Recent PHP Vulnerabilities and How to Fix Them (WordPress Guide)

On October 21, 2026, the PHP team shipped an emergency security release. It fixed two critical flaws, now nicknamed PHP2Shell, that let an attacker run their own code on a web server without logging in. Attack attempts started within hours of the patch.

This matters to you because WordPress, your theme, Elementor and every plugin run on PHP. A site can be exposed even when all of its plugins are up to date, because the bug sits in PHP itself.

This post follows our PHP series, which covered how to update PHP safely, how to fix errors afterwards, and what is new in PHP 8.5. Today: what PHP2Shell is, which versions are fixed, and how to make sure your site is patched.

No coding knowledge needed. If you can open your hosting panel and your WordPress dashboard, you can follow along.

What is a PHP vulnerability, in plain words?

A vulnerability is a mistake in software that an attacker can abuse. Most WordPress security news is about a single plugin. A PHP vulnerability is different: it sits in the engine underneath, so it can affect every site on the server at once.

The fix is not a WordPress update. It is a new PHP patch release, the small number at the end of the version (for example 8.4.27). Your host installs it, or you select it in your hosting panel.

PHP2Shell explained: the two critical flaws

Both flaws are rated CVSS 9.2 (critical). They affect nearly every PHP version back to PHP 5.4, on any server setup that serves web pages: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team rates Apache mod_php as the highest risk.

• CVE-2026-109618: memory crash leads to code execution. When PHP runs out of memory at the wrong moment, it can be left holding half-built request data. The cleanup step then trusts that broken data, which an attacker can turn into running their own code.
• CVE-2026-109619: leftover data from an old request. Some internal data can outlive the request that created it. The next request on the same PHP worker may reuse it. This one is linked to PHP’s session upload progress feature.

Attackers may also be able to read memory from PHP workers. That memory can hold passwords, API keys, tokens and database details.

Timeline

The bugs were found by Wiz Research, Calif and OpenAI’s Codex Security team, working with the PHP security team.

Which PHP versions are fixed?

Your site is safe from PHP2Shell only if it runs one of these versions or newer:

For PHP 8.1, 8.0 and 7.4, the PHP team published source code patches but no new release. Some hosts and Linux distributions apply these patches quietly, so the version number may look old even when the fix is in. Ask your host to confirm in writing.

The bigger lesson: if you are on PHP 8.1 or older, this is the moment to upgrade. The next critical bug may not get a patch at all.

How to check if your WordPress site is patched

1. Log in to WordPress and go to Tools → Site Health → Info.
2. Open the Server section and read the PHP version, for example 8.4.27.
3. Compare it with the table above. The full number matters: 8.4.26 is vulnerable, 8.4.27 is fixed.
4. If you see an older number, check your host’s status page or ask support. Many hosts patched every PHP version on October 21.

How to fix it: step by step

1. Take a full backup of files and database, and confirm you can restore it.
2. Update PHP to the fixed patch release. On managed hosting this is often automatic. On cPanel or Plesk, pick the newest version in the PHP selector. On a VPS, update the PHP packages and restart PHP-FPM or Apache.
3. Restart PHP workers. The fix only takes effect once old PHP processes are gone. A host restart or a PHP-FPM restart handles this.
4. Check Site Health again to confirm the new version is live.
5. Test key pages: home, contact form, checkout, login, and a few pages in the Elementor editor.
6. On PHP 8.1 or older? Plan a move to PHP 8.4 or 8.5 now. Use our earlier guide to test on staging first.

Can’t update today? Temporary mitigations

These reduce the risk but do not remove it. Updating PHP is the only full fix. Ask your host or developer to apply them in php.ini or the PHP-FPM pool config (not in .user.ini):

• Set session.upload_progress.enabled=0, then restart all PHP workers. WordPress does not need this feature.
• On PHP 8.5, also set fatal_error_backtraces=0.
• Keep post_max_size as low as your site allows, and limit request size at the web server or firewall.
• Turn on a web application firewall. Cloudflare enabled PHP2Shell rules for all users on October 21.

After patching: one thing to watch

The fix adds a hard memory cap. If a heavy page or import hits it, PHP now stops the request at once. If you see new white screens or 500 errors, ask your host to review memory_limit. Elementor recommends 512 MB.

Signs someone tried to attack your site

• Many unusual upload (multipart) requests followed by memory errors
• Repeated HTTP 500 errors with no clear cause
• Very long PHPSESSID cookies in your access logs
• PHP workers restarting without explanation

If you see these, change your WordPress admin, database and API passwords after patching.

FAQ

Is my WordPress site affected by PHP2Shell? Treat it as affected until Site Health shows PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer, or your host confirms the patch. The bug is in PHP, so it does not matter which plugins you use.

Will updating WordPress or my plugins fix it? No. This is a PHP fix, not a WordPress one. Keep WordPress updated anyway, but the PHP patch release is what closes this hole.

I use Cloudflare. Am I safe? Cloudflare’s firewall rules block many known attack patterns, but attackers are already changing payloads to get around them. Patch PHP as well.

Will the patch break my site? It is a small patch release in the same branch, so breakage is rare. The main thing to watch is the new hard memory cap on heavy pages.

My host says I’m on PHP 8.1. What now? Ask whether they applied the PHP team’s source patch. Then plan a move to PHP 8.4 or 8.5, because PHP 8.1 gets no more official fixes.

Keep your stack lean after patching

A security scare is a good time to clean house. Remove plugins you no longer use, because every extra plugin is more code to keep updated. The free Bright Addons plugin gives you 40 Elementor widgets at no cost, and Pro adds 70+ more plus 10 extensions, from $16 a year. Setup guides live in our docs.

Conclusion

PHP2Shell is one of the most serious PHP bugs in years, and attacks started within hours. The fix is simple: check your PHP version in Site Health, make sure it is 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer, and restart PHP. If you are still on PHP 8.1 or older, use this as your reason to upgrade now.