[{"data":1,"prerenderedAt":280},["ShallowReactive",2],{"article:\u002Farticles\u002Fwordpress-php2shell":3},{"article":4,"hasOther":273},{"id":5,"title":6,"author":7,"body":8,"description":255,"extension":256,"faq":257,"labels":270,"meta":271,"metaTitle":272,"navigation":273,"ogImage":274,"path":275,"published":276,"seo":277,"stem":278,"updated":274,"__hash__":279},"articles\u002Farticles\u002Fwordpress-php2shell.md","Is my WordPress site safe from PHP2Shell?","Jasper",{"type":9,"value":10,"toc":243},"minimark",[11,15,20,23,26,29,33,36,39,43,46,63,66,70,93,96,156,159,162,166,169,175,178,181,185,188,192,195,204,208],[12,13,14],"p",{},"Not until whoever runs your server updates PHP. PHP is the software your server uses to run WordPress, and PHP2Shell is a flaw in PHP itself. Updating WordPress, your theme or your plugins does not fix it. Check which PHP version your site runs, then ask your hosting company whether the fix is installed.",[16,17,19],"h2",{"id":18},"what-is-php2shell","What is PHP2Shell?",[12,21,22],{},"PHP2Shell is the name for two flaws in PHP that the PHP team fixed on 21 October 2026. They are tracked as CVE-2026-109618 and CVE-2026-109619, and the PHP team rates both 9.2 out of 10.",[12,24,25],{},"An attacker can use them to run their own code on your server without logging in. That lets them change your pages, read data such as the customer details sent through your forms, or leave a hidden way back in for later.",[12,27,28],{},"Attacks have started. Cloudflare said on 21 October that it was already seeing early attacks. The UK's National Cyber Security Centre told organisations to update PHP immediately, or take the system offline until they can.",[16,30,32],{"id":31},"is-php2shell-a-wordpress-vulnerability","Is PHP2Shell a WordPress vulnerability?",[12,34,35],{},"No. It is a PHP vulnerability, and every WordPress site runs on PHP. So does every Joomla and Drupal site, and every WooCommerce shop. The PHP team says all PHP installations that serve web pages are at risk.",[12,37,38],{},"That is why a WordPress update does not help. WordPress is the program, and PHP is what runs the program. You can update the program as many times as you like and the thing underneath stays the same.",[16,40,42],{"id":41},"who-has-to-fix-it","Who has to fix it?",[12,44,45],{},"Whoever runs the server. For most small business websites that is one of two people:",[47,48,49,57],"ul",{},[50,51,52,56],"li",{},[53,54,55],"strong",{},"Your hosting company",", if you pay a yearly hosting fee and log in to a control panel such as cPanel. On shared hosting you cannot update PHP yourself, so the host has to.",[50,58,59,62],{},[53,60,61],{},"Your developer or agency",", if they set the site up on its own server, for example on DigitalOcean or AWS.",[12,64,65],{},"If you do not know which one it is, find out this week. A site where nobody is in charge of the server is the site that stays exposed.",[16,67,69],{"id":68},"how-do-i-check-which-php-version-my-site-runs","How do I check which PHP version my site runs?",[12,71,72,73,76,77,80,81,84,85,88,89,92],{},"In your WordPress dashboard, go to ",[53,74,75],{},"Tools",", then ",[53,78,79],{},"Site Health",", then the ",[53,82,83],{},"Info"," tab. Open the ",[53,86,87],{},"Server"," section and look for ",[53,90,91],{},"PHP version",".",[12,94,95],{},"The PHP project fixed these versions:",[97,98,99,112],"table",{},[100,101,102],"thead",{},[103,104,105,109],"tr",{},[106,107,108],"th",{},"If your site runs",[106,110,111],{},"It needs at least",[113,114,115,124,132,140,148],"tbody",{},[103,116,117,121],{},[118,119,120],"td",{},"PHP 8.5",[118,122,123],{},"8.5.12",[103,125,126,129],{},[118,127,128],{},"PHP 8.4",[118,130,131],{},"8.4.27",[103,133,134,137],{},[118,135,136],{},"PHP 8.3",[118,138,139],{},"8.3.36",[103,141,142,145],{},[118,143,144],{},"PHP 8.2",[118,146,147],{},"8.2.35",[103,149,150,153],{},[118,151,152],{},"PHP 8.1 or older",[118,154,155],{},"no update from the PHP project, see below",[12,157,158],{},"The number does not tell the whole story. Linux vendors such as Ubuntu, Debian and Red Hat often install a fix without changing the version number, and they got these fixes before the public release. A lower number can still be safe. A higher number on an old server can still be missing it. The version check tells you what to ask, and your host gives you the answer.",[12,160,161],{},"PHP 8.1 and older no longer get updates from the PHP project. The PHP team published basic fixes for 7.4, 8.0 and 8.1 because the flaw is so serious, but someone still has to install them on your server. If your site shows 8.1 or lower, that is the first thing to raise with your host.",[16,163,165],{"id":164},"what-should-i-ask-my-hosting-company","What should I ask my hosting company?",[12,167,168],{},"Send them this:",[170,171,172],"blockquote",{},[12,173,174],{},"Has PHP on my server