Is my WordPress site affected by PHP2Shell, and how do I check?

Whether a WordPress site is affected by PHP2Shell depends on the PHP build date and server type, not on WordPress core, theme, or plugin versions. Check Tools → Site Health → Info → Server in WordPress, then confirm the PHP build date with your host; WordPress alone cannot prove the fix if the host backported it under the same version number.

What is PHP2Shell, and why does it matter to WordPress sites?

PHP2Shell is the name for two flaws in the PHP runtime itself: CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS v4.0 9.2 (Critical), and both can allow unauthenticated remote code execution with the web server's privileges. Sources: watchTowr FAQ; Sophos advisory.

For WordPress site owners, PHP2Shell is not a WordPress plugin problem, a theme problem, or a content editor problem. It affects the PHP layer that WordPress runs on, which means the risk sits below WordPress and can exist even when core files, themes, and plugins are fully updated. Source: watchTowr FAQ.

The two flaws work differently, but the result is the same: attacker-controlled input can be turned into code execution in the PHP worker. In CVE-2026-109618, PHP runs out of memory part-way through setting up a request and cleanup code trusts half-built request data. In CVE-2026-109619, request state outlives its memory and the next request handled by the same PHP worker reuses it. Source: watchTowr FAQ.

Every PHP installation serving web requests is affected: PHP-FPM, Apache mod_php, php-cgi, LiteSpeed, and FrankenPHP. Risk is highest on mod_php, where a single request can succeed before application code runs, so server configuration matters as much as the CMS version for WordPress security. Scope note: this statement is based on the PHP2Shell FAQ’s affected SAPIs. Source: watchTowr FAQ.

Which PHP versions were fixed, and which ones were not?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released on October 21, 2026 at about 14:00 UTC. