If you have a website, this week you will have seen headlines about a critical flaw in PHP. And rightly so: on 21 October 2026 the PHP team released emergency patches for two vulnerabilities that allow code to be executed on a server without needing a username or password. I explain what happened with the PHP vulnerability, who it affects and how to fix it, without jargon and without alarmism.
What happened with the PHP vulnerability
The flaws are called CVE-2026-109618 and CVE-2026-109619, and are known as PHP2Shell. Both have a severity of 9.2 out of 10 and allow unauthenticated remote code execution. In plain words: someone from outside could make your server run commands that are not yours.
The most important points in a few lines:
- Where the flaw is: in PHP, the language your website runs on, not in WordPress or your plugins.
- Severity: critical, 9.2 out of 10.
- Who it affects: according to the US agency CISA, PHP installations that serve web requests.
- Patches available: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Attacks: when CISA published its alert it had not observed exploitation, but other outlets report early attempts to take advantage of it. Better not to wait and find out.
Does it affect my WordPress website?
If your website uses PHP, and WordPress does, it can affect you as long as your server runs an unpatched version. Here is the most common confusion: the problem is not in WordPress, nor in your theme, nor in your plugins. That is why updating WordPress does not fix it. What needs updating is PHP on the server, and that is done from your hosting.
The same goes for Drupal, Joomla, Magento or PrestaShop. If you are only a visitor to websites, you do not need to do anything.
How to fix it step by step
- Make a full backup of files and database before touching anything.
- Check your PHP version. You can see it in your hosting panel or, in WordPress, under Tools > Site Health > Info > Server.
- Update PHP to a patched version (8.5.12, 8.4.27, 8.3.36 or 8.2.35). Many hosts apply the patch without changing the version number, so ask them whether it already includes the fixes for CVE-2026-109618 and CVE-2026-109619.
- If you use PHP 8.1 or earlier, those versions no longer have official support. CISA recommends taking PHP-based systems offline until they can be updated. The sensible thing is to migrate to 8.3 or higher and test your website first, because some old plugin or theme may cause problems.
- Enable a firewall (WAF) as a temporary measure. It helps, but it does not replace the update.
- Keep watch over the following days: administrators you do not know, plugins or files you did not install, odd redirects or warnings from your hosting or Google.
If you cannot update right now and your website is not essential these days, CERT-EU recommends taking it offline until it is resolved. It is drastic, but cheaper than cleaning up an infected website.
Why good website maintenance gives you peace of mind
This vulnerability will not be the last. Every few weeks a flaw appears in PHP, in WordPress or in some plugin. The difference between finding out from a headline and already having the problem solved is whether someone takes care of your website continuously.
A good WordPress maintenance plan usually covers the following:
- Automatic, verified backups, so you can roll back if something fails.
- Updates of PHP, WordPress, theme and plugins with prior testing, so nothing breaks along the way.
- Monitoring for downtime, malware and known vulnerabilities.
- Someone who alerts you and acts when a flaw like this appears, instead of you discovering it.
- A review after an incident, in case the attacker left something hidden.
An unmaintained website works fine… until it stops. And when it fails it is at the worst moment: in the middle of the season, with a campaign running or with customers coming in. Keeping it up to date is much cheaper and calmer than repairing the damage. If you have just launched your website, also see the 5 steps to take after building your website.
Frequently asked questions
Does updating WordPress fix the PHP vulnerability?
No. The flaw is in PHP, which is updated on the server through your hosting. It is a good idea to keep WordPress and plugins up to date too, but that is a different matter.
How do I know which PHP version my website has?
In your hosting panel, or in WordPress under Tools > Site Health > Info > Server. If you cannot find it, ask your provider.
My hosting says it is already patched, but the version has not changed. Is that normal?
Yes, some providers and distributions apply the fix without changing the version number. Ask them to confirm it includes CVE-2026-109618 and CVE-2026-109619.
Can I stay on PHP 7.4 or 8.0?
It is not recommended. They are versions without official support and are not among the patched ones CISA cites. Plan the migration as soon as possible.
Can my website break when I update PHP?
It can happen, especially with old plugins or themes. That is why it is done with a backup and, if possible, testing first in a staging environment.
If you would rather not worry about this
If you do not know which PHP version your website runs or prefer someone to take care of updating it without scares, write to me from the contact page and we will review it together.
Information updated as of 22 October 2026. Details may change; always check the official notice on php.net. Sources: CISA alert and Help Net Security.
