On October 21, 2026, the PHP development team released urgent security patches. These address two critical vulnerabilities, collectively known as PHP2Shell, which allow attackers to execute their own code on a server without authentication. The vulnerabilities have a severity score of 9.2 out of 10. Since the flaws exist within PHP itself, virtually any website running on this technology could be affected. This includes WordPress and WooCommerce websites, regardless of which themes or plugins they use.
At WPM, we have been monitoring the situation since the first reports emerged and took immediate action. Below, we explain what happened, what it means for your website, and what we are doing about it.
What Exactly Happened?
PHP is the programming language WordPress is built on. Put simply, it is the engine that powers your website behind the scenes, generating the content visitors see whenever they open a page.
The vulnerabilities affect this engine, specifically the component responsible for processing incoming requests. Under certain conditions, PHP can incorrectly handle data contained in a request, allowing an attacker to exploit the flaw and execute malicious code on the server. The critical detail is that this can happen before your website even starts running. An attacker does not need a username, password, or any other form of access. A single specially crafted request sent to your website may be enough.
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, with security patches available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
Why Updating WordPress Won’t Fix This
This is probably the most important part to understand. When we normally talk about website security, we focus on keeping WordPress, themes, and plugins up to date. This time, the situation is different.
The vulnerability is not in WordPress itself, but in the underlying technology that WordPress runs on. This means your website is not necessarily protected, even if:
- Your WordPress installation is fully up to date.
- All your themes and plugins are updated.
- You use a security plugin.
- Your website was only recently developed.
The proper solution is to apply the necessary PHP security updates on the server hosting your website. This is not something you can do directly from the WordPress dashboard, which is exactly why having someone actively managing your server infrastructure matters.
How We Handle This at WPM
For websites covered by our maintenance services, this is our responsibility, not our clients’.
As soon as the first reports emerged, we reviewed our entire portfolio of managed websites, checking which PHP versions they were running and where they were hosted. We contacted our hosting partners to verify the status of security patches and the protective measures they had implemented. Where necessary, we carried out the updates ourselves.
Situations like this demonstrate just how important it is to choose a reliable hosting provider. At Pressable, protection was automatically implemented across all PHP versions, covering both production and staging environments, without requiring any action from us or our clients. This means websites remain protected even when the WordPress Site Health section still displays an older PHP version. Rocket.net also responded immediately, implementing platform-level security measures and additional protection through its Cloudflare Enterprise web application firewall. Official PHP security patches are being deployed as they become available for the respective versions.
Our clients didn’t have to do anything. In fact, they didn’t even need to know something had happened.
That is the whole point of professional website maintenance. When a vulnerability of this magnitude emerges, the difference between a website secured within hours and one that someone only gets around to checking two weeks later can be critical.
Security is not something we switch on when an incident occurs. It is an integral part of our ongoing maintenance process, from monitoring vulnerabilities and applying updates to overseeing the technical infrastructure supporting every website we manage.
What Should You Do If You Manage Your Own Website?
If your website is not covered by a professional maintenance service, we recommend taking the following steps:
- Check which PHP version your website is running. You can find this information in your WordPress dashboard under Tools → Site Health → Info, or through your hosting provider.
- Contact your hosting provider to confirm whether the security patches have been applied. Some major hosting providers have already deployed the updates automatically, while others may require you to initiate the process yourself.
- If you are running PHP 8.1 or an older version, upgrading is essential. These versions are no longer officially supported.
PHP 8.2 will reach its end of support on December 31, 2026, so it makes sense to plan an upgrade to PHP 8.3 or newer. We have previously explored why upgrading PHP is also beneficial for website performance.
What If You Can’t Update PHP Right Away?
Sometimes an immediate update is not possible. For example, older custom code or certain plugins may not be compatible with newer PHP versions.
In these situations, several temporary measures can help reduce the risk:
- Using a web application firewall (WAF), as some providers have already introduced rules designed to block these types of attacks.
- Disabling file uploads on websites where visitors do not need this functionality.
- Monitoring server logs for suspicious requests, memory-related errors, and sudden spikes in HTTP 500 errors.
These are temporary precautions, not permanent solutions. None of them can replace properly updating PHP. If you find yourself in this situation, it is also a strong indication that your website’s technical foundation may need a more thorough review.
Something Worth Saying Out Loud
Vulnerabilities like these serve as an important reminder that a website is not a project that ends once it goes live.
The technology behind it continues to evolve, and security vulnerabilities can emerge in places you would least expect. That is exactly why website maintenance at WPM means much more than simply clicking an update button.
It means having someone who actively monitors developments across the technology ecosystem, knows which websites need attention, and takes action before clients even have a reason to wonder whether their websites are at risk.
Looking Ahead
If you are unsure which PHP version your website is running or whether the necessary security patches have been applied, get in touch with us.
We will review your website’s current setup and give you a straightforward assessment of whether any additional measures are needed.
When in doubt, it’s better to check today than a week from now.
