Is updating WordPress enough to stop PHP2Shell?

You saw the headlines about PHP2Shell. You logged in to WordPress, found a pile of pending updates, and clicked every one of them. Core, themes, plugins, all green. Are you safe now?

No. Updating WordPress does not fix PHP2Shell. That is the single most important thing to know this week, and plenty of site owners are still treating the flaw as a plugin problem.

This post explains why a WordPress update cannot reach it, who can fix it, and the questions to put to your host. If you want the full background first, read our PHP2Shell explainer.

Why a WordPress update cannot fix this

Think of your website as a shop inside a building. WordPress, your theme and your plugins are the shop: the shelves, the till, the staff. PHP is part of the building, the engine that makes the whole shop run. The flaws are in the building’s engine, not in anything on the shelves.

Wiz Research, which published the findings on 21 October 2026, says the bugs are in the core of PHP itself, not in the application running on top of it. Their demonstrations used the latest WordPress, Drupal and Joomla, and a plain “Hello World” page on an affected PHP was enough to be at risk. Malwarebytes puts it directly: updating WordPress or its plugins is not the same as updating PHP, so site owners should find out who updates the PHP underneath.

Two details make this worse than an ordinary plugin warning:

• It can happen before WordPress gets a say. In some setups the attack works before your site’s own code runs, so your security plugin, your login page and your strong passwords never see it.
• It reaches back a long way. Wiz says the problems go back to PHP 5.4, so nearly every PHP version in use is touched by at least one of them.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10. A CVE is simply the public reference number for a known security flaw.

So who does fix it?

The fix is a newer PHP, installed on the server. The PHP project released patched versions on 21 October 2026: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Wiz calls the PHP update the only complete remedy.

Who installs it depends on how your website is hosted:

• Shared or managed hosting. Your host looks after PHP, so your host patches it. You cannot do it from inside WordPress. Your job is to confirm it was done.
• A VPS or your own server. You, or whoever manages the server, must install the fixed release and restart PHP. Nobody does it for you. Hostinger notes this too: its server-wide protections did not apply to customers who run their own virtual servers.
• A developer or agency looks after it. Ask them in writing. Assume nothing.

Many firewalls and hosts also added temporary blocking rules in the first days. Those are a safety net, not the fix. Hostinger says attackers may get round such rules by changing their requests, and Cloudflare’s own technology chief called its mitigations a stopgap. Wiz says the same: the PHP update “remains the only complete remediation”.

What to ask your host

You do not need technical words. Send these three questions:

1. “Has the PHP on my plan been updated for CVE-2026-109618 and CVE-2026-109619, and on what date?” A good host answers with a date and a version number.
2. “Is the fix installed, or only scheduled?” Malwarebytes tells site owners to ask for confirmation that fixes are installed, not just planned, across all their sites.
3. “Which PHP version is my site on, and is it still supported?” PHP 8.1 and older no longer get routine security updates from the PHP project, so those sites depend on the host’s own back-ported fix, or a move to a newer version.

A warning about reading the answer. The version number on its own can mislead. Hostinger says that on its managed hosting the fix went into the existing PHP version, so the number did not change. That is why the date matters more than the digits. If a host gives you a vague answer or no answer, treat your site as unpatched until they say otherwise.

One more item from Hostinger: a third flaw, CVE-2026-115560, was disclosed on 23 October 2026. Its page says non-VPS plans were covered by the same protections, and the permanent PHP fix is due in PHP’s next regular release. Ask your host whether they are tracking that one too.

What you can check yourself in two minutes

Our free PHP2Shell checker reads the PHP version your server announces to visitors and compares it with the first fixed release in each line. It also runs the rest of our website checks.

Please read the result with care:

• A red result means act today. Your server says it runs a version older than the fix. Unless your host patched without changing the number, ask them to move you.
• “We could not see your PHP version” is not a pass. Well-run servers hide it, which is good practice, but then nobody outside can tell. Ask your host.
• A good result is not proof either. No honest outside tool can test for the flaw itself without attacking your server, so a version check is one part of the picture.

Inside your hosting panel, many hosts show the PHP version and sometimes the build date. If yours shows a build date of 21 October 2026 or later, that is a good sign the fix is in. If you cannot find it, that is a question for the host, not a reason to guess.

Keep updating WordPress anyway

None of this means WordPress updates do not matter. They stop a different, very common kind of break-in: old plugins and themes with their own flaws. Keep doing them. They are just not what closes PHP2Shell, and an owner who thinks they are may feel safe when they are not.

Also remember that a patch closes the door but does not remove anyone who already came in. Attempts began before the fix was public. Watch for the signs in our PHP2Shell explainer: admin accounts you did not create, strange files, redirects, or spam pages in Google. Running Moodle instead? Read Moodle and PHP2Shell.

Want us to check yours?

We can find out which PHP your site really runs, whether it is patched, and whether anything was left behind, without taking the site offline.

• Start with the free website security checker.
• See how we work on the website security service page.
• Email hello@wpfoss.com
• WhatsApp +254 118 271 160
• Tell us what you need

If your site is down or you think it was broken into, say so in the first line and we will look at it first.

Sources and further reading

• Wiz Research: PHP2Shell, AI uncovers critical RCE vulnerabilities
• Hostinger: protections deployed against PHP2Shell
• Malwarebytes: why websites are going offline for emergency security updates