On October 20, 2026, details leaked about two critical vulnerabilities in PHP itself. They are tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 in severity, and both allow remote code execution. Researchers are calling the exploit chain PHP2Shell.
This one is different from the usual plugin vulnerability scare. The flaw is not in a plugin or a theme. It is in PHP, the programming language that powers WordPress itself. That means nearly every WordPress site on the internet is potentially affected, and the fix has to happen at the server level. Updating your plugins will not protect you.
Here is the full picture: what happened, whether your site is at risk, and the exact steps to take today.
What is PHP2Shell?
PHP2Shell is the name researchers gave to an exploit chain built on two critical flaws in PHP core. The PHP security team confirmed both vulnerabilities and rated each one CVSS 9.2, which is firmly in “critical” territory.
Remote code execution is about as bad as it gets. In plain terms, it means an attacker could run their own code on your server without needing a username or password. From there, they could deface your site, steal data, install malware, or use your server to attack others.
Early reports from security researchers say the flaw affects PHP versions going back to 5.4. PHP has not officially confirmed the full list of affected versions yet. What is confirmed is that the patched releases will only cover PHP 8.2, 8.3, 8.4, and 8.5, the versions PHP still supports.
The timeline so far
- October 20, 2026: Details of the vulnerabilities leaked on Hacker News and social media, two days before a planned coordinated disclosure. A screenshot of an exploit tool called PHP2Shell circulated, claiming to work against PHP releases from 5.4.0 onward.
- October 20, 2026 (evening): The PHP security team published an advance notice of an emergency security release, scheduled for October 21 at 14:00 UTC (9:00 AM Central).
- October 21, 2026 (early morning): Cloudflare reported early attack attempts against PHP sites. Security firm Sansec warned that mass attacks could begin within minutes of the patch release, as attackers race to hit servers that have not updated yet.
The patch releases today. The most dangerous window is right after the details go fully public, when automated attacks start scanning for servers that are still unpatched.
Am I affected?
If your site runs on WordPress, the honest answer is: assume yes until your host confirms otherwise. WordPress runs on PHP, and the vulnerability is in PHP itself. It does not matter which plugins or theme you use. It does not matter if your WordPress core is fully updated.
There are two things that determine your actual risk:
- Your PHP version. If you are on PHP 8.2 or newer, your host can apply the official patch. If you are on PHP 8.1 or older, there is no official patch coming for your version.
- Your hosting provider. Managed hosts apply server-level patches for you. If you manage your own server, the update is on you.
What to do right now
Do these in order. None of them require you to be a developer.
Step 1: Back up your site
Before touching anything, make a complete backup: files and database. Store it somewhere other than your current host. If anything goes wrong during the next steps, a backup is the difference between a quick restore and a very bad day. If you do not have a backup plugin yet, install one and run a full backup now.
Step 2: Check your PHP version
You can see your PHP version right inside WordPress. Go to Tools, then Site Health, then the Info tab, then Server. Look for the PHP version line.
- PHP 8.2 or newer: Good. Your version will get the official patch.
- PHP 8.1 or older: Your version will not get an official patch. You need to plan an upgrade to a supported PHP version, which brings us to the next step.
Step 3: Contact your hosting provider or update PHP
This is the actual fix, and it happens at the server level.
If you are on managed hosting (SiteGround, Bluehost, Cloudways, and similar), your host handles PHP updates on their servers. Contact their support today and ask two questions: have they applied the PHP security patch for CVE-2026-109618 and CVE-2026-109619, and is your site running a patched PHP version? SiteGround, for example, announced they moved early and protected their servers before the release.
If you manage your own server or VPS, update PHP to the patched release as soon as it drops today at 9:00 AM Central. Check php.net for the official advisory and the exact fixed version numbers for your PHP branch.
If you can change your PHP version from your hosting panel, this is also the moment to move off an old PHP version. In cPanel, look for MultiPHP Manager or Select PHP Version under the Software section. In SiteGround’s Site Tools, it is under Devs, then PHP Manager. Pick a supported version (8.2 or newer), but test your site afterward, because very old plugins or themes can break on newer PHP.
Step 4: If you are on PHP 8.1 or older, upgrade
This vulnerability is a strong reason to finally leave old PHP behind. PHP 8.1 and earlier will not receive the official fix. Upgrading PHP is usually a one-click change in your hosting panel, but do it carefully: back up first, switch the version, then click through your site and test key pages, forms, and checkout if you run a store. If something breaks, your host’s support can help you sort out which plugin or theme is incompatible.
What NOT to do
- Do not panic-install a “PHP2Shell fix” plugin. There is no plugin that can fix a vulnerability in PHP itself. Any plugin claiming to do so is either useless or malicious.
- Do not ignore this because your WordPress is updated. WordPress core updates do not patch PHP. This is a server-level problem.
- Do not assume your host handled it. Most good hosts will, but a two-minute chat with support to confirm costs nothing.
FAQ
Do I need to update WordPress itself?
Not for this specific issue. Keep WordPress updated as always, but the PHP2Shell fix is a PHP update applied by your host, not a WordPress update.
Will updating PHP break my site?
It can, if you jump several versions at once or run very old plugins. That is why you back up first and test afterward. Moving from 8.1 to 8.2 is usually smooth. Moving from 7.4 to 8.3 deserves more caution.
I am on shared hosting. Is there anything I can actually do?
Yes. Contact your host and confirm they patched. Check your PHP version in Site Health. If you are on an old PHP version and your panel lets you switch, upgrade. And keep backups current.
How will I know when the patch is out?
The PHP security release is scheduled for October 21 at 14:00 UTC (9:00 AM Central). After that, check php.net for the advisory, or just ask your host whether the patched PHP build is live on your server.
Bottom line
PHP2Shell is a rare, genuinely critical event: a remote code execution flaw in the language WordPress is built on. The fix is simple in concept but it is not in your WordPress dashboard. Back up your site, find out your PHP version, and make sure your host applies the patch today. If you are still on PHP 8.1 or older, treat this as your deadline to upgrade.
