Moatline

PHP2Shell: what WordPress site owners should do now

Two critical flaws in PHP itself, the language WordPress runs on, were leaked before their fix was ready. Every WordPress site is affected until its PHP version is updated, and WordPress updates won’t do it for you. Here is what to check and who to ask.

By the Moatline team at Next Nova Technologies · Published 21 October 2026 · 3 min read

Not sure your site is still clean?See what your visitors and Google see right now. Free, no sign-up, about 20 seconds.
Check my site free

Short answer

  • Affected: every site on an unpatched PHP version, whatever plugins it uses.
  • Do now: check your PHP version in Tools → Site Health → Info → Server, and ask your host when it will be patched.
  • On PHP 8.1 or older? No fix is coming. Move to 8.2 or newer.

This one is different from the plugin attacks we usually cover. It doesn’t matter which plugins or theme you use: what matters is the PHP version your server runs.

What happened

  • The flaws: CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Both are rated 9.2 out of 10 and let an attacker run their own code on the server.
  • Why it’s urgent: details leaked before PHP’s fix was ready. PHP scheduled emergency releases for 21 October 2026 at 14:00 UTC.
  • Attacks: Cloudflare reported early attacks, and Patchstack reported confirmed cases on 21 October. Other researchers had not yet seen attacks at that point. Either way, expect automated attacks to grow quickly, as they did after the wp2shell leak.

Is my site affected?

Reports say PHP 5 through PHP 8 are affected, so assume your site is until your PHP version is patched. Fixed versions reported before the release:

  • PHP 8.5: 8.5.12 or later
  • PHP 8.4: 8.4.27 or later
  • PHP 8.3: 8.3.36 or later
  • PHP 8.2: 8.2.35 or later
  • PHP 8.1 and older: no longer supported, so no fix is expected. Upgrade to a supported version.

Linux distributions and some hosts add fixes to older version numbers (“backports”), so a host may be patched without these exact numbers. Ask them to confirm.

Find your PHP version

  1. In wp-admin go to Tools → Site Health → Info.
  2. Open the Server section and read PHP version.

With SSH: php -v. Note that the command line can use a different PHP version from your website, so Site Health is the one to trust.

Get it fixed

  • Shared or managed hosting: contact your host and ask “When will PHP be updated for CVE-2026-109618 and CVE-2026-109619?” Most hosts patch PHP for you, but some only patch the newest versions.
  • cPanel hosting: if you’re on 8.1 or older, use MultiPHP Manager or Select PHP Version to switch to 8.2 or newer.
  • Your own server or VPS: install the updated PHP packages from your distribution or the PHP repository you use, then restart PHP-FPM or your web server.
  • Agencies: list every client site with its host and PHP version. Sites on old PHP versions are the ones to move first.

Until it is patched

  • If your site uses Cloudflare, Cloudflare added emergency firewall rules for known attacks on all plans, including free. Cloudflare calls them a stopgap.
  • Many hosts are disabling session.upload_progress as a temporary measure. It helps, but isn’t a fix.
  • Back up your files and database now, so you have a clean copy to compare against later.

After patching: check nothing got in

Patching stops new attacks, but it doesn’t remove anything planted before. Once your PHP version is fixed:

  1. Look for PHP files in wp-content/uploads. WordPress never puts code there.
  2. Check wp-content/mu-plugins and the main folders for files you don’t recognise.
  3. Check for admins you didn’t create, including hidden ones.
  4. Run a full scan. The free Moatline Malware Scanner checks files, mu-plugins, uploads and the database. See how to scan WordPress for malware.

Sources: Patchstack, Tenable’s FAQ and The Repository. We’ll update this page once PHP publishes the official fixed versions.

Other plugins are being attacked right now too. See the live list of WordPress plugins under active attack.

Don’t want to do this yourself? Our team cleans hacked WordPress sites every week: WordPress malware removal service, from $45, usually done within 24 hours.

Frequently asked questions

Will WordPress update itself to fix this?
No. WordPress automatic updates change WordPress, plugins and themes. PHP is part of your server, so your host (or whoever runs your server) has to update it.
Does a security plugin protect me?
Not reliably. The flaw is in PHP itself, which runs before WordPress and its plugins load. A firewall in front of the site, such as Cloudflare’s, can block known attacks. The real fix is a patched PHP version.
My host says it disabled session.upload_progress. Am I safe?
It may block some attacks, but a PHP release manager has said settings changes won’t fully protect you. Treat it as a stopgap and still ask when PHP will be updated.
I’m on PHP 7.4 or 8.0. What should I do?
Those versions no longer get security fixes, so no patch is coming for them. Move to a supported version (8.2 or newer). Test the site afterwards: most current plugins work fine on PHP 8.2 and 8.3.

Scan your site for free

Moatline checks files, the database and page-builder content. Nothing changes unless you click a button.

Get it free on WordPress.org

More guides

All guides →