Every WordPress site running on an unpatched PHP version is exposed to PHP2Shell, the critical PHP vulnerability fixed on 21 October 2026. Updating WordPress, your theme or your plugins will not fix it. The only real fix is a patched PHP version on your server, which usually means your host has to act or you have to update PHP yourself.

Three days after the patch, many WordPress sites are still exposed. Attackers began probing sites before the fix shipped, and patch rollouts across hosts are uneven. This guide explains what WordPress owners need to know right now and exactly what to do.

At a Glance: PHP2Shell for WordPress Owners

Why WordPress Sites Are Affected Even When Fully Updated

WordPress is written in PHP, so every page request to your site is first read and processed by PHP. PHP2Shell is a flaw in that first step. An attacker can send a crafted request that corrupts PHP's memory and gets PHP to run their commands, before WordPress itself has loaded a single line of code.

That ordering is why the usual WordPress security advice does not help here:

• Updating WordPress core, themes and plugins changes WordPress code, not the PHP engine underneath it.
• Security plugins such as Wordfence run inside WordPress. The attack lands before they start. Wordfence itself has said the fix cannot arrive through automatic updates.
• Maintenance-mode plugins do not block it either, because PHP still processes every request before WordPress shows the maintenance page.
• Login protection, two-factor authentication and strong passwords do not matter. The attack needs no account.

Researchers demonstrated remote code execution against WordPress and 10 other PHP applications. A separate researcher confirmed a working attack against the official WordPress Docker image in a lab. Even a bare "Hello World" PHP page on a vulnerable version can be targeted.

Which server setups are in scope

Every common way of running PHP for WordPress is affected while the PHP version is unpatched:

• PHP-FPM with Nginx or Apache
• Apache with mod_php, considered the worst case because one request can trigger the attack before any application code runs
• LiteSpeed and OpenLiteSpeed (lsphp)
• php-cgi and FrankenPHP
• Docker images built on an unpatched PHP base

What an attacker could do to a WordPress site

Code runs with the permissions of the PHP process, which on most WordPress servers can read and write your site files. It can also read wp-config.php, which holds your database password. In practice that means an attacker could:

• Plant a backdoor or web shell in your uploads or theme folder
• Create hidden administrator accounts
• Steal customer, order or member data from the database
• Inject spam links or malicious redirects
• Deface pages

Is My WordPress Site Vulnerable? How to Check

Your site is vulnerable if the PHP version actually serving its pages is older than the fixed releases and has not been patched by your host or Linux distribution. Check the version first, then confirm the patch.

Step 1: Find your PHP version

• WordPress dashboard: go to Tools → Site Health → Info → Server. This shows the PHP version the website really uses.
• cPanel: open MultiPHP Manager.
• Command line: run php -v or wp --info. Be careful: the command-line PHP can be a different build from the one serving your site.

Step 2: Compare it with the fixed versions

Step 3: Do not panic over an "old" version number

Some Linux distributions, including Ubuntu, Debian and Red Hat, backport security fixes without changing the version number. A patched Ubuntu 24.04 server can still report PHP 8.3.6. If your host uses distribution packages, ask them, or check the package changelog for CVE-2026-109618 and CVE-2026-109619, rather than relying on the number alone.

The reverse is also true: a host saying "we updated" is not enough if PHP was never restarted. Old PHP workers keep running the vulnerable code from memory until they restart.

How many WordPress sites are exposed?

The numbers are large. Monitoring service mySites.guru found that by 13:52 UTC on release day, only 0.08% of the live sites it tracks reported a fixed PHP version. The day before release, 22.7% of monitored WordPress and Joomla sites ran PHP 8.1 or older, and 16.6% ran PHP 7 or earlier. Across the wider web, Censys reportedly counted around 1.5 million internet-facing servers on PHP versions older than the fixes.

What WordPress Site Owners Should Do Now

Who fixes PHP2Shell depends on how your WordPress site is hosted. Find your setup below.

On managed or shared hosting

Most reputable hosts are patching for you, but rollouts vary. For example, DreamHost reported that security updates were applied to most of its network while it finished the remaining servers, and one customer reported their WordPress site already on PHP 8.3.36. cPanel's EasyApache 4 had fixed builds within minutes of the release, and CloudLinux says it is patching every PHP version it ships. Some shared hosts were still waiting on CloudLinux builds on release day.

What to do:

1. Check your host's status page or support announcements for a PHP2Shell notice.
2. If nothing is posted, open a support ticket. Ask when your server's PHP was patched and whether PHP has been restarted.
3. Confirm the result yourself in Tools → Site Health → Info → Server.
4. If your host offers several PHP versions, move to a supported, patched one such as PHP 8.3.36 or 8.4.27. Test your site afterwards.

On a VPS or your own server

You are responsible for the fix. On Ubuntu or Debian, upgrade the PHP packages for your version, for example apt install --only-upgrade 'php8.3*'. Then restart PHP-FPM with systemctl restart php8.3-fpm, or restart Apache if you use mod_php.

A few practical notes from release week:

• Ubuntu's unattended upgrades only pull from Ubuntu's own repository, so they will not update PHP installed from a third-party source.
• If the Launchpad PPA for Ondřej Surý's PHP packages returns errors, the same packages are available at packages.sury.org.
• LiteSpeed and OpenLiteSpeed sites use lsphp packages from LiteSpeed's own repository.
• Restart every long-running PHP process, including queue workers. Old processes keep the vulnerable code in memory.

