php2shell: How to Check If Your WordPress Site’s PHP Is Patched
Two critical PHP flaws (CVE-2026-109618, CVE-2026-109619) were fixed on 21 October 2026. Find your site's real PHP version, see if it is fixed, and what to ask your host.
On 21 October 2026 the PHP project released fixes for two critical flaws in PHP itself, nicknamed php2shell (CVE-2026-109618 and CVE-2026-109619). Both let an attacker run code on the server through an ordinary web request. That makes them a server problem rather than a WordPress problem, and every WordPress site runs on PHP.
The fix is a PHP update, and on almost every hosting plan only your host can do that. This guide covers the part you can do yourself: find out which PHP version your site really runs, tell whether that version is fixed, and know what to ask your host.
Which PHP versions are fixed
The fixes shipped in these releases. Your site is on a fixed version if it runs this release or newer in the same branch:
| PHP branch | First fixed release |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1, 8.0, 7.4 and older | No official release. The PHP project no longer updates these. It published minimal source backports for 7.4, 8.0 and 8.1, and some hosts and Linux vendors ship their own patched builds. |
So 8.3.35 is not fixed and 8.3.36 is. A site on 8.1 has no official fixed version at all. The real fix there is moving to 8.2 or newer, or a host that confirms it applied a backport.
Step 1: find the PHP version your site actually runs
Look at the version the website runs. Your hosting panel’s default, or the version you see when you run php -v over SSH, can be different. On shared hosting the command line often runs one PHP version and the website another.
- In WordPress, go to Tools → Site Health → Info.
- Open the Server section.
- Read PHP version. It shows the full number, for example
8.3.35.
The same section shows Server architecture and Web server, which you will need in Step 3.
Step 2: compare it with the table
Match the first two numbers (the branch, such as 8.3) and compare the last number with the table:
- Same or higher than the fixed release: the version includes the fixes. Nothing else to do for php2shell.
- Lower than the fixed release: the site is probably exposed. Some hosts, especially those using distribution packages or CloudLinux, patch PHP without changing the version number. Only the host can tell you that, so ask (Step 3).
- 8.1 or older: treat the site as exposed unless the host confirms in writing that it backported the fix.
Step 3: what to ask your host
Send your host a short, specific message. A vague “is my site safe?” gets a vague answer. This wording gets a yes or a no:
Our site example.com runs PHP 8.3.35 (from WordPress Site Health). Is this PHP build patched for CVE-2026-109618 and CVE-2026-109619 (php2shell, PHP advisory of 21 October 2026)? If not, when will you update it, or can you move the site to a fixed version (8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer)?
If the server runs Apache with mod_php, say so in the message. The PHP advisory rates mod_php as the highest-risk setup. PHP-FPM, php-cgi, LiteSpeed and FrankenPHP are affected too.
If the update takes time: settings that reduce the risk
The PHP advisory lists configuration changes that reduce the risk until the update is in place. They do not replace it. They have to be set in the server’s php.ini, the PHP-FPM pool or the Apache config, followed by a PHP restart. A plugin, ini_set() or a .user.ini file is not enough. On shared hosting that means asking your host:
session.upload_progress.enabled = 0, then restart all PHP workers. WordPress itself does not use the upload progress feature.- A low
post_max_size:8Mif the site takes no uploads,32Mif it does, withupload_max_filesizebelow it. - On PHP 8.5 only:
fatal_error_backtraces = 0.
The advisory also lists memory-limit changes at the server level. Those belong to your host’s system administrators, not to a site owner.
Things that do not help
- Updating WordPress, themes or plugins. Keep doing it, but it does not change the PHP version underneath.
- A security plugin “blocking” php2shell. Some of the attacks run before WordPress loads, so no plugin code is running at that point. A web application firewall run by your host or CDN may stop known attack patterns, but that is still not the fix.
- Hiding the PHP version. Removing the
X-Powered-Byheader is tidy, but attackers do not need it. They can simply try the attack.
Is anyone being attacked yet?
When the fixes were announced, no successful attacks had been publicly reported. Reporting by the BBC cites a severity score of 9.2 out of 10 and credits the security firms Wiz and Calif with the discovery. Once fixes are public, attackers can study them, so the gap between “announced” and “exploited” tends to be short. Do the check this week, not this quarter.
How the Ovanap Admin Toolkit helps
The plugin cannot update PHP, and neither can any other plugin. What it does from version 3.10.1:
- The site scan and Site Health → Status both show whether the site’s PHP version is a fixed one, warn when PHP runs as mod_php, and give you the exact question to send your host.
- The paid Pro add-on’s Security Check also lists which of the mitigation settings above are still at their risky values on your server, so you can pass a precise list to the host.
The free plugin does the version check, which is the part that matters most. If you manage several client sites, it saves you opening Site Health on each one and comparing numbers by hand.
Frequently asked questions
My host says the site uses “PHP 8.3”. Is that enough?
No. Both 8.3.35 (not fixed) and 8.3.36 (fixed) are “PHP 8.3”. You need the full number from Site Health → Info → Server.
Can I switch to a newer PHP version myself?
On many hosts, yes: hPanel, cPanel and Plesk let you pick the PHP version per site. Picking a newer branch (for example 8.3 instead of 8.1) helps only if the host has already installed the fixed release of that branch. Check Site Health again after switching, and test the site, because old plugins can break on a newer PHP.
Does this affect WordPress.com or managed WordPress hosts?
They run PHP too. Managed hosts usually patch quickly and announce it on their status page or blog. If you cannot find an announcement, ask them with the message in Step 3.
Where is the official advisory?
On php.net, with technical details in the PHP security advisories on GitHub.