PHP2Shell for WordPress Site Owners: A 15-Minute Checklist for Shared Hosting

Last updated: 4 November 2026 (CISA listed both CVEs as known exploited on 26 October; CVE-2026-115560 still unfixed). Background on the bug: PHP2Shell explained. Running your own server? Use the Linux patching guide.

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a critical bug in PHP, the language WordPress runs on. It lets an attacker run code on a server with no login, and it fires before WordPress loads. So updating WordPress, your theme or your plugins will not fix it, and neither will a security plugin.

Affected by this? Emergency exposure check, ₹2,999, 48 hours. Send us up to 5 hosts, sites or product versions. Within 48 hours you get a written verdict for each one, what to patch first and how to verify the fix. Book the check or ask a question first.

On shared or managed hosting (Hostinger, Bluehost, SiteGround, GoDaddy and others) only your host can install the patched PHP. That doesn’t leave you powerless. This checklist takes about 15 minutes and covers everything a site owner can do.

1. Find your PHP version (2 minutes)

In WordPress: Tools → Site Health → Info, open Server, and look at PHP version. You can also check your hosting panel:

  • Hostinger hPanel: Websites → your site → Advanced → PHP Configuration
  • cPanel: Software → MultiPHP Manager (or “Select PHP Version”)
  • Plesk: Websites & Domains → PHP

2. Compare it with the fixed versions

Your PHP versionStatus
8.5.12 or later✅ Patched
8.4.27 or later✅ Patched
8.3.36 or later✅ Patched
8.2.35 or later✅ Patched (but 8.2 support ends 31 Dec 2026, so plan to move to 8.3+)
Anything lower on 8.2–8.5⚠️ Vulnerable until your host updates it
8.1 or older (7.x, 5.x)❌ End of life. Ask your host about a backported build, or switch to 8.3+ as soon as your site supports it

Some hosts install patched builds that still show an older number. CloudLinux, which many shared hosts use, shipped the fix as alt-php85 8.5.11-5, for example, and that build still reports 8.5.11. If your version looks old, ask your host directly (step 3) before you panic, and keep their written confirmation.

3. Ask your host three questions (5 minutes)

Open a support chat or ticket and paste this:

Hi, regarding PHP2Shell (CVE-2026-109618 / CVE-2026-109619):
1. Is the PHP build serving my site patched (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or a backport)?
2. If not, when will it be, and is a patched PHP version already available that I can switch to?
3. Are you blocking exploit attempts at the network/WAF level in the meantime?
4. Is session.upload_progress disabled, as PHP advises for the related CVE-2026-115560 until its next release?

Good hosts are already patching automatically and filtering attack traffic at their edge. Keep the reply in your records. If your host can’t answer these questions, take that as a reason to consider moving.

Why question 4? On 23 October PHP announced a related, lower-risk issue, CVE-2026-115560, that the 21 October patches do not fix. It only affects sites with an unusual session setup, and no attacks are known. PHP’s interim advice is to keep session upload progress turned off until its next regular release. On shared hosting that is a server setting, so your host has to do it. As of 4 November PHP has not shipped that release, so the setting is still needed.

4. Switch PHP version only if it helps

If your host offers a patched build on another branch (for example 8.3.36 while you are on an unpatched 8.2), switching in the panel can protect you right away. Before switching:

  • Take a full backup (files + database).
  • Check that your theme and key plugins support the newer PHP version.
  • After switching, test the home page, a post, a form and checkout (if you have a shop), and watch for errors.

Switching to another unpatched version gains nothing for PHP2Shell. Don’t switch back and forth just to see a different number.

5. Add a layer in front of your site

A network WAF stops attacks before they reach PHP. Cloudflare has deployed rules for known PHP2Shell vectors on all plans, including free. Many hosts also run their own edge filtering. This buys time, but it is not a substitute for the patch. Note that WordPress security plugins (Wordfence, Sucuri, etc.) cannot block this bug, because they run inside PHP, after the vulnerable code. They are still useful for step 6.

6. Check for signs of compromise (5 minutes)

Exploitation attempts were reported from 17 October 2026, and CISA listed both CVEs as known exploited on 26 October. Check for anything new since 17 October:

  • Users → All Users: any administrator you don’t recognise?
  • Plugins: any plugin you didn’t install, or one recently activated?
  • Security scan: run a full Wordfence or Sucuri scan, with high sensitivity if available.
  • File Manager (hosting panel): .php files inside wp-content/uploads/ are almost always malicious. Also look for oddly named files in the site root.
  • Cron jobs (hosting panel): any scheduled task you didn’t create?
  • Site behaviour: unexpected redirects, spam pages in Google results, or “deceptive site” warnings.

If something looks wrong

  1. Tell your host immediately and ask them to preserve the server logs.
  2. Restore a clean backup from before the suspicious change.
  3. Change every password: hosting, WordPress admins, database, FTP/SFTP and email.
  4. Regenerate the WordPress salts in wp-config.php to log everyone out.
  5. Rotate any API keys stored on the site (payment gateway, SMTP, analytics).

7. While you’re here: basic hygiene

  • Update WordPress core, themes and plugins. This doesn’t fix PHP2Shell, but the separate wp2shell WordPress bug from July 2026 (fixed in 6.8.6 / 6.9.5 / 7.0.2) still affects sites that never updated.
  • Turn on two-factor authentication for every administrator.
  • Make sure automatic backups run and that you can restore one.
  • Run our free Website Safety Check to see whether your HTTPS, security headers and email protection (SPF/DMARC) are set up properly.

One-screen summary

StepDone?
Found my PHP version☐
Compared it with 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35☐
Asked my host the three questions☐
Switched to a patched build (if one was offered) and tested the site☐
WAF / edge protection in place☐
Checked users, plugins, uploads and cron for changes since 17 Oct☐

Want a second pair of eyes? We review WordPress and server security for small businesses, see our VAPT services or contact us.

Related guides

Sources

Tags: , , , ,
Post author avatar

Bhaskar Soni

Bhaskar Soni is a Security Engineer and the founder of Youngster Company, based in Ahmedabad, Gujarat. He works hands-on with Linux server hardening, vulnerability assessment and penetration testing (VAPT), ISO 27001 compliance and OSINT investigations. He writes practical, tested guides for IT professionals and Indian businesses, and every article on this site is written or reviewed by him.

Leave a Reply