On Docker

Pull the rebuilt image and redeploy, for example with docker compose pull followed by docker compose up -d. Restarting your existing containers does nothing, because they still run the old image.

Do not forget your other WordPress sites

Staging copies, old campaign microsites, test installs and client sites on forgotten servers are easy to miss. Attackers scan the whole internet, not just your main site. Make a list of every WordPress install you are responsible for and check each one.

If You Cannot Patch Yet: Stopgaps for WordPress

None of these is a complete fix, and PHP itself says there are no complete mitigations. They reduce risk for a few hours or days while you wait for a patched PHP.

How to apply the session setting

The setting must go in php.ini or your PHP-FPM pool configuration, not in .htaccess or a WordPress plugin. Restart all PHP workers afterwards, or it will not take effect. On PHP 8.5, setting fatal_error_backtraces = 0 closes one more confirmed path.

Avoid this "fix"

Removing PHP's memory limit with memory_limit = -1 has been suggested as a workaround for CVE-2026-109618. On a typical WordPress server it is risky: a single heavy request could then eat all the server's memory and take the site down. Only consider it with strict request-size limits in front, and treat it as temporary.

Going offline is a legitimate choice

Taking a site down until PHP is patched is what national security agencies, including the NSA and the UK's NCSC, recommended for systems that cannot be patched right away. One WordPress owner blocked public access through .htaccess until the fix arrived. A static "we'll be back shortly" page served by your web server, not by WordPress, keeps visitors informed while PHP stays out of reach.

How to Check Whether Your WordPress Site Was Compromised

Patching PHP stops new attacks but does not remove anything an attacker already planted. Amazon recorded an attack attempt on 17 October, four days before the fix, so review your site for activity from that date onward.

Quick checks with WP-CLI

• Look for unknown administrators: wp user list --role=administrator. Any admin you don't recognise is a red flag.
• Verify WordPress core files: wp core verify-checksums reports any core file that has been changed.
• Verify plugin files: wp plugin verify-checksums --all does the same for plugins from WordPress.org.
• Find PHP files in uploads: find wp-content/uploads -name "*.php". The uploads folder should hold images and documents, so PHP files there often mean a web shell.

What else to review

• Recently changed files in your active theme folder
• Scheduled tasks (WP-Cron events and server cron jobs) you did not create
• Unexpected outbound connections from the server
• New or changed redirects, and spam links in posts or the footer

Warning signs in your server logs

Look for unusual multipart/form-data requests followed by PHP memory-limit errors or bursts of HTTP 500 responses. Also remember that a successful attack can return a normal 200 OK response, so a clean-looking access log is not proof that nothing happened.

If you find signs of a break-in

1. Take the site offline or put it behind a static page.
2. Restore a clean backup from before 17 October, if you have one.
3. Make sure PHP is patched and restarted before bringing the site back.
4. Change every password: WordPress admins, database, hosting panel, SFTP and SSH.
5. Regenerate the security keys and salts in wp-config.php.
6. Rotate any API keys stored on the site, such as payment, email or CDN keys.
7. If the site handles customer data, check your legal obligations around data breaches.

Old PHP Versions and WordPress: Time to Upgrade

If your WordPress site runs PHP 8.1 or older, PHP2Shell is the push to upgrade. The PHP project is not releasing fixes for PHP 8.1, 8.0 or 7.4, because those versions are past end of life.

There are partial escape routes. PHP published minimal source backports for 7.4, 8.0 and 8.1, but they are aimed at people who compile PHP themselves. cPanel reportedly backported fixes into its own 7.4 to 8.1 packages, and some other package maintainers have done the same. Ask your host whether your exact build includes the fix. Don't assume it does.

The longer-term problem remains: an unsupported PHP version will not get the next fix either.

Which PHP version should WordPress use?

WordPress recommends PHP 8.3, although it still lists PHP 7.4 as compatible. For most sites, the patched PHP 8.3.36 or 8.4.27 is the sensible target. PHP 8.2 is patched too, but its security support ends on 31 December 2026, so moving to 8.2 now means upgrading again in two months.

How to upgrade PHP without breaking your site

1. Take a full backup of files and database.
2. Update WordPress core, your theme and all plugins first. Older plugins are the usual reason a site breaks on newer PHP.
3. Test on a staging copy if your host offers one. Switch the staging site to the new PHP version and click through key pages, forms and checkout.
4. Replace abandoned plugins. If a plugin has not been updated in years and fails on PHP 8.3, find an alternative rather than staying on old PHP.
5. Switch the live site and check Site Health and your error log.
6. Keep the old version available briefly in your panel in case you need to roll back, but don't leave the site on it.

If an old plugin keeps you on PHP 7.4 or 8.1, the plugin is now a security liability, not just a compatibility issue.

WordPress PHP Vulnerability FAQ

Sources

• xCloud: PHP2Shell and WordPress emergency checklist
• Martin Cid Magazine: PHP2Shell patch for WordPress sites and hosts
• TidBITS: PHP2Shell vulnerabilities put 70% of websites at risk
• PHP security announcements, 2026 archive
• PHP supported versions
• CISA Known Exploited Vulnerabilities Catalog