A pair of critical security flaws in PHP, the programming language behind WordPress and a huge share of the web, has website owners and governments scrambling this week. The bugs, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), can let attackers take over a server without logging in. The fix is to update PHP itself to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or a host-patched build dated October 21, 2026 or later). Updating WordPress, themes or plugins does not fix it. Here is what happened, who is affected, and how to check your own site in a few minutes.
What is PHP2Shell?
PHP2Shell is the name researchers at cloud security firm Wiz gave to a set of memory-safety flaws in the core PHP engine. In its technical write-up published October 21, 2026, Wiz says successful exploitation “could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them.” PHP powers roughly 70% of all websites, according to Wiz, including WordPress, Joomla, Drupal and Wikipedia’s MediaWiki software.
The researchers combined the bugs into a single exploit and showed it could run code remotely, with no login, on the latest WordPress, Drupal and Joomla container images at the time of testing. They also showed attackers could read data from server memory, including passwords, tokens and API keys, without full takeover.
Two details make this unusually serious:
- It is in PHP, not in any app. Wiz notes that even a simple “Hello World” page running on an affected PHP version can be vulnerable.
- It goes back years. According to Google Cloud’s advisory, every PHP version from 5.4 through 8.5.11 is vulnerable, and both CVEs carry a Critical CVSS score of 9.2.
The AI angle
Wiz says it found the first flaw on August 19, 2026 with help from frontier AI models, reported it to the PHP security team on August 24, and held off on going public until patched releases were ready on October 21. The firm says the underlying flaws “had been present for decades,” but proving they could be exploited required a chain of steps “at the edge of what human researchers could practically achieve,” a barrier the AI tools substantially lowered.
Why websites have been going offline
Once the bugs were public, attackers moved fast. NPR reports that Cloudflare CEO Matthew Prince said his company saw tens of thousands of exploit attempts in the first 45 minutes, a number he said had grown into the millions by Thursday. Vercel’s security bulletin adds that working public exploits are already available.
That is why some sites have gone dark. According to NPR, dozens of British and Finnish government services were taken offline this week, and many French local government sites were briefly down. The U.K.’s National Cyber Security Centre urged organisations to “take immediate action,” and Japan’s prime minister told organisations that temporarily suspending a site is a reasonable option if they cannot patch quickly. So if a site you use was unexpectedly offline this week, this may be why.
Is my WordPress site affected?
If your site runs on an unpatched version of PHP, yes. In its official notice, WordPress.org says the vulnerabilities “are not specific to WordPress and affect any server that hosts a PHP application,” and that “no WordPress update is required or planned for these issues.” In other words, clicking “Update” in your dashboard will not protect you. The PHP version on your server has to change.
How to check your PHP version
- In your WordPress dashboard, go to Tools > Site Health > Info and expand Server.
- Look at the PHP version line and note the full number, for example 8.3.36, not just 8.3.
- Compare it with the table below.
One catch: the independent tracker php2shell.fyi points out that Site Health only checks the branch (such as 8.3), so a green Site Health result does not prove you are patched. WooCommerce stores can see the same number under WooCommerce > Status.
Patched PHP versions
| PHP branch | First fixed release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 (security support ends Dec. 31, 2026) |
| PHP 8.1 and older | No official fix; upgrade or get a vendor backport |
Source: PHP project releases as listed by Vercel and Google Cloud.
Why your version number might not change
Some hosts slipped the fix into the PHP version you already run instead of bumping the number. Hostinger’s status page says some sites still show PHP 8.5.11 after the update, and that is expected: if the Build Date in PHP Info is October 21, 2026 or later, the fix is in. GoDaddy has given similar guidance, according to the php2shellcheck hosting tracker. When in doubt, ask your host directly.
What major hosts say
Most shared and managed hosting customers do not have to do anything themselves, but it is worth confirming. As of October 22-23, 2026:
- Hostinger: says PHP upgrades are complete on all managed Web, Agency and cPanel hosting servers, with no client action needed. VPS customers manage PHP themselves (status page).
- GoDaddy: says it has patched all PHP versions on Web Hosting, Managed WordPress and Windows Hosting; VPS owners must update PHP themselves (GoDaddy blog).
- Bluehost: said on October 22 that most of its platforms were updated and the rollout was continuing (announcement).
Host status changes quickly, so check your provider’s own status page for the latest.
What to do right now
- Check your exact PHP version (and build date) as described above.
- On shared or managed hosting, ask your host whether the PHP build serving your site includes the fixes for CVE-2026-109618 and CVE-2026-109619.
- On a VPS or your own server, update PHP yourself to a patched release, then restart PHP processes and rebuild any containers. Vercel stresses that only the runtime serving live traffic counts, not your local copy.
- Running PHP 8.1 or older? Move to a supported branch. WordPress.org notes that if you manage your own server on an old version, you should consider taking it offline while you prepare to upgrade, echoing advice from national cyber agencies.
- Rotate secrets if you were exposed. Because the flaw can leak data from memory, php2shell.fyi recommends that stores which ran on unpatched PHP rotate payment-provider keys, API keys and other secrets after updating. Changing admin passwords is a sensible extra step.
A firewall helps but is not a substitute. Vercel says its WAF rules “reduce exposure to known exploit patterns, but do not replace patching.” For background on how these filters work, see our explainer on the top threats an intrusion prevention system detects.
What if you just use websites?
There is nothing to install on your phone or computer for this one, because the flaw lives on web servers, not on your device. Sensible habits still apply: use unique passwords with a password manager, turn on two-factor login, and treat “urgent security” emails with suspicion, since scammers often piggyback on big headlines. Our guide to protecting yourself from email threats covers the warning signs. And if a service you rely on suddenly goes down, our recent piece on what to do when your bank app goes down has practical backup tips.
Frequently asked questions
Does updating WordPress fix PHP2Shell?
No. WordPress.org says no WordPress update is required or planned. Only a patched PHP runtime fixes it.
Which PHP versions are safe?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later in each branch, or a host build that includes the fix (often shown by a build date of October 21, 2026 or later).
Is PHP 7.4 or 8.1 patched?
The PHP project is not releasing fixes for 8.1 or earlier. Some hosts and vendors, such as cPanel via Bluehost, list backported builds, but upgrading to PHP 8.3 or newer is the safer long-term move.
Has my site been hacked?
Patching stops new attacks but does not undo a past break-in. If you see unfamiliar admin users, strange files or redirects, follow WordPress.org’s “My site was hacked” guidance or ask your host for a malware scan.
Image: PHP logo by Colin Viebrock, via Wikimedia Commons (public domain).
