On October 21, 2026, the PHP project closed two critical vulnerabilities in the scripting language on which WordPress also runs. We will explain what is behind this, who needs to act now, and how serious the situation really is for your website in the first sections below.
How to secure your WordPress site against PHP2Shell
Does PHP2Shell affect your WordPress site? Since October 21, 2026, trade publications and authorities have been reporting two critical errors in the PHP programming language. Headlines about a vulnerability that is supposed to affect a large portion of all websites sound alarming. What you specifically need to do, they usually don’t tell you.
The short answer upfront: Your web host installs the crucial update on the server, not you and not us. We at VASTCOB have been supporting WordPress projects since 2010. That’s why we first explain clearly what is behind the vulnerability, who is responsible, and how great the risk actually is. Technical details for administrators follow in the second half of this article.
PHP2Shell explained in simple terms
For a WordPress site to appear in the browser at all, the web server needs PHP. This programming language processes the code from WordPress, your theme, and your plugins with each request and builds the finished page from it. The vulnerability known as PHP2Shell is embedded in this very foundation and not in WordPress itself. Your theme, your plugins, and your content are therefore not faulty.
With certain, deliberately manipulated requests, memory areas in PHP become confused, so to speak. An attacker could use this condition to execute their own commands on the server without having to log in anywhere beforehand. Technically, this is a PHP vulnerability in memory management, listed under the identifiers CVE-2026-109618 and CVE-2026-109619.
Now the good news: Since October 21, there are secured PHP versions. If your server is running one of them, PHP2Shell is closed there. When this happens, however, is not in your hands, but in those of your hosting provider.
Who installs the update and what we do for you
PHP does not run in your website, but on the server where your website is located. How this server is maintained is decided by your web host. That’s why only the host can install the PHP security update, not a plugin and not a setting in the WordPress backend. With shared hosting and managed plans, this happens centrally for all customers, often without you noticing anything.
We ourselves are not a web host and do not operate our own servers. Our hosting packages also run with partner hosts like All-Inkl, who roll out the PHP2Shell fix there themselves.
Our task begins where the host’s ends. For the sites we manage, we check the configured PHP version and ask the respective provider whether the patch is active. We update outdated PHP branches to a supported version in the hosting panel. After that, we test whether the website and shop run without errors.
What you as a website operator should do now
For most operators, the list is pleasantly short:
Become more visible on Google & Social Media?
In a free strategy consultation for data-driven online marketing, we uncover your untapped potential, review any existing ad accounts if necessary, examine your SEO ranking and visibility, and determine which strategy is appropriate for your budget and which active measures will lead to more inquiries or sales.
✅ More visibility & perception through targeted placement
✅ More visitors > prospects > customers > revenue
✅ Reach target groups scalably with SEA
✅ Act and grow sustainably with SEO
🫵 Maximum success with our hybrid strategy
💪 More than 15 years of experience across industries in over 1,000+ projects demonstrable!
- Keep calm: Do not make any changes to the website itself, as neither a plugin nor a backend setting will help against PHP2Shell.
- Check with your hosting provider: Read your provider’s customer information or inquire directly whether the secured PHP version has already been deployed.
- Check PHP version: In the hosting panel, you can see which version is set for your domain. If it shows 8.1 or older, an upgrade is necessary.
- Get help: If you are unsure, feel free to contact us. We will look at it together with you.
How dangerous is PHP2Shell really?
The vulnerability is serious. Security experts rate both flaws at 9.2 out of 10 possible points because an attack can work without a user account and without any action by the site operator. Add to this the scope. Practically all PHP versions from the past 20 years are affected.
At the same time, several factors limit the risk in everyday use. The secured versions were ready within a day, and hosting providers like All-Inkl began rolling them out on the same day. According to heise, an attack via PHP2Shell also requires several thousand to tens of thousands of targeted requests. It is not a one-click trick.
As of now: The Federal Office for Information Security reported no confirmed attacks as of October 21. Cloudflare reported the first attack attempts on October 22 and has activated filter rules for its customers. Servers that remain unpatched for longer or still run on older PHP branches are therefore particularly at risk.
What a PHP RCE means in the worst case
RCE stands for Remote Code Execution. If a PHP RCE were to succeed on an unpatched server, the attacker would have the same rights as the web server itself. They could read database credentials, plant hidden backdoors, inject spam pages, or access customer data in a shop.
The risk is highest on servers running PHP as an Apache module (mod_php). There, the attack takes effect before WordPress even starts. For this reason alone, the update should not be put off.
These PHP versions close PHP2Shell
Whether your site is affected depends solely on the PHP version on your server. WordPress version, theme, and plugins play no role for PHP2Shell. You can find the installed version in the WordPress backend under Tools and Site Health in the Report tab, as well as in your hosting provider’s customer area.
