wp2html

PHP2Shell and WordPress: what to do now

Published . We update this page as new facts come in.

On October 21, 2026, two critical vulnerabilities in PHP, the language WordPress runs on, were made public. They're known as PHP2Shell. Here's what they are, whether your site is affected, and what to do about it.

What happened

  • The two flaws are CVE-2026-109618 and CVE-2026-109619. The PHP project rates both 9.2 out of 10 (CVSS v4.0).
  • They let an attacker run code on a web server by sending it a specially crafted request. No login is needed.
  • Security firm Wiz, OpenAI and offensive-security firm Calif found them with the help of AI models and reported them to PHP in August 2026.
  • Wiz confirmed working attacks against WordPress and Drupal in their default settings.
  • Some security firms reported attack attempts on the day of disclosure.

Is your site affected?

If your site runs on PHP and your host hasn't updated PHP since the fix came out, assume it is. That includes almost every WordPress site.

  • The fix is in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
  • PHP 8.1 and older are past end of life and get no official fix. About 18% of WordPress sites run them, according to mysites.guru.
  • Updating WordPress, your theme or your plugins does not fix this. The flaw is in PHP itself.
  • A firewall in front of your site helps, but it isn't a complete fix. Cloudflare says it deployed firewall rules for these flaws.

What to do today

  1. Ask your host which PHP version your site runs and whether it was updated after October 21, 2026. Some hosts patch PHP without changing the version number, so ask directly.
  2. If you're on PHP 8.1 or older, plan an upgrade to 8.2 or newer. Test the site first: old themes and plugins can break on newer PHP.
  3. While you sort it out, put the site behind a web application firewall, such as Cloudflare's.
  4. Look for signs of trouble: admin users you don't recognize, new files you didn't upload, or pages that redirect to strange sites.
  5. Make sure you have a recent backup stored somewhere other than your hosting account.

Our free site check shows what your homepage reveals, including the PHP version, when your server shows it.

Why static HTML sidesteps this kind of flaw

A static site is a set of finished files. When a visitor arrives, the server hands over a file. No PHP runs and no database is queried, so there's nothing for a PHP flaw to reach.

That doesn't make a static site immune to everything. Your Cloudflare and domain accounts still need strong passwords and two-factor sign-in, and any outside scripts you add still matter. But the largest attack surface a WordPress site has, PHP plus plugins plus a public login page, is gone.

If you want to keep editing in WordPress, we can keep it as a private editor that isn't reachable from the internet and publishes static pages. In that setup the private WordPress still needs PHP updates, and we handle them.

Get a quote to move your site Check my site

Sources