Skip to main content
Entidex

PHP2Shell · CVE-2026-109618 · CVE-2026-109619

Is my WordPress site affected by PHP2Shell?

Updated 23 October 2026 · By Dean, founder of Entidex Ltd

Not sure if your site is exposed? Three questions, two minutes.

Run the free check

A WordPress site is affected by PHP2Shell if its server has not had the 21 October 2026 PHP update, because CVE-2026-109618 and CVE-2026-109619 are flaws in PHP itself, not in WordPress. Updating WordPress will not fix PHP2Shell, so check your PHP version in Site Health and confirm your host has patched.

Is my WordPress site affected by PHP2Shell?

WordPress sites are exposed to PHP2Shell if the server has not had the 21 October 2026 PHP update. Researchers demonstrated PHP2Shell attacks on WordPress, Drupal and Joomla that work without logging in.

The PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619, are in PHP itself. WordPress runs on top of PHP, so the PHP2Shell fix happens on the server, outside your WordPress dashboard.

Why doesn't updating WordPress fix PHP2Shell?

The WordPress dashboard can update WordPress core, themes and plugins, but the WordPress dashboard cannot update the PHP software on the server. Updating PHP is the job of your host or whoever manages your server.

Keep WordPress and plugins updated anyway. A green "everything is up to date" screen in WordPress does not mean the site is protected from PHP2Shell.

Is PHP2Shell the same as wp2shell?

wp2shell was a different flaw, from July 2026, that affected WordPress core itself, and WordPress released updates for wp2shell. PHP2Shell is a separate issue in PHP. A site patched for wp2shell still needs its PHP checked for PHP2Shell.

How do I check my PHP version in WordPress?

The WordPress PHP version is listed in Site Health, and finding the PHP version takes five steps:

  1. Log in to WordPress as an administrator.
  2. Go to Tools > Site Health.
  3. Click the Info tab.
  4. Open the Server section.
  5. Find PHP version.

Compare the PHP version with the PHP2Shell fixed versions (PHP project, 21 October 2026):

  • PHP 8.5.12 or later
  • PHP 8.4.27 or later
  • PHP 8.3.36 or later
  • PHP 8.2.35 or later

A WordPress site showing PHP 8.1, 8.0 or 7.4 is on an end-of-life version. See our guide to PHP 7.4 and 8.1 end-of-life options.

Why the PHP version number may not tell the whole story

Hosts running Linux distributions such as Ubuntu, Debian or Red Hat often receive security fixes without a change to the headline PHP version. A site showing PHP 8.3.6 could be patched against PHP2Shell, or could be exposed. Your host can confirm from the package changelog. More detail in which PHP versions are safe.

What should I do about PHP2Shell for my type of WordPress hosting?

The right PHP2Shell next step for a WordPress site depends on who manages the server: a managed host, a shared cPanel host, you, or an agency.

Managed WordPress hosting

Many managed hosts, including GoDaddy managed WordPress, patched their customers for PHP2Shell automatically. Email your host and ask for written confirmation. Use our copy-paste email.

Shared cPanel hosting

Shared cPanel hosting usually leaves PHP management to the host. To change the PHP version in cPanel, open MultiPHP Manager (or Select PHP Version on CloudLinux hosts), pick your domain and choose a supported version, ideally 8.3 or later. Back up first, then ask the host to confirm the PHP2Shell patch, because changing the version does not prove the build is patched.

Your own VPS or server

A VPS or server you run yourself is your responsibility, or your developer's. Update PHP packages now, restart PHP-FPM or your web server, and check for signs of compromise. Our free read-only PHP2Shell Check script can confirm the result.

An agency built it and you are not sure who maintains it

An agency-built WordPress site with no clear maintainer is one of the highest-risk PHP2Shell situations. Find out who has the server login. Ask the agency directly whether the server is patched. If nobody knows, get help today.

How can I tell if my WordPress site was compromised through PHP2Shell?

PHP2Shell exploit code appeared in public before the fix. After patching, look for:

  • PHP files inside wp-content/uploads (there should normally be none)
  • unfamiliar files with random names in the site folders
  • WordPress core files in wp-admin or wp-includes changed in the last few days
  • new administrator accounts you did not create

If you find any of these signs, treat the WordPress site as compromised and get help.

How can Entidex Ltd help WordPress owners with PHP2Shell?

Entidex Ltd offers three PHP2Shell services for WordPress owners:

  • Free 3-question self-check: entidex.com/php2shell#check
  • Patch Check, £49 per server: run one command on the server, get the verdict within a minute and a signed, dated result once payment has cleared, with a link your insurer or client can verify.
  • Emergency Fix, £149 or £299 per server: checks for compromise first, updates and restarts PHP once you approve, then confirms your sites still load. £299 on PHP 8.1 or older. Limited slots each day. See prices.

We only work on sites you own or are authorised to manage.

What else do WordPress owners ask about PHP2Shell?

My WordPress dashboard says everything is up to date. Am I safe?

Not necessarily. The WordPress dashboard covers WordPress, themes and plugins. PHP is updated on the server, so PHP2Shell needs a server-side fix.

Will a security plugin protect me?

A WordPress security plugin runs inside WordPress, which runs on PHP. PHP says updating PHP is the only complete fix for PHP2Shell.

Can I change the PHP version myself?

On many cPanel and managed plans, yes, you can change the PHP version yourself. Back up first, as older plugins may not work on newer PHP.

Not sure where you stand? Take the free self-check: entidex.com/php2shell#check

Where does this PHP2Shell information come from?