On October 21, 2026, the PHP project shipped emergency security releases that fix two critical vulnerabilities letting an attacker run code on a web server without logging in. WordPress runs on PHP, so even if WordPress core and every plugin are up to date, your site is still exposed until the PHP on the server is updated. The action is simple: make sure your site runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, depending on which branch you use. If you manage your own server, update today. If you're on shared hosting or someone else maintains the site, ask your host or developer whether it's done.
What happened
On October 21, PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 together, fixing CVE-2026-109618 and CVE-2026-109619, a pair of flaws the security community is calling PHP2Shell. PHP rates both at 9.2 out of 10. The bugs sit in the core code PHP uses to handle web requests, not in any plugin or theme. The official announcement is blunt: there are no complete mitigations, and updating is the only safe choice.
The fixes also came out earlier than planned. According to The Hacker News, details leaked online on October 20; PHP posted an advance notice that evening and moved the release up to the 21st, and the report's headline notes that exploit attempts have emerged. The Dutch National Cyber Security Centre (NCSC-NL) keeps a GitHub page tracking which vendors have shipped patches, which is useful if you need to check a specific product.
Who is affected
PHP says every installation that serves web requests is at risk, with Apache running mod_php the most exposed. That covers WordPress, WooCommerce stores and any PHP-based membership system, whether the web server is Apache, Nginx or LiteSpeed.
Workarounds circulating online, such as turning off session.upload_progress, only relate to one of the two attack paths and do nothing for the other. They are not a substitute for updating.
Sites still on PHP 8.1 or older need extra attention: those versions are no longer supported, there is no patched release for them, and the only fix is moving to 8.2 or later.
| Your PHP branch | Update to |
|---|---|
| 8.5 | 8.5.12 or later |
| 8.4 | 8.4.27 or later |
| 8.3 | 8.3.36 or later |
| 8.2 | 8.2.35 or later |
| 8.1 or older | No patched release. Move to 8.2 or later; back up first and confirm your theme and plugins support the new version. |
Check which PHP version your site runs
You don't need server access. In the WordPress dashboard, go to Tools → Site Health, open the Info tab and expand the Server section. It shows the PHP version the site is actually using, down to the last digit, such as 8.3.36. Hosting control panels often show only the branch, like 8.3 or 8.4, which doesn't tell you whether the patched build is installed.
If PHP was installed from Linux distribution packages such as Ubuntu or Debian, PHP says the distributions received the fixes early. Follow your distribution's security notice and go by the package version it lists.
What to do in your situation
You run your own VPS or cloud server
Update today. If you use distribution packages, update the PHP packages as your distribution's notice describes; if you built from source or use another package source, move to the versions in the table above. Then restart the PHP process manager or the web server. If old worker processes keep running, the site is still on the old version. If you run WordPress in Docker, rebuild the container from an updated image; restarting the container alone won't replace the PHP inside it. Finally, go back to Site Health and confirm the version number changed.
You're on shared hosting
Your host is responsible for updating PHP. The selector in your control panel usually picks only the branch, such as 8.3 or 8.4; the exact build is whatever the host installed. The quickest step is to ask your host directly whether PHP has been updated to the October 21 releases, and to check the version in Site Health at the same time. If the host doesn't answer or keeps putting it off, it's time to think seriously about moving.
A developer or agency maintains your site
Send them the version table above and ask them to report which PHP version your site runs. Some maintenance arrangements cover only WordPress and plugin updates and leave the server layer to no one, so this is a good moment to find out who is responsible.
If you'd rather not track PHP updates yourself
This incident is a reminder that a WordPress site depends on more than WordPress and its plugins; the PHP and server underneath need someone keeping them current too. If you don't have a developer and don't want to follow security notices yourself, a fully managed setup is worth considering. WP × Roamer AI is RoamerHost's fully managed WordPress service: no server to manage, automatic WordPress updates and automatic backups, with the latest WordPress installed automatically about 60 seconds after payment. The entry plan works out to NT$299 a month, billed annually. WP × Roamer AI Advanced, which lets AI build pages, change layouts and update plugins for you, works out to NT$999 a month, billed annually. See the WP × Roamer AI plans.
If you're already a RoamerHost member, you can use the Site Health steps above to see which PHP version your site runs.
WordPress itself also had security releases in October; 7.1.3 and the plugins under active attack are covered in WordPress security updates for October. If you're worried an update will break your site, read how to update plugins without breaking your site. If you suspect the site has already been compromised, start with emergency steps when your WordPress site breaks.
Frequently asked questions
WordPress is already on the latest version. Do I still need to care about PHP?
Yes. These flaws are in PHP itself, not in WordPress or any plugin, so updating WordPress to 7.1.3 doesn't protect you. What matters is whether the PHP on your server has been moved to a patched release.
Will updating PHP break my site?
A patch release within the same branch, such as moving to 8.3.36 within the 8.3 series, is mostly fixes and normally doesn't require theme or plugin changes. Moving across branches, for example from 8.1 to 8.3, is where you need care: back up first and confirm that your theme and main plugins support the new version.
How do I tell whether my site has already been attacked?
Common signs are administrator accounts you don't recognise, PHP files in the uploads folder, and visitors being redirected to strange addresses. If you spot something suspicious, back up the current state, change every administrator password, and have your host or a developer investigate. Updating PHP closes the hole, but it won't remove a backdoor that's already been planted.
Sources
- PHP news archive (2026)
- PHP 8.4.27 release announcement
- PHP 8.3.36 release announcement
- php-src: PHP 8.5.12 release notes
- The Hacker News: PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge
- Search Engine Journal: Critical PHP Core Vulnerabilities Affect Websites, Including WordPress
- NCSC-NL: php2shell patch status tracker
WordPress
