PHP2Shell: Is Your WordPress Site Safe? How to Fix It, and How WebHivez Builds Sites That Stay Secure

Quick answer: PHP2Shell is the name for two critical vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619), patched on October 21, 2026. Researchers say every PHP version from 5.4 onward is affected, and they demonstrated attacks without any login against default WordPress, Drupal, Joomla and Magento installs. If your website runs on PHP, it is not safe until the server is on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your host’s patched equivalent) and PHP has been restarted. Updating WordPress, your theme or your plugins does not fix this.

If you are a business owner, the most useful thing you can do today is spend five minutes confirming who controls your PHP version and whether it has been patched. This guide shows you how, explains what to fix first, and then shows how we at WebHivez handle this on the WordPress and custom websites we build and look after.

Not sure where to start? Request a free PHP2Shell security check and we will tell you whether your site is exposed and what to do about it.

Why this one is different from a normal WordPress security alert

Most WordPress security warnings are about a single plugin. You update the plugin, and you are done. PHP2Shell sits one layer lower, in the PHP engine that runs WordPress, WooCommerce, page builders and custom code alike.

That means three things for your business:

• Your WordPress dashboard can show “everything up to date” while your site is still vulnerable. The fix happens on the server, not inside WordPress.
• Custom-built PHP sites are affected too. Laravel apps, client portals, booking systems and older hand-coded sites all run on the same engine. Wiz Research said even a basic “Hello World” PHP page could be vulnerable on an affected version.
• Attackers do not need a login. According to the PHP Foundation, on Apache with mod_php the attack can trigger before any of your website’s code runs. Researchers also showed they could read server memory, which can hold database passwords and API keys.

The flaws were found by security firms Calif and Wiz and by OpenAI, using frontier AI models. Details leaked a day early, which is why you may have seen government and corporate sites go offline on October 21 and 22 while they patched. Security vendors including watchTowr and Amazon reported exploitation attempts within hours of the release, while CISA said it had not yet observed exploitation at the time of its alert. Either way, waiting is the riskiest option.

Step 1: Find out who controls your PHP version

This is the question that decides everything else. Your PHP version is controlled by one of three people:

To see your current version in WordPress, go to Tools → Site Health → Info → Server. In cPanel, look for “Select PHP Version” or “MultiPHP Manager.”

Step 2: Fix it, in this order

1. Get onto a patched PHP version. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. On Ubuntu or Debian servers, the fix may arrive as a patched package with an older-looking version number, so check your distribution’s security advisory rather than the version string alone.
2. Restart PHP. PHP-FPM and Apache workers keep running the old, vulnerable code until they restart. This is the step people forget most often.
3. Move off PHP 8.1 and older. These versions are end-of-life. The PHP team released limited source backports for 7.4, 8.0 and 8.1 as an exception, but most hosts will not package them. Test on a staging copy first, because old themes and plugins sometimes break on PHP 8.2+.
4. Put a firewall in front of the site. Cloudflare says its free and paid WAF customers were protected by default against PHP2Shell from early October 21. This buys time, but PHP is clear that only updating is a complete fix.
5. Rotate your secrets if you were exposed. If your site sat on a vulnerable public server after October 20, change your database password, WordPress salts, payment gateway keys, SMTP and API tokens. Patching stops future leaks; it does not undo past ones.
6. Check for signs of compromise. Look for new admin users, unfamiliar PHP files in wp-content/uploads, unexpected scheduled tasks, and spikes of PHP fatal or out-of-memory errors in your logs from October 20 onward.
7. Don’t forget forgotten sites. Staging copies, old landing pages, microsites and a developer’s test subdomain all count. Attackers scan for them first.

If you cannot patch quickly, CISA and Germany’s BSI both advise taking the vulnerable system offline until you can.

What most businesses get wrong after an alert like this

“Our developer built it, so it’s secure.” A website is secure on launch day only. Security depends on what happens every month afterwards: who updates PHP, who watches advisories, and who gets the call when something like PHP2Shell drops at night.

“We have a security plugin.” Security plugins run inside WordPress, which runs on PHP. They cannot protect the engine underneath them. A plugin like Wordfence is useful, but it is not a substitute for a patched server.

“Our host handles everything.” Sometimes true, often not. Many hosting plans patch the PHP builds but leave the version choice to you. If your site is still set to PHP 7.4 because an old plugin needed it in 2021, you are on an end-of-life version.

“We’ll deal with it next sprint.” For a critical bug with public exploit code, the window between disclosure and mass scanning is measured in hours. A previous critical PHP flaw, CVE-2024-4577, drew exploit attempts within a day.

How WebHivez builds WordPress and custom websites that stay secure

We have built and maintained websites for clients across the US, UK, Canada and the UAE since 2017. The honest truth is that no agency can promise a website that is “unhackable” forever, and you should be wary of anyone who does. PHP2Shell proves it: a bug that sat in PHP for over a decade affected sites that were built well. What we can promise is a site that is secure by default, built so that when the next PHP2Shell arrives, the fix takes minutes, not a week of panic.

