Is my WordPress website affected by PHP2Shell? A plain-English guide for business owners

What happened, without the jargon

WordPress is written in a programming language called PHP. Your web hosting runs PHP on its servers to turn your WordPress pages into what visitors see. Think of WordPress as the shop fitting and PHP as the building's wiring.

On 21 October 2026, the people who make PHP released emergency fixes for two serious flaws, now nicknamed “PHP2Shell”. They let an attacker take control of a web server just by sending it a specially crafted request, with no password needed and no login page involved. Once in, an attacker could change your website, add spam or malware, or reach the customer data your site stores. Security firms reported attack attempts on the same day. php.net announcement

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but you don't need to remember those. Your host or developer does.

Why updating WordPress won't fix it this time

Most WordPress security advice says “keep WordPress and your plugins updated”, and that advice is still right. But this flaw is in the wiring, not the shop fitting. Researchers showed it working against completely up-to-date WordPress sites, and putting WordPress into maintenance mode doesn't stop it either, because PHP handles the request before WordPress is involved. Only an update to PHP on the server closes it.

Is this the same as wp2shell?

No, despite the similar name. wp2shell was a different, WordPress-level flaw fixed back in July 2026 (WordPress 6.9.5 and 7.0.2), and a normal WordPress update fixed it. Rapid7 on wp2shell PHP2Shell is new and sits underneath WordPress. While you're checking, it's worth confirming you have the July update as well: Dashboard → Updates shows your WordPress version.

Who is responsible for fixing your server?

That depends on how your site is hosted. Most small businesses fall into one of these:

Not sure which one you are? Look for who sends your hosting invoice. That company, or the developer who set it up for you, is who you contact.

How to find your PHP version in two minutes

1. Log in to your WordPress dashboard.
2. Go to Tools → Site Health, then click the Info tab.
3. Open the Server section and look for PHP version.

Write the number down and include it in your email. Don't try to judge it yourself, though. Some hosts use Linux packages that include the fix under an older-looking number, while one popular package source was still serving an unfixed 8.3.35 hours after the release. Only your host can tell you whether your particular server is patched. If the number starts with 7 or 8.0 or 8.1, mention that clearly: those versions are out of support and need a bigger conversation.

The email to send your host or developer

Copy this, fill in the brackets, and send it today:

Subject: PHP2Shell security fix for my site

Hello,

My website [your-domain] is hosted on my
account with you [account number].

On 21 October 2026, PHP released urgent
fixes for two critical flaws,
CVE-2026-109618 and CVE-2026-109619
("PHP2Shell"). Please confirm in writing:

1. Which PHP version and package my
   website runs on.
2. Whether it includes the fix for both
   CVEs, and when it was installed.
3. If not fixed yet: when it will be, and
   what you've done to reduce the risk
   in the meantime.
4. Whether you've seen any signs of
   attack on my account.

Thank you,
[Your name]

What a good answer looks like

A good answer names a version, says it includes the fix, and gives a date. For example: “your server runs PHP 8.3.36, installed at 16:20 on 21 October; we've seen nothing unusual on your account.” Keep that email, because it's your proof if a customer, insurer or auditor ever asks.

Answers that should worry you

• “We're aware of the issue”, with no date for the fix.
• “Just keep your plugins updated.” That isn't this problem.
• “You're on PHP 8.3, which is up to date.” Version 8.3 itself isn't enough; it needs the fixed release.
• No reply within a working day, for a flaw that's being attacked right now.

That's the standard to expect from any host or agency: a short note in plain English saying which PHP version each of your sites runs, when it was fixed, and what was checked. If they had to wait for a fixed package, as we did on a client server on release day, the note should also say what they did in the meantime.

What not to do

• Don't install a “PHP2Shell protection” plugin. A plugin runs inside WordPress, after the point where this attack happens. Some “fixes” circulating online are scams.
• Don't change your PHP version in the hosting control panel on a whim. Jumping to a different version can break an older theme or plugin, and it only helps if the host has already patched that version. Leave it to your host or developer.
• Don't download “exploit checkers”. Security researchers have warned that some public exploit code contains malware itself.

Signs your site may already have been hit

None of these prove an attack, but any of them is worth a call to your host or developer today:

• Admin users in WordPress you don't recognise.
• Pages, posts or links you didn't create, often for pharmacy, gambling or loan sites.
• Visitors being redirected elsewhere, especially on mobile.
• A “This site may be hacked” warning in Google, or a suspension email from your host.
• The site suddenly running very slowly or showing errors with no change on your side.

If you think something's wrong, don't start deleting things: that destroys the evidence of how they got in. Ask your host or developer to investigate, change your WordPress and hosting passwords, and restore from a clean backup only once the server is patched. If your site holds customer details such as orders, accounts or enquiry forms, you may also have legal duties to report a data breach. In the UK, that can mean telling the ICO within 72 hours, as our UK patch plan explains.

After this week: four questions to ask about your website

PHP2Shell won't be the last emergency of its kind. The calm way through the next one is knowing the answers to these now:

1. Who updates the server, and how fast? “Within a day for critical fixes” is a reasonable bar.
2. Is my PHP version still supported? PHP 8.2 stops getting security fixes on 31 December 2026, so if you're on 8.2 or older, plan the upgrade now.
3. Where are my backups, and has anyone tested restoring one?
4. Will you tell me, in writing, when something like this happens?

If you can't get clear answers, that's the real risk to fix. A maintenance and support planexists so these answers are somebody's job. If your developer has disappeared, our guide to taking over a website from another agency covers getting control back safely.