Updated October 21, 2026. The PHP project has released emergency security fixes for two critical vulnerabilities, commonly discussed as PHP2Shell. If you own a WordPress website, the practical task is to confirm that your hosting provider has patched the PHP runtime serving your site. Updating a WordPress plugin is a different operation.
This guide explains the confirmed release, the version checks available in WordPress, and the questions to ask your host. It does not diagnose any particular website as compromised. The steps below focus on checking and patching, rather than testing an exploit against a live site.
What has PHP confirmed?
The PHP project’s October 21 security advisory identifies CVE-2026-109618 and CVE-2026-109619 as vulnerabilities that can allow unauthenticated remote code execution. In plain language, that means a potential path for an attacker to run code without first signing in.
The advisory covers PHP installations handling web requests, including common deployments such as PHP-FPM and Apache with mod_php. The upstream fixed releases announced today are:
| PHP branch | October 21 fixed release |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
Some Linux distributions and long-term-support vendors deliver backported fixes. If your provider uses those packages, ask for its security advisory and patched package revision instead of deciding protection from the upstream version string alone.
Why WordPress owners need to check hosting
PHP is one of the programming languages behind WordPress. It runs on the server supplied by your host; visitors do not patch your server by updating their browser.
WordPress’s own October 21 announcement says the flaws are not specific to WordPress, and that no WordPress update is required or planned for these issues. It directs owners to their hosting provider for PHP updates.
Think of these as separate maintenance layers: the WordPress application, its plugins and themes, and the server software underneath them. Keeping one layer current does not prove that the others are current. A dashboard showing no pending plugin updates therefore does not confirm that this PHP issue is fixed.
How to find your site’s PHP version
In your WordPress dashboard, open Tools → Site Health → Info → Server and locate the PHP version. The same information may also appear in your hosting control panel.
Record the full number, not just “PHP 8.” Also note which domain or website you checked. If you manage several sites, do not assume a setting for one domain applies to every other domain on the account.
A version check is an inventory step, not a complete security assessment. Your host should confirm which patched runtime or vendor package actually handles the website’s web requests.
What to ask your hosting company
Contact the provider through its normal support channel and give the domain, the PHP version you found, and both CVE identifiers. Ask whether the fix has already been deployed, whether you need to select a patched version, and whether the serving processes have been refreshed as required.
A concise request can say: Please confirm that the PHP runtime serving my website is patched for CVE-2026-109618 and CVE-2026-109619, and identify the fixed version or vendor package revision. If a change is still needed, please explain the supported update procedure.
This is more useful than asking only whether the account has “the latest PHP.” It gives support a specific security release to check and leaves room for the provider’s packaging and deployment process.
Prepare the change without unnecessary disruption
The official WordPress PHP update guide recommends a website backup and checking theme and plugin compatibility before a PHP version change. Hosting controls differ, so follow your provider’s instructions rather than copying another company’s control-panel steps.
For an ordinary site owner, the next practical step is to confirm that a recent backup includes both files and the database and that a recovery route exists. If a change crosses PHP branches, ask the host or developer about compatibility and staging. Avoid spending hours choosing a distant feature upgrade when the immediate task is getting the security fix onto the running service.
Owners of managed hosting may find that the provider has already handled the patch. Keep the provider’s confirmation with your maintenance records, including the date and the version or package revision it reports.
Check the website after the update
Our suggested checks are the pages and actions your visitors actually use: open the homepage and an article, try search, and test a contact form where appropriate. If the site has accounts or a shop, include its normal login and checkout testing process without placing an unintended paid order.
Recheck the runtime information and ask support about any new errors. If compatibility problems appear, involve the host before reverting to a vulnerable runtime. A page loading successfully establishes basic functionality; it does not, by itself, establish that the correct patch is installed.
Are temporary workarounds enough?
PHP’s advisory says its temporary measures reduce exposure to specific attack paths but do not make an installation safe. Treat configuration changes or a firewall rule as something for your host to evaluate, not as proof that patching can be skipped. PHP 8.1 and older are outside normal upstream security support, so owners of older installations need explicit vendor guidance.
For related maintenance reading, our Windows update guide covers a separate software-update workflow. Our AI search source-checking guide explains why tracing a claim back to its source matters when checking technology news.
The immediate goal is simple: identify the PHP runtime behind the site, obtain a patched release or confirmed vendor fix, and verify normal operation afterward.