Last updated October 22, 2026. We will revise this post as agencies and developers publish new guidance.
On October 21, 2026, the National Security Agency issued an advisory urging organizations to patch two critical flaws in PHP, the programming language every WordPress site runs on. The flaws carry the nickname PHP2Shell. The PHP project released fixes the same day, and CISA told organizations to update immediately.
If you own a WordPress website, start by finding out which PHP version it uses. It takes about a minute.
The short version
- In WordPress, go to Tools > Site Health > Info > Server. Your PHP version is listed there.
- The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything newer on the same branch is also fixed.
- PHP 8.1 and older will not receive an official fix. Plan an upgrade now.
- Updating WordPress, your theme or your plugins will not fix PHP2Shell. The update has to happen on the server.
[Infographic: PHP version check]
What is PHP2Shell?
PHP2Shell is the nickname for two vulnerabilities in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. CERT-EU lists both with a CVSS score of 9.2 out of 10, which places them in the critical range.
The NSA’s advisory says the flaws could let an attacker take control of a web server without a password or any prior access. From there, an attacker could steal data or move deeper into a network. The agency expects attackers to weaponize the flaws, and the SANS Internet Storm Center reported that exploit code was public before the patch shipped.
Is your WordPress site affected?
Most likely, yes, until its PHP is updated. The weakness sits in PHP, the layer underneath WordPress, so your theme and plugins make no difference here. WordPress.org confirmed that no WordPress update is required or planned for these issues.
Your hosting company controls PHP on most WordPress sites. On shared or managed hosting, the host installs the fix. On a server you or your developer manage yourselves, such as a VPS or cloud server, nobody else will patch it for you.
How to check your PHP version in WordPress
- Log in to your WordPress dashboard with an administrator account.
- Go to Tools > Site Health.
- Click the Info tab.
- Open the Server section.
- Find the line labeled PHP version.
Write down the full number, including the last digits. A site on 8.3.36 is fixed. A site on 8.3.30 needs attention.
Can’t log in, or don’t see the Site Health menu? Your hosting control panel usually shows the PHP version too. Our step-by-step guide to checking your WordPress PHP version covers every method.
What your PHP version means
| PHP branch | Fixed in | Notes |
|---|---|---|
| 8.5 | 8.5.12 | Supported with security fixes through 2029 |
| 8.4 | 8.4.27 | Supported with security fixes through 2028 |
| 8.3 | 8.3.36 | The minimum version WordPress recommends |
| 8.2 | 8.2.35 | Security support ends December 31, 2026 |
| 8.1 or older | No official fix | End of life. Upgrade to 8.3 or newer. |
Fixed versions come from PHP’s 8.5.12 release notes and the CISA alert. Support dates come from php.net.
When the number looks old
Some hosts and Linux distributions apply security fixes to the version they already run. In that case, Site Health can show an older number on a server that is patched. If your number looks out of date, ask your host to confirm the fix in writing before you assume the worst.
What to do next
On shared or managed hosting
Contact your host today. Ask whether your server has the PHP2Shell fix and get the answer in writing. You can copy the message below.
On a server you manage
Your developer or IT team needs to install the fixed PHP release and restart PHP so the new version loads. The NSA advises organizations that cannot update right away to take the system offline until it is fully mitigated. WordPress.org gives the same advice to site owners who manage their own hosting and run PHP older than 8.2.
On PHP 8.1 or older
The PHP project stopped supporting these versions, and WordPress.org notes that versions before 8.2 no longer receive security updates. Moving to PHP 8.3 or newer is the safe path. WordPress recommends PHP 8.3 or greater, and most current plugins run well on it. Back up your site before you switch, and follow the update steps in our PHP version guide.
A message you can send your host
Hello. I’m checking my website after the PHP2Shell security advisory (CVE-2026-109618 and CVE-2026-109619). Please confirm in writing that the server for [your domain] runs PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer, or has received an equivalent security patch. If my site uses PHP 8.1 or older, what are my upgrade options? Thank you.
Watch for warning signs
If your site ran on an unpatched version, keep an eye out for trouble over the next few weeks. The NSA asks organizations to stay alert to anything internet-facing that relies on PHP.
- Administrator accounts you don’t recognize under Users
- Pages, links or redirects nobody on your team created
- Security alerts from your host or a security plugin
- A sudden drop in site speed or search traffic
If something looks wrong, WordPress.org keeps a guide for hacked sites. A professional cleanup is the safer route for most businesses.
North Public clients
If North Public maintains your website, you’re covered. There is nothing you need to do.
Not sure where your site stands?
North Public is a web design and development studio in Marietta, Georgia, working with organizations of every size. Request a free site review. We’ll check what’s visible from the outside, such as your WordPress version, plugins and signs of who hosts your site, and tell you exactly what to ask your host.
Frequently asked questions
Does updating WordPress fix PHP2Shell?
No. The vulnerabilities are in PHP, the software your server uses to run WordPress. WordPress.org confirmed that no WordPress update is required. The fix is a PHP update on the server.
Should I take my website offline?
The NSA recommends taking a system offline only if an immediate update is not feasible. For most sites on shared or managed hosting, the host handles the update. If you manage your own server and can’t patch today, talk with your developer about taking the site offline until you can.
Does Cloudflare protect my site?
Cloudflare deployed firewall rules for the known exploit methods, according to Help Net Security. That helps, but PHP’s release notes state that updating is the only safe choice. Treat firewall rules as a stopgap.
What PHP version should a WordPress site use?
WordPress.org recommends PHP 8.3 or greater. PHP 8.4 and 8.5 are also supported and receive security fixes for longer.
How do I know if my host has applied the fix?
Check your version in Site Health and compare it with the table above. If the number is older, ask your host to confirm in writing that the PHP2Shell patch is installed.
Sources
- NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities, National Security Agency, October 21, 2026
- Critical Vulnerabilities in PHP Require Immediate Patching, CISA, October 21, 2026
- PHP security release announcement, PHP.net, October 21, 2026
- Critical PHP Security Release, WordPress.org, October 21, 2026
- Security Advisory 2026-018, CERT-EU
- Supported Versions, PHP.net
- Requirements, WordPress.org
