Facts are correct as of 22 October 2026. This story is still developing, so check your host’s latest guidance as well.
This week, the PHP team released emergency fixes for two critical security flaws, nicknamed PHP2Shell. PHP is the programming language WordPress runs on, so a serious flaw in PHP is a serious flaw in the foundations beneath millions of websites, possibly including yours.
The reassuring part is that checking takes only a few minutes. I checked my own hosting, and it was already covered. The less reassuring part is that attackers began probing for vulnerable servers almost as soon as the fix was published, so this is worth doing today and not next week.
What Has Happened
Researchers found two flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. Both let an attacker run their own code on a web server without logging in. Both were scored 9.2 out of 10 for severity, which puts them firmly in critical territory.
Details leaked a day ahead of the planned announcement, which brought the release forward to 21 October. Security firms then reported attempts to exploit the flaws, and Cloudflare reported early attacks and added emergency firewall rules as a stopgap.
It is worth being clear about what is and is not known. Attempts to exploit the flaws have been reported. At the time of writing, I have not seen a confirmed report of a specific server being taken over. Several government and university sites in Europe were taken offline as a precaution, which shows how seriously authorities are treating it, but precaution isn’t the same as a breach.
Why This Matters for WordPress
Most people think of site security as updating WordPress, themes and plugins. This is different. The flaws sit in PHP, the engine that runs all of that code. Updating WordPress or a plugin does nothing to fix them. The fix has to be applied to PHP itself, which is normally your hosting provider’s job, or yours if you manage your own server.
- The flaws affect a very wide range of PHP versions, and servers using Apache with mod_php have been described as the highest risk
- Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with each older release in those branches vulnerable
- PHP 8.1 and older no longer receive official updates, though limited source code fixes have been published for some of them, and your host may supply their own
- A compromised site can leak customer data, host spam or malware, and lose search visibility, because Google may flag or demote sites that have been hacked
How to Check Your Site
Step One: Find Your PHP Version
In your WordPress dashboard, go to Tools, then Site Health, then the Info tab, and open the Server section. It shows the PHP version your site is running. Compare it with the fixed versions above.
Step Two: Do Not Rely on the Number Alone
Some hosting providers apply the fix to an older-looking version number, so a version that appears behind may in fact be protected. The reverse can also be true: a site may show a fixed number, but the server hasn’t been restarted. This is why the most reliable check is to ask your host directly.
Step Three: Ask Your Host Plainly
- Has the server been updated with the fixes for CVE-2026-109618 and CVE-2026-109619?
- Have the web server and PHP processes been restarted since the update?
- If my PHP version is no longer supported, what are my options?
A good host will answer these quickly. Many managed WordPress hosts will already have patched everything, which was the case for me. If you manage your own server, you will need to update PHP and restart the web server yourself.
If Your Server Is Not Patched Yet
- Ask your host for a firm date, and push for it to be today
- If you are on an unsupported PHP version, take a full backup and arrange a move to a supported one
- A firewall or security plugin can help as a temporary measure, but it is not a substitute for patching, particularly if attackers can reach your server directly
- If you cannot get an answer and the site holds sensitive data, ask whether it can be put into maintenance mode or taken offline until it is fixed. UK and European security agencies have advised isolating affected systems where immediate protection is not possible
After the Patch: Check for Signs of Trouble
Patching closes the door, but it does not remove anyone who has already walked through it. If your server was exposed before it was fixed, look for signs of tampering.
- Administrator accounts you do not recognise
- PHP files you did not add, or files that changed unexpectedly, especially in the uploads folder
- Unexplained error messages, slowdowns or repeated server errors
- Strange pages in search results, or a security warning from Google Search Console
A malware scan from a reputable security plugin or your host can help, and so can comparing your site files against a clean copy of WordPress. If you find anything suspicious, restore from a clean backup taken before the problem and change every password.
A Quick PHP Security Checklist
☐ Check your PHP version under Tools, Site Health, Info, Server
☐ Ask your host to confirm both CVEs are fixed and that services were restarted
☐ Plan an upgrade now if your PHP version is no longer supported
☐ Take a fresh backup before making any changes
☐ Look for unfamiliar admin users and unexpected PHP files
☐ Check Google Search Console for security warnings
☐ Keep WordPress, themes and plugins updated as well, since this does not replace normal maintenance
Frequently Asked Questions
How do I know if my WordPress site is affected?
If your site runs on a PHP version without the fix, it is potentially exposed. Check your PHP version in Site Health, then confirm with your host that the fixes are installed, since version numbers alone can mislead.
Do I need to update WordPress or my plugins to fix this?
No, those updates do not fix flaws in PHP itself. The fix comes from updating PHP on the server, normally done by your host. You should still keep WordPress and plugins up to date, as that remains an important part of security.
Is my hosting provider responsible for patching this?
On managed or shared hosting, usually yes, though it is worth confirming they have done it. On a virtual private server or your own server, you are generally responsible, or whoever manages it for you.
Should I take my website offline?
For most small business sites on managed hosting, the first step is to ask your host rather than take the site down. If your server is unpatched and you cannot get a fix quickly, especially if you hold customer data, temporarily taking the site offline is a reasonable precaution.
Will a firewall protect me from this?
It can reduce risk while you wait, and some providers have added emergency rules, but it isn’t a complete fix. Attackers who can reach your server directly may bypass a firewall, so patching PHP remains the only complete answer.
Not Sure Whether Your Site Is Covered?
If you would like a second opinion on your PHP version, your hosting setup or whether your site shows any sign of trouble, get in touch for a plain conversation with no obligation and no sales pitch.