PHP2Shell: What the Critical PHP Flaw Means for Your WordPress Site and How to Check If You’re Patched
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets attackers hijack PHP servers without logging in. Updating WordPress won't fix it. Here's how to check your PHP version, which releases are patched, and what top hosts say.