A serious PHP security flaw is being actively probed right now. Here’s how to check your site in five minutes, and what to do next.
I spent this week checking my clients’ servers one by one, and the same question kept coming from website owners: “Do I need to worry about PHP2Shell?” Short answer: maybe. Here’s how to find out in five minutes.
// In short
- PHP2Shell is two critical flaws in PHP, the language WordPress runs on. They can let a stranger run their own code on your server.
- Updating WordPress or your plugins does not fix it. The PHP version on your server needs updating.
- Fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on 21 October 2026.
- Attackers are already testing websites for it. Fix it this week, not someday.
What is actually broken
Think of your website as a house. WordPress is the furniture, plugins are the appliances, and PHP is the foundation. PHP2Shell is a crack in the foundation. A new sofa won’t fix it.
The two flaws (CVE-2026-109618 and CVE-2026-109619) are rated 9.2 out of 10 for severity. In some server setups, someone can take over your server without logging in. Then they can change your pages, read your customer data or quietly hide malware on your site.
//// Where things stand (28 October)
Security companies are seeing a lot of automated attacks testing websites for PHP2Shell. Unpatched test servers set up as bait have been broken into. The US cybersecurity agency CISA has officially listed both flaws as being used in real attacks. The good news: Wordfence, which protects more than 5 million WordPress sites, hasn’t confirmed a single WordPress site hacked this way yet. That’s your window to fix it.
The 5-minute check
- Log in to your WordPress dashboard.
- Go to Tools > Site Health > Info.
- Open the Server section and find PHP version.
- Compare it with the table below.
| Your PHP Version | Status | What to do |
| 8.5, 8.4, 8.3 | Fix available | Update to 8.5.12, 8.4.27 or 8.3.36 |
| 8.2 | Fixed, support ends 31 Dec 2026 | Update to 8.2.35 now, move to 8.3+ before the new year |
| 8.1, 8.0, 7.4 | Out of support | No official update. Migrate to PHP 8.3 or 8.4 |
| 7.3 or older | Out of support | Migrate. The site probably needs a refresh too |
If your website was built a few years ago and nobody has looked after it since, it’s most likely in the bottom two rows.
How I update a client site, step by step
This is my process, so you know what a safe update looks like, whoever does it:
- Full backup first. Files and database, saved somewhere other than the server.
- Test copy. For bigger jumps (for example from PHP 7.4), I update a copy of the site first, never the live one.
- Update plugins and theme. Old plugins are what usually break on a newer PHP.
- Switch PHP. Usually one click in the hosting panel.
- Test what makes you money. Contact forms, booking widgets, online payments, newsletter sign-ups, the admin area.
- Keep an eye on it for a few days. Error logs and anything odd.
Can’t update right away? A firewall service like Cloudflare in front of your site can block a lot of attack traffic for now. It buys you time. It isn’t a fix.
Signs your site may already be affected
No confirmed WordPress cases yet, but if your PHP is out of date, look for:
- Admin users in WordPress you don’t recognise
- Files or plugins you never installed
- Visitors (especially on mobile) being sent to strange websites
- Google warnings in search results or in Search Console
- Your host warning you about high server load or spam being sent
If you see any of these, don’t just update and move on. The site needs cleaning first.
How I can help
Whether I built your site or not:
- Check and update, from €60: one hour to look at your site and server, one hour for the update and testing. After that, hourly rate if more is needed.
- Maintenance, €75/month: updates, backups and monitoring. Next time there’s news like this, it’s my job, not yours.
- Hacked site clean-up, from €300: malware removal and repair. (Yes, maintenance is cheaper.)
Before I touch anything, I tell you what your site needs and what it costs.
Hosts update the server, but they can only switch you to a newer PHP if your website can run on it. If your theme or plugins need old PHP, the website itself has to be updated first. That part is web work, not hosting.
I wouldn’t. Attackers are scanning now. On a fairly recent PHP version, the update usually takes less than a day.
Often, yes. PHP 8.3 and 8.4 are noticeably faster than 7.x, so the security fix can come with a small speed boost.
No. I’m already on it, and I’ll let you know when your site is done.
