PHP2Shell: What the PHP Vulnerability Means for Your WordPress Site

On 21 October 2026 the PHP team fixed two critical vulnerabilities that became known as PHP2Shell. Government agencies took their websites offline as a precaution, it made the evening news in Germany, and there may already be a warning from your host in your inbox.

If you run a WordPress site, this very likely affects you. WordPress runs on PHP, and PHP2Shell sits right there: not in a plugin, not in WordPress itself, but one layer below. This article explains in plain language what happened, how to tell whether your site is safe and what to do now.

This article reflects the situation on 29 October 2026. All facts come from the security advisories of PHP, CERT-EU, Tenable and heise; sources are listed at the end.

The short version

• What: Two flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619), both rated critical at 9.2 out of 10. They let attackers run their own code on the server without logging in.
• Who is affected: Practically every PHP installation that serves web pages, so almost every WordPress site. According to Calif’s analysis, the affected code goes back to PHP 5.4.
• Safe versions: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or newer. For 7.4 to 8.1 there are only source-code fixes; older versions remain unpatched.
• Already exploited: The first attack attempt was seen on 17 October, four days before the patch. On 26 October the US agency CISA listed both flaws as actively exploited.
• What you need to do: Ask your host, or check yourself, whether PHP has been updated and restarted. Then update WordPress, plugins and theme.
• The lesson: A WordPress site is only as secure as its weakest link. There are many links, and one of them isn’t even in your hands.

What is PHP2Shell?

PHP is the programming language WordPress is written in. Every time someone visits your site, your server starts PHP, and PHP assembles the page from the database, theme and plugins.

PHP2Shell is two bugs in that engine:

• CVE-2026-109618 concerns how PHP handles running out of memory. If memory runs out halfway through processing a request, for example while uploading a form, a half-initialised state can be left behind. During cleanup PHP wrongly treats that data as valid, and attackers can fill exactly that gap with their own data.
• CVE-2026-109619 is a use-after-free bug: leftovers from an earlier request point to memory that has already been freed, and a later request to the same process can exploit it.

In the worst case both end the same way: a stranger sends a crafted request to your website and gets a shell, a command line on your server. Hence the name. According to PHP, the risk is highest with Apache and mod_php, where the attack works before any WordPress code even runs. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are affected too.³

In a short video, the researchers at Calif showed how they used it to run system commands on a web server running the Laravel PHP framework after 38 seconds.⁴

Why this matters so much for WordPress

When it comes to WordPress security, most people think of plugins first, and rightly so: in 2025 alone, 11,334 new vulnerabilities were found in the WordPress ecosystem, 91% of them in plugins.¹

PHP2Shell shows, however, that a WordPress site consists of several layers, and each of them can break:

1. The server with operating system and web server
2. PHP, which runs everything ← this is where PHP2Shell sits
3. WordPress itself
4. Plugins and theme
5. Your content and credentials

As a site owner you control layers 3 to 5. For most small websites, layers 1 and 2 belong to the host. If the host doesn’t update quickly enough, keeping all your plugins up to date won’t help you.

What has happened so far

• 17 October: Amazon Threat Intelligence observes a first exploitation attempt, four days before the flaws become public.³
• 20 October: The CVE numbers surface on Hacker News and social media. The PHP team announces a security release and moves it forward by a day.³
• 21 October, 14:00 UTC: PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35.² Agencies, hospitals and hosts across Europe take websites offline as a precaution.
• 23 October: Censys finds more than 41 million PHP services worldwide with vulnerable version numbers, around 4.2 million in Germany, second only to the USA.⁵
• 26 October: CISA adds both flaws to its catalogue of known exploited vulnerabilities. Trail of Bits confirms working exploits against pre-patch PHP 8.2 to 8.5.³
• 27 October: heise reports the first confirmed successful attacks.⁶

Which PHP versions are safe?

One catch: Linux distributions such as Debian or Ubuntu often backport security fixes into older version numbers, so a reported “8.2.30” may already be patched. Conversely, the update does nothing until PHP is restarted, because running processes keep using the old code.³

How to check your WordPress site

1. Look in the WordPress admin. Under Tools → Site Health → Info → Server you’ll find the PHP version WordPress is using.

