Tech & Security

How to Fix PHP2Shell Vulnerability in WordPress Websites (Easy Guide)

By Abdullah · Published

If you run a WordPress website, you have probably seen the name “PHP2Shell” in the news this week. It is one of the most serious website security problems in years, and it cannot be fixed by updating WordPress or installing a security plugin. This guide explains what happened in plain language, how to check if your site is exposed, and exactly what to do about it, step by step.

The Short Answer

What Is PHP2Shell?

PHP2Shell is the nickname for two vulnerabilities in the core of PHP, tracked as CVE-2026-109618 and CVE-2026-109619. PHP’s own security team rated both 9.2 out of 10 on the CVSS v4.0 severity scale, which is “critical.”

In simple terms, an attacker can send a specially crafted request to a website and make the server run the attacker’s own commands, without needing a username or password. The word “shell” in the name refers to that: a hacker getting a command line on your server.

The researchers who found the flaws, including teams from Wiz, Calif and OpenAI, showed the attack working against a normal WordPress install. They also found that it can leak pieces of the server’s memory, which may contain things like passwords and access keys.

The PHP team released the fixes on October 21, 2026. Technical details leaked online a day earlier, on October 20, and security companies reported attack attempts starting before the fix was even available. Amazon’s security team reported seeing one attempt as early as October 17. These are reports of attempts, not proof that every attempt succeeded, but they show how quickly attackers moved.

Why Is Everyone Calling It “Black October”?

“Black October” is not an official name. It is a nickname that spread on social media after PHP2Shell landed in the same days as several other unrelated security incidents, including a critical flaw in GitLab, a poisoned release of an AI software library, and breaches at some hosting platforms.

One thing worth knowing: security analysts point out that these incidents are not one single coordinated attack. PHP2Shell is the one that matters most to website owners, because PHP powers a huge share of the web (estimates say nearly 70 percent of websites).

Why WordPress Sites Are Affected

Every time someone visits a WordPress site, PHP runs first, and only then does it load WordPress and your plugins. PHP2Shell sits in that first layer. This has two important consequences:

Only a PHP update on the server fixes the root problem.

Is Your Site Affected? Check Your PHP Version

You can see your PHP version from inside WordPress:

  1. Log in to your WordPress dashboard.
  2. Go to Tools, then Site Health.
  3. Open the Info tab and click the Server section.
  4. Look for the line called PHP version.

Then compare it with this table:

Your PHP branch Safe from version
8.5 8.5.12
8.4 8.4.27
8.3 8.3.36
8.2 8.2.35
8.1 and older No official fix from PHP. Only safe if your host or server vendor added the fix. You should upgrade anyway.

A warning before you panic: a lower-looking number does not always mean you are unprotected. Some hosts and Linux systems add the security fix without changing the version number. For example, Hostinger said its servers were fixed even though sites may still show an older-looking number like 8.5.11, and Ubuntu’s fixed package for version 24.04 still reports 8.3.6. This is why you must ask your host directly rather than trusting the number alone.

Step-by-Step: How to Fix It

Step 1: Make a Backup

Before changing anything, take a full backup of your files and your database, and store a copy somewhere outside your server (your computer or cloud storage). If something breaks later, you can restore it.

Step 2: Ask Your Hosting Company

On shared hosting and managed WordPress hosting, the host controls PHP at the server level, so they have to install the fix. Send them a short message like this:

“Hi, my site runs PHP [your version]. Has the fix for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) been installed on my server? If not, when will it be? Thank you!”

Keep asking until you get a clear answer. A reply like “we added firewall protection” is good, but it is not the same as “PHP has been updated.” You want the second one.

Several big hosts announced that they had already patched their platforms by October 22 to 24, including Cloudways, DreamHost, Flywheel, Hostinger, Kinsta, Namecheap, OVHcloud, WP Engine and others. SiteGround said it applied server-level protection and turned off the affected PHP features. If you cannot find your host’s announcement, contact their support.

Step 3: Switch to a Supported PHP Version in cPanel

If you are on cPanel hosting, you can usually choose your PHP version yourself:

  1. Log in to cPanel.
  2. Find and open MultiPHP Manager.
  3. Tick the box next to your domain name.
  4. Pick a current PHP version from the dropdown. PHP 8.3 or 8.4 is a safe choice for most WordPress sites.
  5. Click Apply.
  6. Open your website and click through the important pages (home page, contact form, checkout if you have a shop) to make sure everything still works.

