About 70% of all websites run on PHP, and that includes every WordPress site ever made. This week researchers revealed PHP2Shell, a pair of critical flaws inside PHP itself that can hand your server to an attacker with no password and no click. The fix takes about 15 minutes, and here’s exactly how to do it.
What PHP2Shell actually is
On October 21, 2026, the PHP team shipped emergency updates for two vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Security researchers nicknamed the pair PHP2Shell, because together they let an outsider run their own code on your web server. That’s called remote code execution, and it’s the worst category of web bug there is.
Both flaws score 9.2 out of 10 on the CVSS severity scale. They’ve sat hidden in PHP’s core engine for over a decade, affecting every release going back to PHP 5.4. Your WordPress theme, your plugins, your login page: none of that matters here, because the hole sits in the layer underneath all of them. Updating WordPress or any plugin won’t close it.
Worse, one of the two flaws can leak server memory. That memory can hold passwords, API keys, and login tokens from other sites on the same box. On shared hosting, one unpatched neighbor becomes everyone’s problem.
Why AI made an old bug dangerous
Here’s the part that matters for this blog specifically. These flaws existed for years, but proving they were exploitable took a chain of steps so complex that human researchers mostly gave up. Wiz Research, working with OpenAI and Calif, pointed frontier AI models at that chain. The AI handled the tedious thousand-step reasoning humans couldn’t sustain, and out came working exploits against WordPress, Drupal, and Joomla demo sites.
Think about what that means. An AI system weaponized a bug that had sat there quietly since around 2012. And that same playbook now applies to every other old software you rely on. This is the new normal: AI on defense, finding bugs and shipping fixes, while AI on offense weaponizes everything the defenders haven’t patched yet.
I covered the defensive side of this shift in our piece on vibe coding security, where the speed of AI-built software forces everyone to patch faster.
Check your PHP version in 2 minutes
Don’t trust your memory or your host’s marketing page. Check the live number instead:
- Log in to your WordPress dashboard.
- Go to Tools, then Site Health.
- Click the Info tab and expand the Server section.
- Find the PHP version line.
Now compare it against the safe versions below. And here’s the trap: the “outdated PHP” warning in your dashboard is not enough. WordPress flags versions that are old in general, but this week’s fix is brand new. Your site can show zero warnings and still be exposed. Go by the exact number.
The versions that fix PHP2Shell
| PHP branch | First safe version |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 and older | No official fix. Upgrade now. |
If your number matches or beats the safe version for your branch, you’re done. If you’re on 8.1 or older, there’s no official patch at all. The PHP project dropped support for those branches, so upgrading is the only real move. Around 884,000 internet-facing servers still advertise an end-of-life PHP version, so this is not a rare situation.
How to update PHP on WordPress
What you do next depends on where your site lives. Pick your situation below.
Managed WordPress hosting
On hosts like WP Engine, Kinsta, or managed GoDaddy plans, the company patches PHP for you, and most applied this fix within hours. Verify anyway. Open support chat and ask one question: “Is the PHP build serving my site patched for CVE-2026-109618?” If they hesitate, escalate. Then confirm the number in Site Health, same as the section above.
Shared hosting with cPanel or Plesk
You can often pick the PHP version yourself:
- Log in to cPanel or Plesk.
- Open MultiPHP Manager (cPanel) or PHP Settings (Plesk).
- Select your domain.
- Pick PHP 8.3 or newer and apply.
Give it five minutes, then re-check Site Health. If the site breaks, which is rare, switch back one version and update your plugins first. Old plugins are usually the picky ones. And before you touch the PHP version at all, take a backup. Every decent host offers one-click backups, and a five-second-old backup beats a broken site with none.
A VPS or your own server
Update the system package. On Ubuntu or Debian, that’s sudo apt update && sudo apt upgrade. Then confirm the changelog actually mentions CVE-2026-109618, because the package version alone can fool you. On older PHP builds, the sury.org repository backported the fix to every branch from 5.6 up. After updating, restart PHP, usually systemctl restart php8.3-fpm, and reload your site.
Watch out for patch-day scams
Scammers move fast on days like this. Within a day of the patch, security teams spotted phishing emails dressed up as emergency PHP updates, asking people to “verify your control panel credentials” so the “account can be updated.” Nobody legit needs your cPanel password to patch PHP. Delete those emails on sight.
It’s the same playbook as the fake ChatGPT Mac app security alerts from earlier this year: real news, fake urgency, stolen logins. Turn on two-factor authentication while you’re in your hosting panel anyway. It costs two minutes.
Signs your site was already hit
Nobody has confirmed a mass breach yet, but exploit attempts started within hours of the leak. So how do you know if your site got hit before you patched? Look for the classics: new admin users you didn’t create, strange files with recent dates in your site’s folder, redirects sending visitors to sketchy pages, or new links stuffed into your footer. WordPress security plugins can scan for those changes automatically.
Check one more place while you’re in the dashboard: Users, then All Users. An admin account you don’t recognize is the single clearest sign of trouble. If something looks off, restore a backup from before the disclosure date and change every password, starting with hosting and database. Don’t just delete the weird admin user and move on. Attackers rarely stop at one door.
If you can’t update today
Sometimes you inherit a site you can’t touch for a few days. PHP published two settings that shrink the attack surface, though neither fully closes it: set memory_limit=-1 and disable session.upload_progress, both in your php.ini file. The UK’s NCSC went further, suggesting unpatchable systems be taken offline until they’re fixed. Governments don’t say that about ordinary bugs.
One more option: put Cloudflare’s free plan in front of the site. Their firewall rules against these exploits went live within hours of the disclosure. It’s a seatbelt, not a repair, but it buys time.
The takeaway
Check Site Health, confirm you’re on 8.2.35, 8.3.36, 8.4.27, or 8.5.12, and do it today. Exploit code for PHP2Shell leaked before the patch even dropped, and honeypots caught attack traffic the same morning. Fifteen minutes now beats rebuilding your site from backups next week.
While you’re at it, run a free AI security scan on the rest of your stack, and if you ship your own code, our pre-launch security checklist is worth 20 minutes too.
