On October 21, 2026, the PHP project released emergency fixes for two critical security flaws. If you run a WordPress site, this PHP vulnerability concerns you, even though it has nothing to do with WordPress itself. WordPress is built on PHP, so any site running an unpatched version is potentially exposed.
What actually happened
The two flaws (tracked as CVE-2026-109618 and CVE-2026-109619, and nicknamed “PHP2Shell” by researchers) are rated critical. In plain terms, they could let an attacker run their own code on a server without needing to log in to anything. Attacks were reported within hours of the details becoming public, so this isn’t a “get to it eventually” situation.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The WordPress team has confirmed that no WordPress update is needed or planned, because the problem is in PHP, not in WordPress. The fix has to happen at the server level, which is normally your host’s job.
Step 1: Check your PHP version
In your WordPress dashboard, go to Tools → Site Health → Info → Server. You’ll see your PHP version listed there.
Compare it against the fixed versions above. If you see 8.2.35, 8.3.36, 8.4.27, 8.5.12 or higher, you’re patched. If the number is lower, or you’re on PHP 8.1 or older, keep reading.
Step 2: Ask your host directly
Check your host’s status page or announcements first. Many have already rolled out patches or added firewall rules. If you can’t find anything, send support a question: “Have you installed the patched PHP release for CVE-2026-109618 and CVE-2026-109619 on my server?”
Step 3: If your host hasn’t patched, don’t just wait
Here’s where you take matters into your own hands:
- Switch to a newer PHP version in your hosting panel. Most hosts let you change this in a couple of clicks. Aim for PHP 8.3 or newer. Just keep in mind that a newer version only helps if your host has installed the patched build of it, which is why Step 2 matters.
- Back up your site first, and test after switching. Old plugins or themes sometimes break on newer PHP versions. If something looks off, tell your host or developer rather than switching back to an old version.
- Add a firewall layer if you can. Services like a web application firewall can block known attack attempts, this can be a temporary shield.
- Consider moving host provider if yours is silent. A host that can’t patch a critical flaw within days of release is telling you something about how they handle security of their clients websites.
Step 4: Check your site for signs of trouble
Since attacks started quickly, take a few minutes to look around: unfamiliar admin users, files or plugins you don’t recognize, sudden redirects, or a host warning about suspicious activity.
The bottom line
This isn’t a reason to panic, but it is a reason to act this week. Check your PHP version, get a straight answer from your hosting, and upgrade if your site is running on an older PHP version.
If you’d rather not deal with server settings, host negotiations or a security check yourself, that’s the kind of thing our WordPress developer service handles regularly. We can check your setup, get the PHP version sorted and make sure nothing was missed.