Here is the process we use on every WordPress development and custom website development project.

1. The right hosting and PHP version from day one

We launch on a currently supported PHP version and recommend hosting that applies security patches quickly and lets us restart PHP on demand. We document exactly who controls the PHP version, so there is never confusion during an incident like this one.

2. Lean builds with fewer moving parts

Every plugin is extra code that can break or be attacked. We build with a small, well-maintained stack (Elementor Pro, Kadence or ACF where they fit) and write custom functionality in clean theme or plugin code instead of stacking a dozen plugins to do one job.

3. Secure coding on every custom feature

Custom forms, booking flows and portals are where most real-world breaches start. Our custom PHP follows WordPress and OWASP practices: prepared database queries, input validation and output escaping, nonces on every form, capability checks on every admin action, and no secrets stored in code or in the database in plain text.

4. Hardening before launch

Before a site goes live we lock down file permissions, disable file editing from the dashboard, block PHP execution in the uploads folder, enforce HTTPS and security headers, limit login attempts, and give every user the lowest role they need. These steps would not have stopped PHP2Shell on their own, but they limit what an attacker can do if anything gets through.

5. A firewall layer in front of the site

We set up a web application firewall, usually Cloudflare, so that when a new vulnerability is disclosed, virtual patching can block known attack patterns while the real fix is applied.

6. Staging, backups and a tested update path

Every site we maintain has a staging copy and automated off-site backups. That is what makes urgent updates safe: we test a PHP upgrade on staging, then apply it to production without guessing whether something will break.

7. Monitoring and fast response

For clients on ongoing support, we watch PHP, WordPress and plugin security advisories, monitor uptime, and act on critical issues the same day. When PHP2Shell was disclosed, our job was to confirm patch status, restart PHP and check for signs of compromise, not to start from zero.

8. Clear handover

At handoff, you get the details that matter in an emergency: where the site is hosted, who controls PHP, where backups live, and who to call. If you ever move to another team, they can pick up where we left off.

Already have a website someone else built?

Most of the sites we are asked to fix were not built badly. They were simply left alone: an old PHP version kept for one plugin, a staging copy nobody remembers, no backups, and no one watching advisories. That is fixable without a full rebuild.

A typical WebHivez security cleanup covers:

• Confirming your PHP version and patch status, and upgrading safely through staging
• Replacing or removing plugins that block a PHP upgrade
• Scanning for malware, rogue admin users and injected files
• Hardening, firewall setup and off-site backups
• Rotating database, API and payment keys where exposure is possible

If the site needs a bigger refresh while we are at it, our migration checklist for redesigning without losing rankings explains how we protect your SEO during the move.

WordPress or custom build: which is safer?

Neither is automatically safer, and PHP2Shell shows why. Both WordPress and most custom-built PHP sites ran on the same vulnerable engine. What makes a site secure is how it is built and maintained: supported versions, minimal code you don’t control, secure coding, and someone responsible for updates. If you are deciding between platforms for a new build, our comparison of WordPress vs Webflow covers the trade-offs, including who handles server-level security on each.

For what’s changing in WordPress itself, see our breakdown of WordPress 7.2 and what it means for agency sites.

Get a free PHP2Shell security check

If you are not 100% sure your website has been patched, let us check it for you. Send us your website address and we will confirm:

• Which PHP version your site is running and whether it is patched against PHP2Shell
• Who controls the update (you, your host or your developer)
• Any obvious warning signs of compromise or end-of-life software
• The fastest safe fix for your setup

Request your free security check → or talk to the WebHivez team about a secure new WordPress or custom website. You can also browse our portfolio of 500+ projects across 25+ industries.

Frequently Asked Questions

Is a WordPress website safe?

WordPress itself is reasonably secure when it is kept updated and built properly. Most hacks come from outdated plugins, weak passwords or poor hosting, not from WordPress core. But PHP2Shell shows that no site is 100% safe, because the flaw sits in PHP underneath WordPress. Your site is only safe if PHP is patched and restarted too.

What is PHP in cyber security?

PHP is the server-side language that runs WordPress and millions of other websites. It matters in security because insecure PHP code can let attackers in, and bugs in PHP itself can expose every site running on it. That is why keeping PHP supported and patched is a core security task.

What is PHP2Shell?

PHP2Shell is the name for two critical vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619), patched on October 21, 2026. They affect PHP versions from 5.4 onward and can be attacked without any login. The fix is a server-side PHP update and restart, not a WordPress or plugin update.

Why is my WordPress website getting hacked?

Usually because of outdated PHP, themes or plugins, weak passwords, poor hosting or forgotten old copies of the site. Nulled plugins and insecure custom code are also common causes. Server-level flaws like PHP2Shell can hit even well-built sites, so keeping the whole stack updated matters.

How do I protect my WordPress site from hackers?

Start by confirming your PHP version is patched and restarted, then keep WordPress, themes and plugins updated and delete the ones you don’t use. Add a firewall like Cloudflare, use strong passwords with login limits, and keep off-site backups. If you are not sure where your site stands, the WebHiveZ team can check it for you with a free security check.