PHP2Shell: Is Your WordPress Site Vulnerable? How to Check and Patch It Today

I run this blog on WordPress. So when CISA put out an alert saying every PHP site needs patching right now, I didn’t skim it.

You shouldn’t either.

On October 21, CISA urged everyone to immediately patch two critical PHP bugs, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell.

They let an attacker run code on a server without logging in. No password, no account, nothing.

And PHP runs roughly 70% of websites, including WordPress.

Here’s what it means for regular site owners like you and me, and exactly how to check your own site.

What PHP2Shell actually is

PHP is the language underneath WordPress. Your theme, your plugins and WordPress itself all run on it.

PHP2Shell isn’t a plugin bug. It’s a flaw in PHP itself.

According to Google Cloud’s breakdown, both bugs are about how PHP handles memory when a request goes wrong, for example when it runs out of memory halfway through.

Both are rated 9.2 out of 10 for severity.

Every PHP version from 5.4 through 8.5.11 is affected.

The researchers behind it say even a plain “Hello World” page on a vulnerable PHP version can be hit. Your code being clean doesn’t save you.

AI found it. That’s the scary part

This one was found by Wiz Research, OpenAI’s Codex Security team and a firm called Calif, per the official PHP2Shell site.

Wiz says it used frontier AI models during discovery, exploit building and patch testing, with Google’s Gemini doing a lot of the heavy lifting.

I’ve written about AI agents going off script before. This is the flip side. AI is now good enough to find holes in software that runs most of the web.

And attackers have the same tools.

Amazon says in its security blog that someone tried the exploit against its honeypot on October 17, four days before the public disclosure. It now says PHP2Shell is being broadly exploited in the wild.

Amazon also says AI makes it cheaper to turn a patch into a working exploit, so the gap between “fix released” and “attacks start” is now hours, not weeks.

My take? The old habit of “I’ll update this weekend” is dead for bugs like this.

Why updating WordPress won’t fix it

This is the part most people will get wrong.

Updating WordPress, your theme or your plugins does nothing here. The bug lives in the PHP runtime on the server.

The PHP2Shell researchers say it plainly: updating an application doesn’t update the PHP underneath it.

So the fix has to happen at the server level. For most of us, that means our hosting company.

How to check if your site is vulnerable

Here’s what I’d do, in this order.

Step 1: Find your PHP version. In your WordPress dashboard go to Tools > Site Health > Info, then open the Server section. Your PHP version is listed there.

Step 2: Compare it to the fixed versions. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to CISA. Anything older on those branches is vulnerable.

Step 3: If you’re on PHP 8.1 or older, take it seriously. The PHP project isn’t releasing fixes for 8.1 and earlier because they’re end of life, Google Cloud notes. CISA says systems on those versions should go offline until they’re patched or upgraded.

Step 4: Check your host’s status page. Here’s the catch. Some hosts patch older versions themselves with backported fixes, so the version number in WordPress might not tell the full story. Your host’s statement is the real answer.

Step 5: Upgrade PHP in your hosting panel if you can. Most hosts let you switch PHP versions with a dropdown. Back up first, then move to a supported version like 8.3 or 8.4 and click through your site to make sure nothing broke.

What the big hosts are saying

Good news for most of us on shared or managed hosting: the hosts are handling it.

My site is on Hostinger. Hostinger says PHP’s fix is now installed on all of its hosting servers except VPS, and it blocked the circulating exploit with firewall rules. No action needed on regular plans.

WP Engine says it finished deploying the patches and customers don’t need to do anything.

Cloudflare says its WAF has blocked PHP2Shell attacks by default since early October 21, even on the free plan.

But here’s my warning.

If you run your own VPS or cloud server, nobody is patching it for you. Hostinger says exactly that about its VPS plans. You need to update PHP yourself and restart PHP-FPM or Apache.

If you’re not sure what kind of hosting you have, my cloud computing explainer covers the basics.

A firewall helps, but it isn’t the fix

Cloudflare itself says customers should still patch PHP even with its protection on.

CISA agrees. A web application firewall “may provide some protection,” but patching is the actual fix.

Think of a firewall as a lock on the front door while the wall behind it is still cracked.

Signs someone may have tried it

Honestly, this is hard to spot.

The PHP2Shell researchers list a few warning signs: unusually large or weird PHPSESSID cookies, odd upload requests followed by memory-limit errors or repeated HTTP 500 errors, and PHP workers crashing or restarting for no reason.

CISA also says to watch for PHP processes launching shells or downloading tools.

If you’re on shared hosting, you won’t see most of this. Ask your host directly if anything looked off on your account.

And if your site handles logins or payments, change your admin passwords and API keys once you know you’re patched. The researchers say leaked server memory can include passwords, tokens and keys.

It’s the same lesson I keep coming back to with giving AI tools deep access to your machine: assume the boring security step matters, because it usually does.

My honest take

Most WordPress bloggers on managed hosting are probably fine already.

But “probably fine” isn’t a plan. It takes two minutes to check your PHP version and your host’s status page.

Do it today. Then go back to writing.

FAQ

What is PHP2Shell?

PHP2Shell is the name for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code on a server without logging in.

Is my WordPress site affected by PHP2Shell?

If your server runs PHP 5.4 through 8.5.11 and hasn’t been patched by your host, yes. Check Tools > Site Health > Info > Server, then check your host’s status page.

Will updating WordPress or my plugins fix it?

No. The bug is in the PHP runtime on the server, not in WordPress. You or your host has to update PHP.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. There’s no official fix for PHP 8.1 or older.

Is PHP2Shell being exploited right now?

Yes. Amazon says it’s being broadly exploited in the wild and saw an attempt as early as October 17, 2026.

Do I need to do anything on Hostinger or WP Engine?

Both say regular hosting customers don’t need to act. Hostinger VPS users have to update PHP themselves.

Sources: CISA, PHP2Shell research site, Google Cloud, AWS Security Blog, Cloudflare, Hostinger, WP Engine