php2shell PHP Flaws: Is Your WordPress Site Exposed?
Critical runtime bugs CVE-2026-109618 and CVE-2026-109619 affect every PHP-powered site. Check your exposure now.
Yes, your WordPress or WooCommerce site is almost certainly affected if the server runs any PHP version before the 21 October 2026 patched releases: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The php2shell flaws — CVE-2026-109618 and CVE-2026-109619 — sit in the PHP runtime itself, so updating WordPress core, plugins or themes does not fix the problem; only the hosting provider or server administrator can apply the patch.
Both vulnerabilities carry a CVSS v4.0 score of 9.2 (critical) and allow unauthenticated remote code execution on the web server. Exploitation attempts were observed in the wild shortly after the PHP project disclosed the flaws on 21 October 2026, though no confirmed breaches had been published at disclosure time. End-of-life PHP branches receive no official release; the PHP security team published source backports for older versions instead.
Why WordPress and WooCommerce Sites Are in Scope
The php2shell vulnerabilities affect any PHP installation that serves web requests. This includes PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Because WordPress, WooCommerce, Magento, Drupal, Laravel and virtually every other PHP application rely on the underlying runtime, the application layer cannot mitigate the issue. A fully patched WordPress installation on an unpatched PHP 8.3 server remains fully exploitable.
What to Ask Your Hosting Provider Today
Contact your hosting support immediately and request written confirmation of the following:
- The exact PHP version currently running on your production environment.
- Whether the patched versions (8.5.12, 8.4.27, 8.3.36 or 8.2.35) have been applied.
- The scheduled maintenance window if the patch is not yet live.
- Whether a web application firewall rule or virtual patch is active as an interim control.
- Confirmation that staging and development environments are included in the rollout.
Managed WordPress hosts such as Kinsta, WP Engine, 20i and Krystal typically apply runtime patches within hours. Shared hosting and VPS customers on unmanaged plans must often trigger the update themselves or raise a support ticket.
What to Do This Week: Checklist
- Run php -v via SSH or ask your developer to output phpinfo() from a temporary file to verify the active version.
- If the version is older than the patched releases listed above, request an immediate update from your host or apply the package manager update on self-managed servers.
- Confirm the update succeeded by re-checking the version string.
- Review access and error logs for anomalous POST requests or crashes around 21 October 2026 onwards.
- Ask your host for a statement on whether they applied the PHP project source backports for any end-of-life branches still in use.
- Document the remediation steps and date for compliance records and cyber insurance purposes.
Interim Mitigations If Patching Is Delayed
If your host cannot patch immediately, request that they enable a web application firewall rule targeting the known exploitation vectors. Cloudflare, Fastly and many managed hosts deployed virtual patches within hours of disclosure. Restrict admin panel access by IP allow-list and enforce strong authentication on all entry points. Disable unused PHP extensions such as pcntl or posix if your application does not require them, reducing the attack surface.
End-of-Life PHP Branches Require Urgent Action
Sites still running PHP 8.1, 8.0 or 7.4 receive no official binary release. The PHP security team published source backports, but compiling and deploying these requires specialist knowledge. The safest path is to migrate to a supported branch (8.2 or newer) on the patched version. Treat this as a business continuity priority: an unpatched end-of-life runtime combined with a critical remote code execution flaw creates an unacceptable risk profile for any UK business handling customer data or transactions.
Sources: PHP security advisories, Tenable, Rapid7, The Hacker News, Datadog Security Labs.
Frequently asked questions
Does updating WordPress plugins fix the php2shell vulnerability?
No. The flaws exist in the PHP runtime on the server, not in WordPress code. Only updating the server PHP version to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 resolves the issue.
My host says they use a web application firewall. Am I safe without a PHP update?
A WAF or virtual patch reduces risk but is not a substitute for patching the runtime. Insist on the official PHP update as the primary fix.
We run PHP 8.1 on a VPS we manage ourselves. What should we do?
PHP 8.1 is end-of-life and has no official binary patch. Upgrade to PHP 8.2.35 or newer immediately, or compile the PHP project source backport if you cannot upgrade yet.
Have any UK WordPress sites been hacked via php2shell yet?
At the 21 October 2026 disclosure, security firms reported exploitation attempts in the wild but no confirmed break-ins had been published. Treat the threat as active and patch immediately.
Want your company inside the AI answers?
1real.ai builds AI agents and gets businesses cited by ChatGPT, Gemini and Perplexity. Book a free discovery call.
Email us