been updated for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)? Is the fix installed now, or only scheduled?",[12,176,177],{},"Ask whether it is installed, not whether it is planned. If they cannot install it yet, ask whether your site should go offline until they can. If your site runs PHP 8.1 or older, ask when they will move it to a supported version.",[12,179,180],{},"After any move to a newer PHP, open your site and check the pages that matter, such as the contact form, the shop and the checkout. Old plugins sometimes stop working on a newer PHP.",[16,182,184],{"id":183},"what-if-my-site-is-behind-cloudflare","What if my site is behind Cloudflare?",[12,186,187],{},"Cloudflare added blocking rules for the known attacks, on every plan including the free one. They help. They are also temporary, and the PHP team says that only updating PHP fully protects a site. Cloudflare buys time for your host to update. It does not replace the update.",[16,189,191],{"id":190},"what-if-nobody-looks-after-my-website","What if nobody looks after my website?",[12,193,194],{},"Then this is the real finding, more than PHP2Shell. Hosts patch their own servers. A site on a server that a former developer set up and nobody has touched since will not get fixed by anyone.",[12,196,197,198,203],{},"Our ",[199,200,202],"a",{"href":201},"\u002Faudit","free website audit"," checks from the outside what an owner usually cannot see. That includes whether WordPress, your theme and every plugin are on a current version. We cannot read your server's PHP version from outside, but we can tell you who should, and what to ask them.",[16,205,207],{"id":206},"sources","Sources",[47,209,210,219,227,235],{},[50,211,212,213],{},"PHP, \"Security advisory: Critical remote code execution vulnerabilities, update now\", 21 October 2026. ",[199,214,218],{"href":215,"rel":216},"https:\u002F\u002Fwww.php.net\u002Farchive\u002F2026.php#2026-10-21-5",[217],"nofollow","php.net\u002Farchive\u002F2026.php#2026-10-21-5",[50,220,221,222],{},"PHP, \"Upcoming Critical PHP Security Release\", 20 October 2026. ",[199,223,226],{"href":224,"rel":225},"https:\u002F\u002Fwww.php.net\u002Farchive\u002F2026.php#2026-10-20-1",[217],"php.net\u002Farchive\u002F2026.php#2026-10-20-1",[50,228,229,230],{},"BleepingComputer, \"PHP ships emergency patches for critical PHP2Shell flaws\". ",[199,231,234],{"href":232,"rel":233},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fphp-ships-emergency-patches-for-critical-php2shell-flaws\u002F",[217],"bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fphp-ships-emergency-patches-for-critical-php2shell-flaws",[50,236,237,238],{},"Malwarebytes, \"PHP2Shell: Why websites are going offline for emergency security updates\". ",[199,239,242],{"href":240,"rel":241},"https:\u002F\u002Fwww.malwarebytes.com\u002Fblog\u002Fbugs\u002F2026\u002F10\u002Fphp2shell-why-websites-are-going-offline-for-emergency-security-updates",[217],"malwarebytes.com\u002Fblog\u002Fbugs\u002F2026\u002F10\u002Fphp2shell-why-websites-are-going-offline-for-emergency-security-updates",{"title":244,"searchDepth":245,"depth":245,"links":246},"",2,[247,248,249,250,251,252,253,254],{"id":18,"depth":245,"text":19},{"id":31,"depth":245,"text":32},{"id":41,"depth":245,"text":42},{"id":68,"depth":245,"text":69},{"id":164,"depth":245,"text":165},{"id":183,"depth":245,"text":184},{"id":190,"depth":245,"text":191},{"id":206,"depth":245,"text":207},"Not until your host updates PHP. Updating WordPress does not fix PHP2Shell. Check your PHP version, then ask your host one question.","md",[258,261,264,267],{"q":259,"a":260},"Does updating WordPress fix PHP2Shell?","No. PHP2Shell is a flaw in PHP, the software your server uses to run WordPress. Updating WordPress, your theme or your plugins does not change PHP. Whoever runs your server has to update it.",{"q":262,"a":263},"My website was offline for maintenance this week. Was it hacked?","Not necessarily. Hosts are taking sites offline for a short time while they install the PHP fix. Downtime on its own does not mean someone broke in. Ask your host what the maintenance was for.",{"q":265,"a":266},"Is my Wix, Squarespace or Shopify site affected?","On those platforms the platform runs the server, not you. There is nothing for you to update.",{"q":268,"a":269},"My site runs PHP 7.4. What now?","The PHP project stopped updating 8.1 and older. Some hosts and Linux vendors still send fixes for older versions, so ask yours whether your server has one. If not, ask them to move you to PHP 8.2 or newer, and test the site after the move, because old plugins sometimes break on a newer PHP.",false,{},"Is your WordPress site safe from PHP2Shell?",true,null,"\u002Farticles\u002Fwordpress-php2shell","2026-10-22",{"title":6,"description":255},"articles\u002Fwordpress-php2shell","ry_VbZt8Vx47r5ejUDy4y5GXlVBdzLHGijqJoTFunPE",1792645003813]