PHP2Shell help for WordPress owners
Reviewed 22 October 2026 · PHPCheck
PHP helps run WordPress. Your website host can help check whether its security fixes are installed.
What is PHP2Shell?
PHP2Shell is the name used for two security issues in PHP, the software that helps run many websites. A website check can show whether the reported PHP version may need a fix.
What should I do?
- Enter your website address in PHPCheck to look for warning signs.
- Ask your host to confirm the PHP version and fixes running your website.
- If an update is needed, ask your host to make a backup and check that your website will work with it.
- After the update, test important pages, logins and forms.
Does updating WordPress fix PHP?
Not necessarily. WordPress, plugins and PHP have separate updates. Ask your host about PHP even if WordPress is up to date.
Which PHP versions include the fixes?
PHP lists the fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older versions, newer versions we haven’t reviewed, and fixes supplied separately by your host need the host’s confirmation.
What if PHPCheck can’t give me an answer?
Ask your host to confirm which PHP security updates are installed. We won’t offer a paid report when we can’t confirm the PHP update information.
Technical details
The PHP project’s 21 October 2026 notice covers CVE-2026-109618 and CVE-2026-109619. PHP 8.1 and older no longer receive upstream releases; some vendors supply separate fixes. A higher patch number alone does not prove an unsupported release is fixed.
A version shown in a response header does not confirm installed fixes or whether a website has been hacked. Ask the host to check package provenance and all serving workers. A web application firewall does not prove that PHP was updated.