Critical PHP flaw puts WordPress sites and online shops at risk

If your website runs WordPress, WooCommerce or another PHP application, check its PHP version immediately and ask your hosting provider to confirm that the PHP2Shell fixes have been applied. Updating WordPress itself will not address these vulnerabilities because the affected software is PHP.

On 21 October 2026, the PHP project released emergency security updates addressing two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell.

According to Help Net Security, a working exploit can be triggered through a single unauthenticated web request.

That makes prompt action important even when a site appears to be operating normally.

Are WordPress and WooCommerce websites affected?

They can be, depending on the PHP version running on the server.

PHP executes much of the application logic behind WordPress and WooCommerce. It handles requests, generates content and supports many of the functions used by plugins and themes.

PHP2Shell affects several web-serving configurations:

• PHP-FPM.
• Apache with mod_php.
• php-cgi.
• FrankenPHP.
• LiteSpeed.

The mod_php configuration carries the greatest risk, according to Help Net Security's report.

The vulnerabilities are not specific to WordPress. Other content management systems and custom PHP applications may also be exposed.

A fully static website serving HTML, CSS and JavaScript files without executing PHP for visitor requests is not vulnerable through that execution path. However, any separate PHP-powered components still need checking.

Which PHP versions contain the fixes?

The emergency release includes corrected versions across four supported PHP branches.

Source: Help Net Security, 21 October 2026, updated 22 October.

Minimal source patches are available for PHP 7.4, 8.0 and 8.1, but those versions no longer receive ordinary security support from the PHP project.

Some Linux distributors and extended-support providers may supply backported fixes through their own packages.

If your hosting environment uses such packages, ask the provider to confirm that both vulnerabilities have been addressed.

A displayed PHP version number may not reveal every security patch supplied by the hosting vendor.

How to check the PHP version in WordPress

You can perform the initial check without accessing server configuration files.

From the WordPress administration dashboard:

1. Open Tools.

2. Select Site Health.

3. Choose Info.

4. Expand Server.

5. Find the installed PHP version.

These are the steps provided in WordPress.org's security advisory dated 21 October 2026.

Many hosting control panels also show the PHP version assigned to each website.

If your account contains several websites or subdomains, check each installation rather than assuming they all use the same configuration.

Record the versions before contacting support.

What should you ask your hosting provider?

If your hosting company manages the server, ask its support team to confirm three things:

1. The PHP version currently serving your website.

2. Whether fixes for CVE-2026-109618 and CVE-2026-109619 are installed.

3. When any outstanding update will be applied and which temporary protections are active.

You can also ask whether the provider has enabled web application firewall (WAF) rules addressing PHP2Shell.

Cloudflare has deployed rules targeting known attack methods for all its customers, including those using its free service, according to Help Net Security.

These rules may reduce exposure while an update is being arranged.

However, a WAF is not a replacement for patching PHP. It cannot be assumed to block every possible exploitation method.

What if your site still uses PHP 8.1 or earlier?

WordPress.org warns that PHP versions earlier than 8.2 no longer receive regular security updates from the PHP project.

If your site runs one of these older branches, arrange a move to a supported PHP version containing the security fixes.

Before changing the runtime, create a complete backup of the website files and database.

Where possible, test the upgrade in a staging environment. Older themes, plugins and custom integrations may require compatibility adjustments.

If you operate your own server and cannot remediate the vulnerabilities promptly, the UK National Cyber Security Centre (NCSC) recommends considering taking the affected system offline until it can be properly protected.

WordPress.org repeats this recommendation in its official advisory.

Leaving an exposed server online indefinitely while postponing the upgrade is not a sound maintenance plan.

What should you check after updating PHP?

A successful update should be followed by practical website testing.

If something stops working, record the affected feature and report it to the technical team responsible for the website.

A security update can reveal existing compatibility problems. That is a reason to investigate the affected component, not simply to restore a vulnerable PHP release.

Website security depends on more than the CMS

A website relies on several layers of software beyond its visible design and content management system.

PHP2Shell illustrates why maintaining an inventory of server components and their support dates matters.

Our guide to software stack versions and support schedules explains how to plan updates before dependencies become obsolete.

Businesses developing digital products should also establish procedures for handling reported vulnerabilities. Our article on the Cyber Resilience Act and vulnerability reporting covers that responsibility.

The urgency of PHP2Shell is supported by an incident reported by Amazon Threat Intelligence: an exploitation attempt was observed on 17 October 2026, before the vulnerabilities were publicly disclosed.

This confirms an early attempt, not widespread exploitation.

What should you decide this week?

Check the PHP version of every website you operate and obtain confirmation that both PHP2Shell fixes have been applied. Arrange any necessary upgrade, preserve a backup and test essential functions afterwards, particularly checkout if you run an online shop. If you need help reviewing your website's maintenance requirements or integrations, tell us which installation you need assessed so we can identify the outstanding work.