What happened
On 21 October 2026, the PHP project released urgent fixes for two critical security flaws in PHP itself, nicknamed "php2shell" (CVE-2026-109618 and CVE-2026-109619). PHP is the programming language that runs behind WordPress and many other websites.
The flaws could let an attacker run commands on a web server without logging in. The PHP project rated both 9.2 out of 10 for severity. The UK's National Cyber Security Centre (NCSC) issued an alert the same day, advising organisations using PHP to update.
Is it still a concern?
Yes, if your website hasn't been updated. Security firm watchTowr reported attacks on its monitoring systems from 21 October, and one report says the US cyber security agency CISA added CVE-2026-109618 to its list of flaws known to be exploited on 26 October.
That doesn't mean your site has been attacked. It does mean this is worth checking today rather than leaving for later.
Updating WordPress isn't enough
The flaws are in PHP, not in WordPress or its plugins. Your site can be fully up to date in WordPress and still run on a PHP version without the fix. The update has to be made on the server, usually by your hosting company or web developer.
Which PHP versions are fixed?
| Your PHP version | What to do |
|---|---|
| 8.5 | Update to 8.5.12 or later |
| 8.4 | Update to 8.4.27 or later |
| 8.3 | Update to 8.3.36 or later |
| 8.2 | Update to 8.2.35 or later, and plan a move as support ends on 31 December 2026 |
| 8.1, 8.0 or 7.4 | No official PHP release. Move to a supported version, or use a patched package from your server or hosting provider |
| 7.3 or older | Reported as affected with no fix. Move to a supported version |
The PHP project says no settings change fully protects a site. Updating is the only complete fix.
What to do now
- Find your PHP version. In WordPress, go to Tools, then Site Health, then Info, then Server. Otherwise, check your hosting control panel or ask your host.
- Ask your host or developer one direct question: "Has our site's PHP been updated with the 21 October fixes, and have the PHP processes been restarted?" The restart matters, because the old version keeps running until then.
- If you can't update yet, ask about the temporary measures published by the PHP team. The NCSC advises considering taking a system offline until it can be updated or protected.
- If your site went unpatched for a while, ask your host or developer to check for anything unexpected, such as unfamiliar admin accounts or changed files, and make sure you have a recent backup.
One more item to watch
On 23 October the PHP project published a further notice about a related issue in a feature called session upload progress (CVE-2026-115560). It suggested turning that feature off until its next bug-fix release. Your host or developer can do this, and it's worth asking about at the same time.
How SMART5 can help
SMART5 can check your website's PHP version and apply the fixes, or move your site to a current, supported version. We can also keep WordPress, themes and plugins updated with testing, or replace the site with a bespoke website that runs no PHP on the server, leaving far fewer parts that need security patches.
This article reflects information available on 4 November 2026.