Skip to main content
BlogPHP2Shell: What WordPress Site Owners Need to Know
5 min readBy

PHP2Shell: What WordPress Site Owners Need to Know

CybersecurityPHPWordPressWebsite MaintenanceSmall Business TipsNorthwest North CarolinaSouthwest Virginia
Two people look at a computer beneath the WordPress logo; the image is titled PHP2Shell: What WordPress Site Owners Need to Know.

If you run an owner-led or family business in Northwest North Carolina or Southwest Virginia, your website may be part of the everyday work. Customers may use it to request a quote, book an appointment, ask a question, or place an order. If your site runs on WordPress, here is what to know about PHP2Shell.

PHP2Shell affects PHP, the server-side software WordPress uses. A WordPress site may be vulnerable if its PHP runtime lacks the fixes, even if WordPress, its theme, and plugins are current. Depending on your hosting setup, PHP may be updated through your host’s control panel or by the provider or server administrator. PHP announced fixes on October 21, 2026. PHP’s security release notice lists the fixed versions.

The short version: In WordPress, go to Tools → Site Health → Info → Server and note the PHP version. Ask your hosting company whether the installed build includes fixes for CVE-2026-109618 and CVE-2026-109619. Updating WordPress alone does not fix PHP. Because successful exploitation can allow unauthenticated code execution, ask your host to check this promptly.

What is PHP2Shell?

Wiz Research called its combined exploit demonstration PHP2Shell. Its tests showed that an attacker could run commands on vulnerable sites without signing in, including WordPress sites. The flaws are in PHP itself, not in a WordPress plugin or theme. Wiz Research explains its PHP2Shell findings.

That does not mean every WordPress site has been attacked. Site owners should check the PHP version and confirm the fixes. The CVE numbers below are identifiers you can share with your host.

What do the two PHP problems do?

  • CVE-2026-109618: If PHP runs out of available computer memory while responding to a visitor, a bug can leave it in an unsafe state. An attacker may be able to use that to make the server run commands. PHP’s advisory describes the flaw.
  • CVE-2026-109619: A fatal error can leave internal PHP worker state pointing to memory from a request that has ended. If a later request handled by that worker reaches the stale state, it may allow an attacker to run commands. PHP’s advisory describes the flaw.

Both problems are in PHP, and the PHP security updates address them.

Which PHP updates fix PHP2Shell?

PHP’s October 21 security release lists these fixed versions:

PHP version your site usesFixed version
PHP 8.28.2.35 or later
PHP 8.38.3.36 or later
PHP 8.48.4.27 or later
PHP 8.58.5.12 or later

Your hosting company may use its own version labels or install an update that does not show one of these exact numbers. Ask whether the PHP version running your site includes fixes for both CVEs.

PHP no longer provides regular security support for PHP 8.1 and older. For this incident, however, the PHP team published source backports for PHP 7.4, 8.0, and 8.1 to help people building PHP themselves. These are end-of-life branches, so ask your provider whether the installed build includes both fixes. Plan to move to a currently supported PHP version for ongoing security updates. PHP’s supported versions page lists the branches that receive regular updates.

What should a WordPress site owner do?

  1. In your WordPress dashboard, open Tools → Site Health → Info → Server and write down the PHP version. WordPress’s Site Health guide explains where to find this information. If you cannot access the dashboard, ask your web partner to check it.
  2. Contact your hosting company and ask: “Does the PHP version for my website include the fixes for CVE-2026-109618 and CVE-2026-109619? If I am using PHP 8.1 or older, what supported version can you move my site to?”
  3. After the host confirms the update, check the parts of the site customers rely on, such as the contact form, quote request, booking page, or checkout.

If you or your web developer manage the server, arrange the PHP update and have someone check the site afterward. Keep WordPress, themes, and plugins up to date too; those updates help with other issues, but they do not replace the PHP fix.

Common questions about PHP2Shell

Does PHP2Shell affect WordPress sites?

Yes. A WordPress site can be affected when it runs vulnerable, unpatched PHP. The vulnerability is in PHP, so updating WordPress itself does not remove it.

Will updating WordPress, a theme, or a plugin fix PHP2Shell?

No. Those updates do not update the PHP software on your hosting server. Your hosting company or server manager needs to install the PHP security fix.

What if I cannot update PHP myself?

If your hosting company takes care of the server, ask them to install the fix. Send the two CVE numbers and ask them to confirm when the site is covered. If they cannot update your current PHP version, ask what supported version they recommend and whether they can help move the site.

A practical next step

For owner-run and family businesses in Northwest North Carolina and Southwest Virginia, a website should make it easy for customers to get in touch, request a quote, book a visit, or place an order. If your site has become difficult to maintain or no longer fits the way your team works, Corespark can help plan and build a custom website around your day-to-day needs, with a clear handoff for your team. Talk with us about your website.

Sources

Need a technology partner in the Yadkin Valley?

Corespark helps local small businesses in NC and VA with tech strategy, web development, and more.

Talk to Corespark →

More from the Corespark Blog

Let's Connect