PHP2Shell: Is My WordPress Site at Risk?

What is PHP2Shell?

PHP2Shell is the nickname for two serious flaws in PHP, the software that runs behind WordPress. They were announced on October 21, 2026. An attacker does not need a login to use them, and a successful attack can let the attacker run commands on your web server.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. The PHP project published fixes the same day on its 2026 news page. For the full background, read our php2shell explainer.

Is my WordPress site vulnerable to PHP2Shell?

Possibly. Your site is exposed if the server it runs on uses a PHP version that does not have the October 21 fix. WordPress itself is not the problem. The flaw sits underneath it, in PHP, so the answer depends on your hosting account, not on your theme or plugins.

The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, per the PHP project. Among WordPress sites, the WordPress.org statistics feed shows about 34 percent on PHP 8.1 or older (our own calculation, October 27, 2026).

Does updating WordPress fix PHP2Shell?

No. Updating WordPress, your theme or your plugins does not change the PHP version on your server. PHP is installed and updated by your hosting company, or by whoever manages your server. A fully updated WordPress site can still sit on a vulnerable PHP version.

The PHP team rated one common setup, Apache with mod_php, as the highest risk, because the demonstrated attack runs before any of your site's own code does. That is why security plugins inside WordPress cannot close this gap. The fix is a patched PHP version, installed at the server level.

Is PHP2Shell being used in real attacks?

Yes. CISA, the US cyber agency, added both flaws to its Known Exploited Vulnerabilities list on October 26, 2026, a list reserved for flaws used in real attacks (CISA alert). Scanning started early. That makes an unpatched site a real target now, not a future risk, so confirm your PHP version with your host soon.

Zscaler counted 1,156 exploitation attempts from 156 unique IP addresses against 70 organizations in the first 48 hours, using decoy systems (Zscaler). F5 Labs reported that scanning began before official disclosure.

What do I do about PHP2Shell if my host is still on PHP 8.1 or 7.4?

Ask your host in writing for a patched PHP version, and plan an upgrade. PHP 8.1 and older no longer receive regular updates, so the fix is not guaranteed there. The PHP team shipped minimal source backports for 7.4, 8.0 and 8.1 because of the severity, but that is a one-time exception.

CISA's wording is blunt: organizations that cannot patch, or that keep using PHP 8.1 or earlier, should take PHP-based systems offline until patched. Whether to do that is a business call. Short of it, get a written fix date from your host.

The 8.2 date comes from the PHP supported versions page.

Has my hosting provider patched PHP2Shell?

Do not assume so. Some providers update PHP for you, and some only after you ask or redeploy. A secondary write-up on cloud platforms notes that some managed runtimes update only when you redeploy. Ask your host in writing which version you run and the date it was updated.

Bluehost, for example, posted a status notice about deploying patched PHP builds. Check your own provider's status page or ask support directly. The questions in our 5-minute owner check are a good script, and a host that says "we updated everything" should still tell you which version your site runs.

How do I check which PHP version my WordPress site runs?

Use our free PHP version checker. Inside WordPress, you can also open Tools, then Site Health, then the Info tab, and look under Server. Your hosting control panel usually shows the version under a PHP or "Select PHP Version" menu.

Write down the exact number, such as 8.3.36, not just "8.3". The last digits decide whether the October 21 fix is included. If the checker and the control panel disagree, trust the one closer to the live site, and ask your host to confirm.

How do I know if PHP2Shell was used against my site?

You usually cannot tell from the outside. Scanning is common and most attempts fail. Signs of a successful attack are the same as any break-in: unknown admin users, new files you did not upload, spam pages, odd redirects or a host warning about malware.

As of October 27, CISA lists ransomware use of these flaws as "Unknown" (CISA KEV feed). That means no confirmed link, not a clear result. If something looks wrong, read what to do in the first hour after a hack before changing anything.

How can Cuanto Labs help?

We start with a PHP Health Check for $295: your PHP version and end-of-life status, a plugin and theme compatibility scan, your host's options and a written plan. If you go ahead with an upgrade within 30 days, the fee is credited toward it.

From there, a standard WordPress upgrade is $3,500, with a staging copy and a 30-day fix of regressions. See the PHP upgrade service for scope. We cannot promise a site is unbreakable, but we can close this flaw and leave you a written record. If you are on a care plan, see website care plans.

If your host is pushing you to move, our guide on what to ask is at my host says upgrade PHP.

Next step

Check your version today with the PHP version checker. If it is not a patched number, or you are not sure, book a call and tell us your hosting provider.

This article is general information, not legal or compliance advice. Written by Eliran Yihye, founder of Cuanto Labs, on October 27, 2026.