A critical PHP vulnerability is putting most WordPress sites at risk. On October 21, 2026, the PHP project released urgent security updates for two critical flaws, CVE-2026-109618 and CVE-2026-109619, known as “php2shell”. Both are rated 9.2 out of 10 for severity. They allow attackers to run malicious code on a server without logging in.
Because the threat is serious, some public institutions in Europe took their websites offline as a precaution until the fix was available.
What this PHP vulnerability means for your website?
The problem is in PHP, the language WordPress runs on. It is not in WordPress, your theme, or your plugins.
That’s why updating WordPress and plugins won’t fix it. WordPress and every plugin run on top of PHP, so if PHP is vulnerable, a fully updated WordPress site is still exposed. PHP has to be updated on the server.
According to the PHP project, every website running on PHP is at risk until it’s updated. That includes most WordPress and WooCommerce sites, regardless of how the server is set up.
The fixed versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Most hosting providers and Linux distributions received the fixes in advance, so many servers are being updated already. That doesn’t mean yours is, so it’s worth checking.
If your site runs PHP 8.1 or older, the PHP project no longer provides official updates. Some hosting providers offer their own fixes for older versions, but the safest long-term option is upgrading to a supported PHP version.
Why this PHP vulnerability is more serious than usual?
Most security issues affect a single plugin or theme, and only sites using it are at risk. This one is different. Because the PHP vulnerability sits in the language itself, it affects almost every site running on PHP at the same time. The PHP team has also confirmed that, on some server setups, an attack can work with a single request before the website’s own code even runs. That’s why acting quickly matters.
What to do now?
- Check your PHP version. In WordPress, go to Tools > Site Health > Info > Server. Your hosting control panel shows it too.
- Check with your hosting provider. Confirm the update has been applied, or whether you need to do it yourself. On managed hosting, this is usually handled for you. On a self-managed server, it’s not.
- Test your site after the update. Check forms, checkout, logins and anything else your business depends on. Bigger version jumps, especially from older PHP versions, can break outdated plugins.
If an update isn’t possible right away, your developer or host can apply temporary server-level protections. They lower the risk, but they’re not a fix. Only updating PHP fully solves the problem.
Don’t wait for the next emergency
Security alerts like this one are part of running a website. What matters is whether someone is already taking care of your site when they happen.
With a Santos Digital maintenance plan, that’s us. We keep WordPress, plugins and your server environment up to date, coordinate with your hosting provider, and test your site after every important update, so security fixes don’t turn into broken forms or a checkout that stops working.
Get your website on a maintenance plan ›
FAQ
Will updating WordPress protect my site?
No. The vulnerability is in PHP, so it has to be fixed on the server.
How do I know if my site is affected?
If your site runs on PHP and hasn’t been updated to one of the fixed versions, it’s at risk. Check your version under Tools > Site Health.
My site runs an older PHP version. What now?
Ask your hosting provider whether they offer a fix for your version. Plan an upgrade to PHP 8.2 or newer, and test it on a staging copy of your site first.
Who should apply the update?
Usually your hosting provider, or your developer or agency if you manage your own server.
