PHP2Shell and WordPress: is your site affected, and what to do

Does PHP2Shell affect WordPress?

Yes — but not because of anything in WordPress. PHP2Shell lives in PHP itself, the language WordPress runs on. A WordPress site with every plugin updated is still exposed if the PHP serving it is unpatched. WordPress security plugins can’t fix it either.

Patchstack, a WordPress security company, has received exploitation reports from hosting partners, so this is not theoretical for WordPress sites.

1. Check your PHP version

In your WordPress dashboard go to Tools → Site Health → Info, open Server, and read PHP version. Because WordPress reports the PHP it’s actually running on, this is a reliable web-side check.

Paste the number into our version checker. If it says vulnerable:

• Managed WordPress or shared hosting — your host has to patch. Go to ask your host.
• Your own VPS or server — patch PHP yourself with the guide for your setup: Ubuntu & Debian, RHEL family, cPanel & WHM, Docker.

Hosting on a Linux distribution’s PHP packages? A backported fix may not change the version number — ask your host or check the package changelog.

Ask your host

Copy, paste and send this to your hosting support:

Subject: PHP2Shell (CVE-2026-109618 / CVE-2026-109619) — patch status for my site

Hi,

My site <your-domain> currently runs PHP <version from Site Health>.

Can you confirm that the PHP version serving my site has been patched for
CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), and that PHP was restarted
after the update? Please tell me the exact version or package release.

If my current PHP version can't be patched, which patched version can I
switch my site to?

Thanks!

Many hosts can also move your site to a newer PHP version in the control panel (Select PHP Version or MultiPHP Manager). Pick 8.3 or newer, then check your site still works.

2. Check for signs of compromise

Attacks were seen from 17 October 2026, before the fix was public. After PHP is patched:

• Users → All Users → Administrator: remove any admin you don’t recognise.
• Plugins: delete anything you didn’t install.
• Stray PHP in uploads: WordPress uploads should be images and documents, never .php files.

With WP-CLI (or SSH) you can do this faster:

wp user list --role=administrator
wp core verify-checksums
wp plugin verify-checksums --all
find wp-content/uploads -name '*.php'

verify-checksums compares core and plugin files with the official copies and lists anything modified. Our compromise checklist covers server-side checks too.

3. Rotate secrets

PHP2Shell can leak data from PHP’s memory, so rotate what WordPress keeps there:

• Regenerate salts — this logs everyone out and invalidates stolen cookies:

  wp config shuffle-salts

  Without WP-CLI, paste fresh values from the WordPress.org key generator into wp-config.php.

• Change admin passwords and any API keys stored in plugin settings (payment gateways, SMTP, backups).

• Change the database password if you find any sign of compromise, then update DB_PASSWORD in wp-config.php.

Not comfortable doing this?

We’ll patch the server and run the checks for you, or book a 30-minute call and we’ll tell you exactly what to ask your host.