WordPress PHP Update: What PHP2Shell Means for Your Website

WordPress PHP Update: What PHP2Shell Means for Your Website

If you run a WordPress website, you may have seen some fairly alarming warnings about PHP over the last 24 hours.

Two critical vulnerabilities were publicly disclosed on 21 October 2026 and have become known collectively as PHP2Shell.

The important distinction is that this is not actually a WordPress vulnerability.

The vulnerabilities are in PHP itself. WordPress happens to run on PHP, along with a huge number of other websites and applications, which is why WordPress website owners need to pay attention.

WordPress.org has issued its own security notice encouraging website owners to check their PHP version and their web host's advice. It also makes clear that no WordPress core update is required or planned to fix PHP2Shell.

So, if you've been looking for a WordPress PHP update or wondering whether you need to urgently update WordPress itself, here's what has actually happened and what you need to do.

What is PHP2Shell?

PHP2Shell is the name being used for two newly disclosed vulnerabilities in PHP:

CVE-2026-109618 and CVE-2026-109619.

Both have been rated as critical security vulnerabilities.

In the worst case, they can potentially allow an attacker who isn't logged into a server to execute code remotely.

That's considerably more serious than the sort of minor plugin vulnerability that WordPress website owners may be used to seeing.

The PHP project has released patched versions and is strongly encouraging users to update affected installations.

Is PHP2Shell a WordPress vulnerability?

Not technically, although I suspect we'll see plenty of people searching for the latest WordPress vulnerability over the next few days.

PHP2Shell exists within PHP rather than WordPress.

WordPress is relevant because PHP is one of the main technologies it runs on. The same vulnerability can therefore affect other websites and applications built using PHP too.

That distinction matters.

Updating WordPress core, installing a security plugin or updating an individual WordPress plugin does not patch PHP2Shell.

The PHP installation running on the server needs to be protected or updated.

WordPress itself has confirmed that these vulnerabilities aren't specific to WordPress and that there is no WordPress core update required to address them.

Which PHP versions are safe?

Patched PHP versions were released on 21 October:

• PHP 8.5.12 or newer

• PHP 8.4.27 or newer

• PHP 8.3.36 or newer

• PHP 8.2.35 or newer

Earlier releases within those branches may be affected.

PHP 8.1 and older are already outside normal support from the PHP project, so if your website is still running one of those versions, this is also a good opportunity to look at moving it onto a currently supported release.

PHP 8.2 is still supported at the time of writing, although its security support ends on 31 December 2026.

For WordPress websites, PHP 8.3 or newer is currently recommended, although exactly which version you should use can depend on the age of the website, the theme, plugins and any custom code it uses.

How do I check my PHP version in WordPress?

Fortunately, you don't need to install anything.

Inside the WordPress dashboard, go to:

Tools → Site Health → Info → Server

You'll see the PHP version currently being used by your website.

Your hosting control panel will usually show the PHP version as well.

Once you know what version you're using, the next step is to check whether your hosting provider has already applied the security update.

Does my web host update PHP automatically?

Possibly.

This is where things will differ depending on how your website is hosted.

If you're using managed WordPress hosting or standard shared hosting, your hosting provider may already be handling the security update at server level.

Some hosts automatically apply PHP security patches and may also have additional firewall or server-level protections in place.

In that situation, you may not need to do anything yourself.

However, I wouldn't assume that every hosting company has handled PHP2Shell in exactly the same way.

Check your host's status page, security notice or support documentation and confirm whether your PHP version has been patched.

If you're unsure, ask them directly.

What if I manage my own server or VPS?

That's different.

If you're running a VPS or dedicated server where you are responsible for PHP yourself, you need to make sure the installed PHP version has been updated to a patched release.

That means running at least:

• PHP 8.5.12

• PHP 8.4.27

• PHP 8.3.36

• PHP 8.2.35

or a newer supported version.

In self-managed environments, the hosting company may provide the infrastructure but leave software updates such as PHP entirely up to you.

This distinction between managed hosting and self-managed hosting is important.

If you're not sure which applies to you, check with your host before changing anything.

Do I need to update WordPress itself?

Not specifically for PHP2Shell.

This is probably one of the most useful points to understand because the words WordPress, PHP and security update can easily get mixed together.

WordPress has its own updates.

Your themes have updates.

Your plugins have updates.

And the PHP software running on the server has its own updates.

PHP2Shell is in that final category.

There is no WordPress core update required specifically for these vulnerabilities.

That doesn't mean you should ignore normal WordPress updates.

Keeping WordPress, your theme and your plugins current is still an important part of website security.

It simply means pressing "Update WordPress" isn't the fix for this particular problem.

