Security alert: PHP2Shell
Your WordPress site is at risk.
A critical flaw in PHP, the software every WordPress site runs on, lets attackers take over a server without logging in. If your server's PHP wasn't updated on or after 21 October 2026, your site is exposed.
We'll check it, patch it and lock it down, so you can get back to business.
What is PHP2Shell?
PHP2Shell is the name researchers gave to two flaws in PHP made public on 21 October 2026. Here's what it means for a WordPress site:
- A critical flaw in PHP itselfTwo bugs in the PHP engine (CVE-2026-109618 and CVE-2026-109619), both rated 9.2 out of 10.
- No password neededAn attacker can run their own code on your server without logging in.
- Older PHP gets no official fixServers still on PHP 8.1, 8.0 or 7.x get no official patch.
- Attacks are being reportedResearchers have reported attempts to exploit it in the wild.
Is your site affected?
It comes down to the PHP version on your server. These are the releases that fix it:
| Your PHP | Fixed in | What to do |
|---|---|---|
| PHP 8.5 | 8.5.12 | Update to 8.5.12 or later |
| PHP 8.4 | 8.4.27 | Update to 8.4.27 or later |
| PHP 8.3 | 8.3.36 | Update to 8.3.36 or later |
| PHP 8.2 | 8.2.35 | Update to 8.2.35 or later |
| PHP 8.1 and older | No official fix | Upgrade to a supported version |
Not sure which PHP your server runs? Most site owners aren't, and that's fine. Send us your site and we'll find out.
How we secure your site
One job, start to finish. You don't need to know what a PHP version is.
- CheckWe see which PHP your server really runs, what your host has done, and what's out of date.
- PatchWe update PHP to a fixed release, with a full backup first and minimal downtime.
- HardenWordPress, plugins and theme updated, unused ones removed, backups and a firewall on.
- ReportA plain-English summary of what we found and fixed.
Or leave WordPress behind
A site built with Astro has no PHP and no database on the server, so flaws like PHP2Shell have nothing to reach. It's faster too. Read about moving your site to Astro.
Get your site secured
Tell us where your site is and how to reach you. We'll check it and come back to you shortly.
Sources
- PHP2Shell: Critical PHP vulnerabilities patched, update now!Help Net Security - The fixed PHP releases and what to do if you can't update straight away.
- PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619)Sansec - Which servers are affected, and why older PHP versions get no official fix.
- PHP RCE FAQ: PHP2Shell CVE-2026-109618 & CVE-2026-109619watchTowr - Answers to common questions, including what attackers have been seen doing.
- PHP2Shell: CVE-2026-109618 & CVE-2026-109619SOCRadar - A summary of both flaws, their severity and the patches.