Menu
How it worksPricingFor agenciesAI assistantsCompareSecurityFAQ Sign in Join the waitlist

PHP2Shell explained in plain English

Short version: PHP is the engine that runs WordPress®. On 21 October 2026, the PHP project fixed two serious flaws in that engine, nicknamed PHP2Shell. A stranger could send one web request and run their own code on the server, before WordPress or any plugin even loaded. Updating WordPress did not fix it. Your web host had to update PHP.

What happened, and when

Date (2026)What happened
17 OctoberAmazon logged an attack attempt on its decoy servers, four days before any fix existed (Tenable)
20 OctoberThe bug numbers leaked online, and PHP moved the release up a day
21 OctoberPHP released fixed versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 and told everyone to "update now" (php.net)
21–22 OctoberCloudflare reported attempts rising from tens of thousands to millions (The Hacker News)
23 OctoberPHP announced a third, unrelated flaw (CVE-2026-115560) that has no fix yet. It needs an unusual setup and has a one-line workaround (php.net)

The two flaws are CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity. PHP's own advice was blunt: there are "no complete mitigations, updating is the only safe choice."

Why updating WordPress wasn't enough

Most WordPress advice says "keep WordPress and your plugins up to date." That is still good advice, but it did not help here. The flaw is in PHP itself, one layer below WordPress. On most hosting, the host decides which PHP version runs and when it gets updated, not the site owner.

Researchers confirmed the attack worked against WordPress with no login at all (Tenable). So a site with every update applied was still open until its host updated PHP.

Who is still exposed

  • Sites on old PHP. PHP 7.3 and older get no fix from the PHP project. PHP 7.4, 8.0 and 8.1 got only "minimal" fixes. About 1 in 3 WordPress sites runs a PHP version that no longer gets official security support, and about 1 in 5 runs PHP 7 or older (our math from WordPress.org's public stats, 24 October 2026). Some hosts add their own fixes to old versions, so ask yours.
  • Sites whose host hasn't updated yet. Many large hosts said they updated within a day or two. Smaller and cheaper hosts vary.
  • Anyone who can't update. The US cybersecurity agency CISA advised that systems which can't be updated, or run PHP 8.1 or older, be taken offline until they are fixed (via Tenable).

What we know and don't know. Attack attempts are confirmed by several security companies. As of 24 October 2026, no source has confirmed sites actually taken over through PHP2Shell, and it is not yet on CISA's list of known-exploited flaws. Several attempts were reported as failing. That can change quickly once a reliable attack is shared.

What to do today

  1. Find your PHP version. In WordPress, go to Tools → Site Health → Info → Server.
  2. Ask your host two questions: "Is my site on PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer?" and "If I'm on an older PHP, have you added the PHP2Shell fixes yourselves?"
  3. If the answer is no or unclear, move to a supported PHP version (8.3 or newer is best, since 8.2 support ends on 31 December 2026), or take PHP off the public internet.
  4. Keep updating WordPress and plugins. None of the above replaces that.

How WranglePress fits in

WranglePress serves your public pages as plain files from Cloudflare's network, so visitors' requests never reach PHP. Then you can keep WordPress at a private address that only you and your editors can open, or retire it completely. A flaw like PHP2Shell then has no public door to come through. A WordPress you keep still needs updates, but on your schedule instead of within hours. See how it works, or read what it does and doesn't protect.

Sources

Last updated 2026-10-24.