On 21 October, the PHP project released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”. Because PHP powers WordPress and a huge share of the web, this is one of the most significant web security issues in years, and we want to explain what it means and what we’ve done about it.
What’s the issue?
The flaws sit in the core of PHP itself, not in WordPress, a theme or a plugin. By sending specially crafted requests, an attacker who doesn’t need to log in could potentially run their own code on the server. Researchers at Wiz found the issue, it’s been rated critical, and proof-of-concept exploit code was published shortly after disclosure, with reports of attacks starting to appear. Practically every PHP setup that serves web pages is affected unless it’s been updated.
The fix is to upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Versions 8.1 and older are no longer supported by the PHP project and won’t get an official fix.
What we’ve done
- Checked every site we look after to confirm which PHP version each one runs on. [X] sites were on affected versions.
- Patched or upgraded all of them to a fixed release [by date], working with [hosting provider] where the server is managed by them.
- Moved sites off unsupported PHP versions, after testing themes and plugins for compatibility, so they’ll keep getting security updates going forward.
- Added temporary protections while updates rolled out, such as [web application firewall rules / tighter upload and request limits].
- Reviewed logs for signs of suspicious activity. [We found no evidence of compromise on any client site.]
Do you need to do anything?
If we host or maintain your site, no. It’s already been handled, and we’ll be in touch directly if anything changes. If your site is hosted elsewhere, ask your host which PHP version you’re on and whether it’s been patched. If you’re not sure, get in touch and we’ll check for you.
Keeping PHP, WordPress and plugins up to date is one of the least visible parts of looking after a website, but weeks like this are why it matters.