2. Check from outside. Our free WordPress security check shows whether your server reveals its PHP version and whether it includes the fix. It also shows which plugins are visible from outside, whether usernames are publicly accessible and which security headers are missing. It only looks at public addresses, without any login attempts. Around 54% of PHP servers hide their version, though, and then no third-party check can judge PHP2Shell reliably.⁵

3. Ask your host. The most reliable answer is a short email: “Is PHP on my plan patched against CVE-2026-109618 and CVE-2026-109619 and restarted?” Reputable hosts have a status page for this by now.

What to do now

1. Have PHP updated (or update it yourself) and restart the PHP service.
2. Update WordPress, your theme and all plugins. PHP2Shell is a good reason to bring everything else up to date too.
3. Delete unused plugins rather than just deactivating them. Every plugin is extra code.
4. Look for traces: administrators you don’t know, unfamiliar files in wp-content, sudden redirects to other sites. If your server was unpatched when the attacks started, it’s worth a look even if everything seems normal.
5. Change passwords if there are signs of a break-in: WordPress admins, FTP/SFTP and the database.
6. Check your backup: do you have one from before 17 October that you could restore if needed?

What PHP2Shell teaches us about WordPress

PHP2Shell is not a one-off. It’s just a particularly visible example of a pattern WordPress owners have known for years: the site is never finished. Somewhere in the server, PHP, WordPress or one of the plugins there is always the next vulnerability, and attackers are fast. For serious WordPress flaws the median time to mass exploitation is five hours, and 46% of vulnerabilities had no patch yet when they became public.¹

For an online shop or a portal with logins, that effort is the price of the features. For the typical business, practice or club website, though, there’s an honest question: does this site need PHP at all? Opening hours, services, team, a contact form: all of that can be delivered as a finished, static site. Without PHP, a database or plugins, a flaw like PHP2Shell simply has nothing to attack.

That’s exactly what we do with getmind: we rebuild your existing WordPress site 1:1 as a static website, with the same content and the same URLs so your Google rankings stay intact. You get an admin area where you edit texts yourself or tell the AI what should change. We take care of the servers and the technology. The rebuild costs €99 once; hosting is then free for three months and costs €4.99 per month from the fourth month, including 150 AI credits. And if you’re not happy, you get your money back within 30 days, no conditions.

FAQ

Is my WordPress site affected by PHP2Shell?

Very likely it was, if it ran on a typical PHP version before 21 October 2026. Whether it still is depends on whether your host has updated PHP to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or a patched distribution version, and restarted it.

Do I need to do anything myself on shared hosting?

PHP is usually updated by the host. You should still ask whether it has happened, and keep WordPress, your theme and plugins up to date yourself.

Is a security plugin like Wordfence enough?

Not reliably against PHP2Shell. With mod_php, the attack happens before WordPress, and therefore any plugin, is even loaded. Security plugins help against many other attacks but don’t replace a PHP update.

Does PHP2Shell affect my Windows PC?

No, unless you run a web server with PHP on it. This is about servers delivering web pages with PHP.

My host says the version number is old but patched. Is that true?

It can be. Linux distributions often backport fixes into older version numbers. If in doubt, ask for confirmation that the distribution package includes the fix for both CVEs.

How can I tell whether my site has already been attacked?

Typical signs are unknown administrators, new or modified PHP files in wp-content, redirects to other sites and spam pages for your domain in Google search. If in doubt, your host or a security provider can help.

Is a static website really more secure?

Against this kind of flaw, yes: without PHP and a database, nobody can run code on your website through a request. Someone still has to maintain the server behind it; at getmind we do that. For shops, bookings with payment or member areas, however, a static site isn’t the right choice.

Sources

1. Patchstack: State of WordPress Security in 2026
2. CERT-EU: Critical Vulnerabilities in PHP (Advisory 2026-018)
3. Tenable: php2shell (CVE-2026-109618, CVE-2026-109619) FAQ
4. heise online: php2shell: Critical flaws allow code injection in PHP
5. heise online: php2shell: Millionen PHP-Dienste in Deutschland verwundbar (German)
6. heise online: php2shell: Successful attacks confirmed, many instances still unpatched