3 or newer. Test on a staging copy first, since older themes and plugins sometimes break on newer PHP.

6. Update WordPress core, plugins, and themes.
This won’t fix PHP2Shell, but newer PHP versions work best with up-to-date software. Updating also closes other security holes. Remove any plugins or themes you no longer use.

7. Add a web application firewall (WAF).
A WAF, at your host, through a service like Cloudflare, or via a security plugin, can block many known attack patterns. CISA notes a WAF “may provide some protection” until systems are patched. It’s a safety net, though, not a substitute for updating PHP.

8. Scan for signs of compromise.
Because this was exploited in the wild, run a malware scan after patching. Watch for unfamiliar admin users, unexpected files, strange redirects, or unusual server activity. If something looks wrong, restore from a clean backup and change all passwords.

A note for server admins: the official PHP advisory lists temporary configuration changes (such as disabling session.upload_progress) that reduce exposure if you truly can’t update right away. They’re partial measures only. Updating is the only complete fix.

Don’t Want to Deal With This Yourself? Let Me Handle It.

Security issues like PHP2Shell aren’t one-time events. New vulnerabilities in PHP, WordPress, plugins, and themes show up all the time, and the businesses that come through unharmed are the ones whose sites someone is actively looking after.

That’s what I do. With my managed WordPress hosting and security maintenance, you get:

• Server and PHP updates handled for you. I patch critical issues like PHP2Shell quickly, so you don’t have to.
• WordPress core, plugin, and theme updates, tested so your site doesn’t break.
• Automatic off-site backups, so your site can be restored quickly if anything goes wrong.
• 24/7 uptime and security monitoring, so problems get caught early.
• Regular malware scans and firewall protection.
• Incident response. If something does go wrong, I clean it up and get you back online.

You focus on running your business. I’ll keep your website secure, fast, and online.

Not sure if your site is protected right now? Contact me for a free PHP and security check, and let’s make sure your website is in good hands.