Skip to content

Menu

WorkServicesClaude CodeHostingAboutContactConsulting (hourly) Start a project

> security alert ·

PHP2Shell: the WordPress fix is a server update.

A critical flaw in PHP, disclosed October 21, 2026, lets anyone take over a server with a single web request. Most WordPress sites run on PHP, and updating WordPress won't fix it. We'll check yours for free and tell you what we see and what to do next.
Get a free exposure check Check it yourself
// 01 — what happened

One request, no login.

Disclosed
CVE
CVE-2026-109618 · CVE-2026-109619
Severity
CVSS v4 9.2 (critical)
  • The bugs are in PHP itself, the language WordPress, Drupal and Joomla run on. One crafted web request, with no login, runs the attacker’s code on the server.
  • Every PHP version since 5 is affected.
  • It was exploited in the wild before the patches shipped.
  • Updating WordPress, plugins or themes does not fix it. The server’s PHP has to be upgraded.

Plain-language write-up:BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws

// 02 — are you exposed?

Find your PHP version in 30 seconds.

  1. Log in to your WordPress admin.
  2. Go to Tools → Site Health.
  3. Open the Info tab, then Server.
  4. Read the line called PHP version.

Fixed releases

  • 8.5.12 or later
  • 8.4.27 or later
  • 8.3.36 or later
  • 8.2.35 or later

PHP 8.1 and older get no official fixed release. Some hosts and Linux distributions backport the fix without changing the version number.

The number can mislead: some hosts backport the fix into an older PHP without changing the version number. That's why we check rather than guess.

Patched isn't the same as clean: a site attacked before the fix can still hold a backdoor. Turning off session.upload_progress is only a partial stopgap.

// 03 — how we fix it

Four situations, one free check first.

The exposure check is free. It tells us which of these you're in, and you get a fixed quote before any work starts.

  • Your host already patched

    We confirm the fix is really in place, then scan the site for backdoors left by an attack before the patch landed.

    $99Fixed quote after the free check

  • Stuck on old PHP

    A plugin or theme breaks on a newer PHP, so the site never got upgraded. We upgrade PHP and fix whatever breaks.

    From $199Fixed quote after the free check

  • Your own server or VPS

    Nobody patches it but you. We apply the fixed PHP release, put the stopgap in place while we work, and verify the result.

    From $199Fixed quote after the free check

  • Already hacked

    Strange redirects, new admin users, spam pages or a host warning. We clean it up, close the way in and patch PHP.

    From $299Fixed quote after the free check

Or let us host it and never think about this again.

// 04 — free exposure check

Tell us the site. We'll look.

A person reviews your setup, not an automated scan from outside, because an outside scan can't prove what PHP your server is really running. You'll hear back with what we found and, if it needs work, a fixed quote.

Tools → Site Health → Info → Server.

A person does the check, not a scanner. We don't share your email and we don't run a newsletter.