PHP2Shell: Is Your WordPress Site at Risk? How to Check in 5 Minutes

If your website runs on WordPress, there is a security story from this week you should not ignore. On October 21, 2026, the PHP project released emergency patches for two critical flaws, nicknamed PHP2Shell, that can let an attacker take control of a web server without logging in. Attack attempts started before many site owners had even heard about it.

This guide explains what PHP2Shell is in plain language, why it matters for ordinary WordPress sites, and the simple steps you can take today to make sure your site is safe.

Key Takeaways

• PHP2Shell is two critical bugs in PHP itself: CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 for severity.
• They allow unauthenticated remote code execution, meaning an attacker can run their own code on your server without a password.
• Safe versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or newer.
• PHP 8.1 and older get no official fix. If your site still runs on them, it is time to upgrade.
• Real attacks have already been seen, so this is not a “someday” problem.

What Is PHP2Shell?

PHP is the programming language that powers roughly three out of every four websites on the internet, including every WordPress, Joomla and Drupal site. When someone visits your website, PHP runs behind the scenes to build the page.

PHP2Shell is the name given to two bugs in how PHP cleans up its memory when a web request ends in an unusual way. In simple terms, PHP can leave a small “mess” in memory, and a skilled attacker can send a specially crafted request that uses that mess to run their own commands on the server. The “Shell” in the name refers to a shell: full command access to the machine.

What makes this especially serious is that the bug is in PHP itself, not in a plugin or theme. According to the PHP team, on setups using Apache’s mod_php, an attack can be triggered before any of your website’s own code even runs. That means a well-maintained WordPress install with every plugin updated can still be exposed if the PHP underneath it is old.

Where AI Comes In

The flaws were reported by researchers from security firms Calif and Wiz together with OpenAI. It is part of a growing trend: AI tools are increasingly being used to scan huge, decades-old codebases like PHP for subtle memory bugs that humans have missed for years.

That is good news in the long run, because more bugs get found and fixed. But it also means the gap between a bug being found and attackers exploiting it is shrinking. Security researchers reported exploitation attempts against PHP2Shell even before the official patches were public, and Cloudflare said it was already seeing early attacks and had deployed firewall rules in response. The lesson for site owners: updates can no longer wait weeks.

Is My WordPress Site Affected?

Any PHP installation that serves web pages is potentially affected, whether it runs with PHP-FPM, Apache mod_php, php-cgi, LiteSpeed or FrankenPHP. Security scanners estimate that more than 5 million PHP servers are reachable on the internet. The question is simply which PHP version your site is using.

How to Check Your PHP Version in 5 Minutes

You do not need to be a developer to check this. Use either method below.

Method 1: Inside WordPress

1. Log in to your WordPress dashboard.
2. Go to Tools → Site Health, then open the Info tab.
3. Expand the Server section and look for PHP version.
4. Compare the number with the table above.

Method 2: In Your Hosting Control Panel

Most shared hosts (Hostinger, Bluehost, GoDaddy and others) show the PHP version in cPanel or hPanel under a menu such as Select PHP Version or PHP Configuration. From the same screen you can usually switch to a newer version with one click.

What to Do Right Now

1. Back up your site first. Use your host’s backup tool or a plugin, so you can roll back if anything breaks.
2. Update PHP. On shared hosting, your host patches PHP on their side, but you may still need to choose a supported version (8.3 or newer is a good choice). If you manage your own server or VPS, install the patched release for your branch and restart PHP.
3. Ask your host if you are unsure. Send a short message: “Has my server been patched for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?”
4. Update WordPress, themes and plugins so they are compatible with newer PHP versions.
5. Check your site afterwards. Visit a few pages and log in to the dashboard to make sure everything works.

Can’t Update Immediately?

Server administrators who cannot patch right away can reduce risk with temporary settings recommended by the PHP team, such as disabling session.upload_progress.enabled, keeping post_max_size low and enforcing request-size limits at the web server. These steps only reduce risk. The PHP team is clear that updating is the only full fix, and the UK’s National Cyber Security Centre has urged organisations to update immediately or take unpatched systems offline.

Why This Matters Beyond This One Bug

Many small website owners set up WordPress once and never think about the server underneath it again. PHP2Shell is a reminder that the hosting layer needs care too. With AI speeding up the discovery of new vulnerabilities, expect more alerts like this one. A good habit is to check your PHP version and hosting updates once a month, the same way you update plugins.

Frequently Asked Questions

What is PHP2Shell?

PHP2Shell is the nickname for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, which can let an attacker run code on a web server without logging in.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on October 21, 2026, contain the fixes. Any newer release in those branches is also safe.

Does updating WordPress plugins protect me?

No. The flaw is in PHP itself, so plugin and theme updates do not fix it. You need a patched PHP version on your server.

I’m on PHP 7.4 or 8.1. What should I do?

These versions no longer receive official updates from PHP. Switch to PHP 8.3 or newer through your hosting panel, after taking a backup and checking that your plugins support it.

Is PHP2Shell being actively exploited?

Yes. Security companies including Cloudflare have reported attack attempts, some of them starting before the patches were released. Treat this as urgent.

Sources: official PHP security release notes, BleepingComputer, Help Net Security, Qualys and watchTowr research published October 20–22, 2026.