On October 21, 2026, PHP released emergency security fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 (CVSS v4.0) and can potentially allow an attacker to execute code on a vulnerable PHP server without logging in.
The issues are being called PHP2Shell. They affect the PHP runtime itself, not a particular WordPress plugin, theme, or WordPress Core version.
That distinction matters: updating WordPress will not fix these vulnerabilities. The PHP software running on the hosting server needs to be patched.
Which PHP Versions Are Fixed?
The PHP project released these patched versions on October 21:
| PHP branch | Fixed version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
PHP 8.1 and older no longer receive official security releases from the PHP project. Some hosting companies offer their own backported security patches, so an older-looking version number is not necessarily proof that a host has failed to patch. Ask for confirmation of the installed security fix.
What Are WordPress Hosting Providers Doing?
Here is the status reported on October 21, 2026:
- Automattic — already protected. Automattic confirms that websites hosted on WordPress.com, WordPress VIP, WP Cloud, Pressable, and Tumblr are protected against PHP2Shell and that customers do not need to take action. Read Automattic's statement.
- WP Engine — PHP updates rolling out. WP Engine says it is deploying the patched PHP releases across its platforms. It has also already deployed protective measures at its Cloudflare and Fastly CDN layers. These are interim mitigations, not confirmation that every environment has finished updating. See WP Engine's status update.
- Kinsta — existing firewall protections; PHP patch status not independently confirmed. Kinsta documents Cloudflare enterprise firewall protection for its hosted sites and recently rolled out additional Patchstack-powered WordPress vulnerability protection. That WordPress-focused feature should not be confused with a PHP runtime patch. We could not verify an official Kinsta announcement confirming completion of the PHP2Shell-specific patch rollout as of publication. Customers should check directly with Kinsta. See Kinsta's security overview.
Separately, Cloudflare confirmed it deployed PHP2Shell-specific firewall protections for free and paid WAF customers ahead of the public disclosure. A firewall can reduce risk while updates are deployed, but the PHP project says there is no complete mitigation other than patching. Cloudflare's technical update.
What Should You Do Right Now?
If you run a WordPress or WooCommerce site:
- Check your PHP version in WordPress under Tools → Site Health → Info → Server.
- Check your host's advisory or status page. If you use managed hosting, ask whether your specific environment has received the PHP security fix or a vendor backport.
- Patch urgently if you manage PHP yourself. Do not assume a WordPress Core update or security plugin resolves a server-level PHP vulnerability.
- Test the site afterward, particularly login, forms, checkout, payments, and any custom integrations.
An unpatched site is at risk, but that does not mean it has necessarily been compromised.
Our WordPress security plugin comparison explains where application-level protection helps. This incident is a reminder that secure hosting and maintained PHP remain essential even when WordPress security tools are installed.
Bottom line: Check your hosting provider's PHP2Shell update status today. Firewall rules are helpful during rollout, but the PHP security update is what fixes the underlying vulnerabilities.
