PHP2Shell: What WordPress Site Owners Must Do Now
PHP2Shell is a critical PHP flaw. Check your PHP version, ask your host to patch, and use a 503 if your site goes offline.
Bilal
3 min read
On 21 October 2026, PHP released emergency patches for two critical flaws nicknamed PHP2Shell. WordPress runs on PHP, so this affects your website.
So this guide explains what happened and what to do today. First, a note. Details are moving fast, so also check your host’s advisories.
What Happened
- The flaws are CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale, according to The Hacker News.
- Attackers can run code on a server without logging in, according to Help Net Security.
- The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- CISA urged organisations to patch immediately.
- watchTowr reported active exploitation attempts on 21 October. Amazon recorded one on 17 October, before disclosure.
Some estimates say more than 70% of websites use PHP, according to The Record. Temporary settings only reduce the risk, according to UptimeRobot, so the patch is the real fix.
Check Your PHP Version
- In WordPress, go to Tools, then Site Health, then Info, then Server.
- Read your PHP version.
- Compare it with the fixed versions: 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
- If yours is lower, ask your host to update today.
On most hosting plans, your host updates PHP, not you. Malwarebytes advises asking the host to confirm that the fixes are live, not just scheduled.
PHP 8.1 and older no longer receive routine security updates. So ask your host about backported fixes, or plan an upgrade.
If You Take Your Site Offline
Most sites can patch without downtime, according to Search Engine Roundtable. But some owners are taking sites down while they update. If that is you, follow Google’s advice.
- Use an HTTP 503 status, not timeouts, 404 or 500 errors, according to John Mueller.
- Serve the 503 from outside PHP, for example through DNS or a CDN, because PHP is what is down.
- Keep your robots.txt file reachable, according to Search Engine Journal.
- Never serve an error page with a 200 status, because Google may index the error text.
Google has not said how long a 503 can stay up. So keep the downtime short.
What to Do After Patching
- Check for admin users you do not recognise.
- Look for unknown files and odd redirects.
- Update WordPress, plugins and themes.
- Confirm your backups work.
- Ask your host whether it saw suspicious activity before the update.
For a fuller checklist, read our guide to WordPress security in 2026. Also see what website maintenance for builders includes.
How We Can Help
We can check your PHP version, coordinate the update with your host and review your site afterwards. See our IT support service.
Book a free consultation at bilalwebstudio.co.uk or email [email protected].
Frequently Asked Questions
What is PHP2Shell?
It is the nickname for two critical PHP flaws. They let attackers run code on a server without logging in.
Does PHP2Shell affect WordPress sites?
Yes, if the server is unpatched, because WordPress runs on PHP. How-To Geek lists WordPress among the platforms seen so far.
Which PHP versions contain the fix?
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 contain the fix.
Should I take my website offline?
Not necessarily. Most sites can patch without downtime. If you must go offline, serve a 503 from outside PHP.
