If your business website runs on WordPress, it runs on PHP. On October 21, 2026, PHP released an emergency fix for the PHP vulnerability researchers call PHP2Shell (CVE-2026-109618 and CVE-2026-109619). An attacker could take over an unpatched server with a single request, before any of your site's own code even ran. Attempts to use it were spotted days before the fix was public.
The fix is simple. The risk is assuming someone already did it.
How to fix the WordPress PHP vulnerability in five minutes
- Find out who updates your server. If you pay a hosting company for "managed WordPress", it is usually them. If a freelancer set up a server years ago, it may be nobody.
- Ask for the PHP version. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or your host's own patched build of an older one.
- Ask about PHP 7 and 8.0 or 8.1. Those no longer get official fixes. If your site is still on one, it is time to move.
- Update WordPress, your theme and your plugins while you are in there. The PHP fix closes this door, not every door.
How to check your PHP version in WordPress
Sign in to WordPress, go to Tools, then Site Health, then the Info tab, and open Server. The PHP version is listed there. If it is older than 8.4.27 or 8.3.36, or your host's own patched build, ask your host to update it today.
Not sure your site is up to date?
We will check your PHP version, your hosting and your WordPress plugins, and fix what is out of date.
Get help securing your siteWhat we did on our side
We run our own servers. On October 22, the day after the fix came out, we updated PHP everywhere we use it, retired older versions we no longer needed, and checked every site afterward. The same week, a certificate company, eMudhra, had signing keys exposed; we confirmed our sites use certificates from a different issuer and that our servers no longer trust the exposed ones.
Not running a website yourself? Here is what to do as a user.