These versions contain the fix from October 21, 2026:
| PHP Branch | Secured Version | Support Status |
|---|---|---|
| 8.5 | 8.5.12 | actively maintained, longest runtime |
| 8.4 | 8.4.27 | actively maintained |
| 8.3 | 8.3.36 | security updates until end of 2027 |
| 8.2 | 8.2.35 | security updates only until end of 2026 |
| 8.1 and older | no official version | migration to a supported branch required |
With Linux servers, there is a special feature. Distributions like Debian or Ubuntu often incorporate security fixes into their own packages without changing the version number. An apparently old number there does not automatically mean that PHP2Shell is still open. In case of doubt, the hosting provider can provide binding information.
Why security plugins don’t work here
Security plugins and WordPress firewalls operate within WordPress. However, PHP2Shell is typically triggered before WordPress is even loaded, so a plugin cannot see the attack at all. Against this vulnerability, only updating the server software helps.
For all other attack vectors, good plugins, secure passwords, and regular updates remain important nonetheless. Our guide on WordPress security shows how these protection layers work together.
How All-Inkl responded to the PHP security vulnerability
All-Inkl*, the hosting provider we prefer for WordPress projects, responded on October 21st, the day of publication. The company publicly announced that it would prepare the necessary security updates with high priority for all servers and roll them out gradually over the following hours. Customers there normally do not need to do anything against PHP2Shell themselves. If your package is still on an older PHP branch, it’s still worth checking your customer portal.
Why is this important to us? In the case of a PHP security vulnerability of this magnitude, the hosting provider’s response time determines how long websites remain vulnerable. Immediate customer notification and rollout on the same day align with what we have experienced in many years of collaboration. What we additionally appreciate about the provider is summarized in our All-Inkl experiences.
What you should ask your hosting provider now
Regardless of the provider, these four questions quickly clarify the situation:
- Is the secured PHP version already active for my plan?
- Does the protection apply to all PHP branches I can select in the customer menu?
- What happens to packages that are still running PHP 8.1 or older?
- Were there any signs of attacks via PHP2Shell on the servers?
The PHP security update on your own servers
If no one performs the update for you, the responsibility lies with you. This applies to your own root servers and VPS, Docker containers with a fixed PHP version built in, as well as agency servers where many customer projects run together. Routers, NAS systems, and firewall appliances also sometimes use PHP for their management interface and then require a firmware update from the manufacturer.
The fixes against PHP2Shell come on such systems via package management. Container images must be pulled again, and PHP-FPM and web server must then be restarted. Among the more than 1,000 projects we have implemented, there were repeatedly servers with PHP branches from 7.4 to 8.1 that continued to run years after support ended. For these branches, there are only source code corrections without an official release. Switching to a supported branch is therefore the cleaner solution. Our guide on WordPress PHP update describes how to make the switch without downtime.
Interim solutions while no patch is possible
The PHP team mentions some settings that make certain attack vectors more difficult. They explicitly refer to them as a stopgap measure. These include a removed memory limit, disabling upload progress display in sessions, a low allowed nesting depth for form data, and more frequent restarts of PHP-FPM workers.
Such measures have side effects. Without a storage limit, for example, a single faulty script can slow down the entire server. These settings buy time, but do not replace the update against PHP2Shell. Where even that is not feasible, CERT-EU recommends disconnecting affected applications from the public network until the patch is available.
Investigating after the update
A patch closes the door, but does not remove anyone who got in before. For most sites, the inspection should go unnoticed. However, you should not skip the check, especially on servers that ran for a few days after October 21st without a fix against PHP2Shell.
Once an attack has succeeded, the perpetrators often leave behind so-called webshells. These are small PHP files that allow the server to be controlled again later. Therefore, check whether there are PHP files in wp-content/uploads, in wp-content/plugins, or in the main directory that you do not recognize. Files are also suspicious if their modification date does not match any of your updates.
Other warning signs are new administrator accounts in WordPress, unknown cronjobs in the hosting panel, and modified core files. A comparison with the original files from WordPress.org, for example using WP-CLI with the command wp core verify-checksums, will uncover such changes in minutes.
Renew access credentials and keys
If a server was vulnerable for an extended period, all access credentials on it should be considered potentially known. Via PHP2Shell, an attacker could, for example, have read the wp-config.php along with the database password.
In this case, renew the database password, the security keys (salts) in the wp-config.php, all administrator and FTP access credentials, as well as API keys from payment and shipping services in the shop. New salts also log out all logged-in users at the same time, including any potential intruders.
PHP2Shell as an opportunity for a fixed update routine
The next critical vulnerability will certainly come, whether in PHP, in the WordPress core, or in a popular plugin. Then a practiced workflow with clear responsibilities counts. The hosting provider keeps the server and PHP up to date, but WordPress core, theme, and plugins require their own regular maintenance. How well this division of labor works was demonstrated by PHP2Shell. Sites on well-maintained hosting with current PHP versions were able to be secured within a short time.
If you do not want to handle this maintenance yourself, our WordPress maintenance takes care of updates, PHP versions, and functionality tests. Over 100 customers have rated our work as „Very good“ on ProvenExpert. Unsure whether your server is already secured? We are happy to check that with you.
DE
