Last updated: 22 October 2026. Background on the bug: PHP2Shell explained. Running your own server? Use the Linux patching guide.
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a critical bug in PHP, the language WordPress runs on. It lets an attacker run code on a server with no login, and it fires before WordPress loads. So updating WordPress, your theme or your plugins will not fix it, and neither will a security plugin.
On shared or managed hosting (Hostinger, Bluehost, SiteGround, GoDaddy and others) only your host can install the patched PHP. That doesn’t leave you powerless. This checklist takes about 15 minutes and covers everything a site owner can do.
1. Find your PHP version (2 minutes)
In WordPress: Tools → Site Health → Info, open Server, and look at PHP version. You can also check your hosting panel:
- Hostinger hPanel: Websites → your site → Advanced → PHP Configuration
- cPanel: Software → MultiPHP Manager (or “Select PHP Version”)
- Plesk: Websites & Domains → PHP
2. Compare it with the fixed versions
| Your PHP version | Status |
|---|---|
| 8.5.12 or later | ✅ Patched |
| 8.4.27 or later | ✅ Patched |
| 8.3.36 or later | ✅ Patched |
| 8.2.35 or later | ✅ Patched (but 8.2 support ends 31 Dec 2026, so plan to move to 8.3+) |
| Anything lower on 8.2–8.5 | ⚠️ Vulnerable until your host updates it |
| 8.1 or older (7.x, 5.x) | ❌ End of life. Ask your host about a backported build, or switch to 8.3+ as soon as your site supports it |
Some hosts install patched builds that still show an older number. If your version looks old, ask your host directly (step 3) before you panic.
3. Ask your host three questions (5 minutes)
Open a support chat or ticket and paste this:
Hi, regarding PHP2Shell (CVE-2026-109618 / CVE-2026-109619):
1. Is the PHP build serving my site patched (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or a backport)?
2. If not, when will it be, and is a patched PHP version already available that I can switch to?
3. Are you blocking exploit attempts at the network/WAF level in the meantime?Good hosts are already patching automatically and filtering attack traffic at their edge. Keep the reply in your records. If your host can’t answer these questions, take that as a reason to consider moving.
4. Switch PHP version only if it helps
If your host offers a patched build on another branch (for example 8.3.36 while you are on an unpatched 8.2), switching in the panel can protect you right away. Before switching:
- Take a full backup (files + database).
- Check that your theme and key plugins support the newer PHP version.
- After switching, test the home page, a post, a form and checkout (if you have a shop), and watch for errors.
Switching to another unpatched version gains nothing for PHP2Shell. Don’t switch back and forth just to see a different number.
5. Add a layer in front of your site
A network WAF stops attacks before they reach PHP. Cloudflare has deployed rules for known PHP2Shell vectors on all plans, including free. Many hosts also run their own edge filtering. This buys time, but it is not a substitute for the patch. Note that WordPress security plugins (Wordfence, Sucuri, etc.) cannot block this bug, because they run inside PHP, after the vulnerable code. They are still useful for step 6.
6. Check for signs of compromise (5 minutes)
Exploitation attempts were reported from 17 October 2026. Check for anything new since then:
- Users → All Users: any administrator you don’t recognise?
- Plugins: any plugin you didn’t install, or one recently activated?
- Security scan: run a full Wordfence or Sucuri scan, with high sensitivity if available.
- File Manager (hosting panel):
.phpfiles insidewp-content/uploads/are almost always malicious. Also look for oddly named files in the site root. - Cron jobs (hosting panel): any scheduled task you didn’t create?
- Site behaviour: unexpected redirects, spam pages in Google results, or “deceptive site” warnings.
If something looks wrong
- Tell your host immediately and ask them to preserve the server logs.
- Restore a clean backup from before the suspicious change.
- Change every password: hosting, WordPress admins, database, FTP/SFTP and email.
- Regenerate the WordPress salts in
wp-config.phpto log everyone out. - Rotate any API keys stored on the site (payment gateway, SMTP, analytics).
7. While you’re here: basic hygiene
- Update WordPress core, themes and plugins. This doesn’t fix PHP2Shell, but the separate wp2shell WordPress bug from July 2026 (fixed in 6.8.6 / 6.9.5 / 7.0.2) still affects sites that never updated.
- Turn on two-factor authentication for every administrator.
- Make sure automatic backups run and that you can restore one.
- Run our free Website Safety Check to see whether your HTTPS, security headers and email protection (SPF/DMARC) are set up properly.
One-screen summary
| Step | Done? |
|---|---|
| Found my PHP version | ☐ |
| Compared it with 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 | ☐ |
| Asked my host the three questions | ☐ |
| Switched to a patched build (if one was offered) and tested the site | ☐ |
| WAF / edge protection in place | ☐ |
| Checked users, plugins, uploads and cron for changes since 17 Oct | ☐ |
Want a second pair of eyes? We review WordPress and server security for small businesses, see our VAPT services or contact us.
