CompatNav

PHP2Shell: what WordPress site owners should do now

By CompatNav · Published · Last reviewed · 2 min read

Short answer

PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. They sit in PHP itself, not in WordPress or a plugin, and php.net says they “can allow unauthenticated remote code execution”. What to do: open Tools → Site Health → Info → Server and read the exact PHP version. 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later are patched. Anything lower: ask your host to update today. On PHP 8.1 or older, there is no official fix: plan the move to a supported version now.

What happened

On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. php.net: they “fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.” (php.net)

Unauthenticated remote code execution means an attacker who isn’t logged in could make your server run code of their choice. Security researchers nicknamed the pair PHP2Shell; the details are in CVE-2026-109618 and CVE-2026-109619 explained.

Is your site affected?

php.net: “Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.” (php.net) So every WordPress site is concerned until its PHP is updated. The way your host runs PHP changes the level of risk, not whether you’re concerned: mod_php or PHP-FPM?

What to do, in order

  1. Read your exact PHP version: Tools → Site Health → Info → Server → PHP version. The full number matters (how to read it).
  2. Compare it with the patched versions: 8.2.35, 8.3.36, 8.4.27, 8.5.12, or later in the same series.
  3. Not patched? Ask your host to update PHP now. What to ask your host has a message you can send.
  4. On PHP 7.4, 8.0 or 8.1? There is no official release for these: upgrade WordPress from PHP 7.4, 8.0 or 8.1.
  5. Running your own server? Apply the update yourself, and restart every PHP worker.

Will the update break my site?

Not this one. The fix keeps your site on the same PHP version, for example 8.3.35 to 8.3.36, and such releases are bug and security fixes only: patch releases versus upgrades. A move from 8.1 to 8.3 is different: that changes what your plugins run on, and needs a check first.

What about the mitigations?

The advisory lists settings that reduce exposure, but php.net is clear that they don’t replace the update: “while only an update is a complete solution, the following measures reduce exposure to specific attack paths but do not make an installation safe.” (php.net) They are for whoever manages the server: the mitigations explained.

And the advisory of 23 October?

A related, much less likely issue, CVE-2026-115560, with one recommended setting until the next regular release: the session upload progress advisory.

Key takeaways

  • Two critical PHP flaws, fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on 21 October 2026.
  • They affect PHP itself: no WordPress, plugin or theme update fixes them.
  • Check the full version number in Site Health: 8.3.35 is vulnerable, 8.3.36 is not.
  • PHP 7.4, 8.0 and 8.1 get no official release; only an upgrade or a vendor backport helps.
  • The patch stays on the same PHP version, so it doesn’t change how your plugins run.

Frequently asked questions

Do I need to update WordPress or my plugins for PHP2Shell?

Not for these two flaws: they are in PHP, the program your server uses to run WordPress. Keeping WordPress and plugins updated is still good practice, but the fix is a PHP update on the server.

My host manages PHP. Do I need to do anything?

Check that they did it: Site Health shows the exact version. If it still ends in a number below the patched ones, ask them when they will update.

Is my site already hacked?

A vulnerable version doesn’t mean an attack happened. Security firm watchTowr reports exploitation attempts since 21 October 2026, so update first, then ask your host whether they saw anything unusual.

Check your own site before you upgrade

CompatNav is a free WordPress plugin. It reads the code of your plugins and themes on your own server and tells you, in plain words, what will break and what will only show notices on the PHP version you choose. It never changes your code. It can’t see problems that only appear while code runs with real data, so a quick check of your site after the upgrade still matters.

Get CompatNav on wordpress.org How it works

Sources

About the code examples: each output is the real output of the code shown, run with the official PHP builds, without a php.ini, with all errors reported and displayed. Only the file path was replaced by a neutral server path.