Important detail many guides skip: the cPanel version menu only switches between versions that are already installed on the server. It does not download the security fix by itself. Switching to a newer branch is still the right move, especially if you are on PHP 8.1 or older, but you must still confirm with your host that their installed build contains the PHP2Shell fix.

If your site breaks after the switch, the cause is almost always an old plugin or theme that does not support the newer PHP version. Update or replace that plugin, or switch back temporarily and ask your host for a patched build of your old version while you fix the plugin.

Want the full walkthrough for cPanel, Hostinger, Bluehost and DreamHost? Read our guide on how to update PHP in WordPress without breaking your site.

Step 4: If You Manage Your Own Server (VPS, Dedicated or Docker)

If you rent a virtual or dedicated server, the update is your responsibility:

GoDaddy, Namecheap and others have noted that customers with their own VPS or dedicated server need to apply the update themselves.

Step 5: Confirm the Fix

After your host says it is done, recheck Tools, Site Health, Info, Server in WordPress and write down the PHP version. If you are still unsure, ask your host to confirm in writing that your account runs a patched build.

What If You Cannot Update PHP Today?

Sometimes your host is slow or your old plugins block an upgrade. These options buy you time, but none of them replaces the real fix:

If your host will not give you a date for the fix, it may be a good time to consider moving to a better host.

How to Check If Your Site Was Already Hacked

Updating PHP closes the door, but it does not remove someone who already got in. Because attempts started days before the fix, it is smart to look at activity from around mid-October onward. Most hacks are quiet, so do a five-minute check:

What to Do If You Find Something Suspicious

  1. Do not panic, and do not try to clean everything by yourself if you are not sure what you are looking at.
  2. Contact your host and ask them to scan the server and restore a backup from before the problem appeared.
  3. Change all your passwords: WordPress admin, hosting account, FTP, and database.
  4. Delete unknown admin users and unknown plugins.
  5. Because PHP2Shell can expose server memory, security experts also recommend rotating any API keys, payment gateway keys and email (SMTP) passwords your site uses, and regenerating the security keys (salts) in your wp-config.php file.
  6. If you run a shop or collect customer data, consider getting professional help, because you may have legal duties to report a data exposure.

Frequently Asked Questions

Is PHP2Shell a WordPress bug?

No. It is a flaw in PHP itself. WordPress is affected only because it runs on PHP. The same flaws also affect other PHP-based systems such as Drupal, Joomla and Magento.

Will a WordPress update fix it?

No. There is no WordPress update for this. The fix has to be installed on the server by whoever runs it, usually your hosting company.

Will my security plugin protect me?

No. The attack happens before WordPress and its plugins load, so security plugins never see it. A firewall in front of your server, such as Cloudflare, can help, but a plugin cannot.

Do I need to take my website offline?

Usually not. If your host confirms the fix or temporary protection is in place, you can keep your site running and monitor it. Taking a site offline makes sense mainly if you run your own server and cannot patch it at all.

I am on WordPress.com or another fully managed service. Do I need to do anything?

The company that runs the platform updates PHP for you. You can still do the five-minute check above for signs of a hack.

My site is on PHP 7.4 or 8.1. What now?

Ask your host first. Some hosts and control panels, including cPanel, released patched builds for older versions. That only buys you time. Plan an upgrade to PHP 8.3 or 8.4, starting with updating or replacing any plugins that hold you back.

Why was it so urgent?

Because details leaked before the fix was ready and attackers began trying the exploit right away. Many governments and companies even took websites offline temporarily while they installed the patch. The time between a bug being made public and being attacked is now measured in hours, so quick action matters.

Quick Checklist

Final Thoughts

PHP2Shell is a good reminder that website security does not stop at WordPress. This time the weak point was the layer underneath it, and the solution came from the server, not from a plugin. The good news is that fixes are already available, and most big hosts have rolled them out. Take ten minutes today to confirm yours has.

This guide is general information, not professional security advice. Hosting setups differ, so follow your host’s instructions where they differ from the steps above. Hosting status and official guidance change quickly, so check your host’s status page for the latest.

Sources