Rob Record
Security alert · last checked 22 October 2026

PHP2Shell: is your WordPress site affected?

Very likely. WordPress runs on PHP, and this hole is in PHP itself, so it reaches almost every WordPress site until the server is updated.

Here's what it means in plain English, how to check your site in two minutes, and how I can fix it for you.

Get it fixed Check my site
What it is

A security hole in PHP, the language WordPress runs on

PHP is the programming language WordPress runs on. Your hosting runs PHP every time someone visits a page. On 21 October 2026 the PHP project fixed two serious holes in it, which security researchers have named PHP2Shell.

The worst of it: an attacker can send one specially made request to your site and run their own code on your server. They don't need a password, and it happens before WordPress itself starts. Once they're in, they can change your site, steal your customers' details, or use your server to attack others. The holes can also leak bits of the server's memory, which can include passwords and other people's sessions.

Why updating WordPress won't fix it, but updating PHP will

This isn't a WordPress bug, or a plugin bug. Updating WordPress and your plugins is still a good idea, but it won't close this hole. Neither will a security plugin such as Wordfence, because the attack lands before any plugin runs. The fix is a newer version of PHP on the server.

Is anyone actually using it?

Yes. A working attack exists, and Amazon's security team recorded someone trying it on 17 October, four days before it was made public. Once a hole like this is public, automated attacks usually follow within days, trying every site they can find. Small sites aren't skipped for being small.

Check your site

Check your WordPress site's PHP version in two minutes

You'll need to log in to your WordPress admin.

  1. In the WordPress admin, go to Tools, then Site Health.
  2. Open the Info tab, then the Server section.
  3. Look at PHP version. It's a number like 8.3.36.

Then find your version below.

8.2.35 or newerFixed
8.2.35 or higher on 8.2, 8.3.36 or higher on 8.3, 8.4.27 or higher on 8.4, or 8.5.12 or higher on 8.5. Your server has the fix. Nothing to do for this one.
8.2, 8.3, 8.4 or 8.5, but lowerNeeds updating
Your PHP is still looked after, so the fix exists. It just needs installing. On managed hosting your host may do it for you. On your own server it's a package update. Either way, check it's done, and don't wait.
8.1, 8.0, 7 or olderNo official fix
These versions stopped getting updates, so the PHP project hasn't released a fixed version for them. The safe answer is upgrading to a current PHP. Old themes and plugins sometimes break on newer PHP, so it's worth testing on a copy of the site first.

A lower number isn't always bad news. Some hosts and Linux distributions add the fix to an older version without changing its number. If your number looks old, ask your host one question: "Has PHP on my site been patched for CVE-2026-109618 and CVE-2026-109619?" If they can't say yes, assume it hasn't.

Can't get to the admin? Your hosting control panel usually shows the PHP version too. Or send me your site's address and I'll take a look.

If it can't be fixed today

Cloudflare has added rules that block the known attacks, for every customer, including free accounts. That helps, but it isn't a fix, because new versions of an attack can slip past. The UK's National Cyber Security Centre advises taking systems offline if they can't be fixed straight away. For most small sites, the quicker way out is getting PHP updated.

Get it fixed

Fix your WordPress site: patch or update PHP

I've worked with PHP for 18 years and WordPress for 16. Tell me your site's address and I'll say which of these it needs before you pay anything. I'm not VAT registered, so there's no VAT to add.

Patch PHP

£95 fixed

For sites on PHP 8.2 or newer.

  • I check your PHP version and how your server runs it
  • I install the fixed version, or get your host to
  • I check your site still works afterwards
  • You get a short note of what I found and did

Update PHP

£195 a session

For sites on PHP 8.1 or older.

  • Your site moved to a current, supported PHP
  • Tested on a private copy first, so your visitors see nothing break
  • Plugins and theme updated where they need it

If the upgrade turns up old code that needs rewriting, I'll tell you what and quote before doing it.

New server

Quoted

For servers too old to update.

  • For servers whose operating system no longer gets security updates
  • Your site moved to a fresh, supported server, in your name
  • Your old server stays on until you're happy
The better way

Or make this the last one you have to chase

Fixing PHP2Shell closes one hole. There'll be another. On my WordPress care plan, holes like this are my job, not yours to read about in the news.

  • Security holes that are being exploited fixed the same working day
  • Every update tested on a private copy of your site before it goes live
  • A monthly email report: what was updated, what was tested, and how your site is doing
  • On my setup, if your site is hacked while I look after it, I clean it up at no charge

From £65 a month. See the plans and prices.

Contact

Get your WordPress site fixed

Send me your site's address. I'll look at it and tell you what it needs. "Don't know" is a fine answer to anything here.

Or write to me directly at that address.

What would you like? Tick any

I'll use these details only to reply to you.

Where these facts come from