Should I manually update my PHP version?

That depends on your hosting setup.

If your hosting provider has confirmed that it manages PHP for you and has already applied the necessary security patches, I'd follow its advice rather than changing settings unnecessarily.

If you manage PHP yourself, you should update to a patched release.

For an older WordPress website, though, I wouldn't blindly jump several major PHP versions without checking it first.

An old plugin, abandoned theme or piece of custom code can potentially rely on PHP behaviour that has since changed.

Before changing PHP versions, I'd recommend:

• backing up the website;

• updating WordPress core;

• updating plugins and themes;

• checking compatibility with the PHP version you want to use;

• changing PHP;

• and testing the website afterwards.

For an ecommerce website, membership website or anything else with important functionality, test things such as checkout, forms, accounts and integrations rather than simply checking that the homepage still loads.

Can updating PHP break WordPress?

It can.

Usually, though, the problem isn't WordPress itself. It's older code running alongside it.

I've come across plenty of WordPress websites that have accumulated plugins, themes and snippets over several years. Sometimes nobody is quite sure what half of them are doing anymore.

Moving a website like that from a very old PHP version straight onto a current release can expose compatibility problems.

That's one reason keeping a website reasonably current is much easier than leaving it untouched for years and trying to update everything at once.

It's also worth separating a security update within your existing PHP branch from a major PHP upgrade.

Moving from PHP 8.3.35 to PHP 8.3.36 is not the same thing as moving an old website from PHP 7.4 straight to PHP 8.5.

What should WordPress website owners do now?

First, don't panic.

Check which PHP version your website is running and, more importantly, check what your hosting provider has said about PHP2Shell.

If your host manages PHP, it may already have taken care of the immediate problem.

If you manage PHP yourself, make sure you're running a patched version.

If you're using an unsupported PHP version such as PHP 8.1 or older, I'd also use this as a prompt to work out why the website is still on it and whether it can be safely moved onto something current.

The main thing is not to assume that updating WordPress itself has fixed the issue.

PHP sits underneath WordPress, so this particular security update needs to be dealt with at hosting or server level.

A useful reminder about WordPress security

Events like this are also a good example of why WordPress security goes further than installing a security plugin.

A WordPress website sits on top of several different layers.

There's WordPress itself, its plugins and themes, PHP, the web server, the hosting environment and often services such as a CDN or web application firewall sitting around it.

A vulnerability in any one of those layers can matter even if WordPress itself is completely up to date.

Good hosting is therefore a meaningful part of website security.

One of the advantages of managed hosting is that server-level issues can often be dealt with by the hosting provider before the average website owner even knows there's a problem.

That doesn't mean you should completely ignore what's happening behind the scenes, but it does mean you shouldn't necessarily need to become a server administrator just to run a WordPress website.

Do you need help with an older WordPress website?

If all of this has made you check your WordPress dashboard and discover your website is still running an ancient PHP version, that doesn't necessarily mean you need a completely new site.

Sometimes it simply needs properly updating, testing and cleaning up.

I work with existing WordPress websites as well as building new ones, so if you're unsure whether your current website can safely be updated, I can take a look at what's actually running before changing anything.

The aim isn't to update things for the sake of it. It's to keep the site secure, supported and working properly.

WordPress PHP Update FAQs

What is the latest safe PHP version for WordPress?

The PHP2Shell fixes were released in PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 and PHP 8.2.35. Later supported releases also include the security fixes.

Is PHP2Shell a WordPress vulnerability?

No. PHP2Shell refers to vulnerabilities in PHP itself. WordPress websites are potentially affected because WordPress runs on PHP, but WordPress core isn't the source of the problem.

Do I need to update WordPress for PHP2Shell?

No WordPress core update is required specifically for PHP2Shell. The underlying PHP environment needs to be updated or protected at server level.

How do I check my PHP version in WordPress?

Go to Tools → Site Health → Info → Server in your WordPress dashboard. Your current PHP version will be displayed there.

Does my web host update PHP automatically?

Many managed and shared hosting providers handle PHP security updates automatically, but this varies between hosts. Check your hosting provider's security notice or support documentation rather than assuming it has already been done.

What if I use a VPS?

If you manage the server yourself, you may be responsible for updating PHP manually. Check which PHP version is installed and whether your hosting provider manages software updates on your behalf.

Is PHP 8.1 safe to use with WordPress?

PHP 8.1 and older are no longer supported by the PHP project. Even if your website still runs on them, moving to a currently supported PHP version is advisable.

Can changing the PHP version break my WordPress site?

Potentially. Older themes, plugins and custom code may not support newer PHP releases. Back up the site first and test important functionality after making a major PHP version change.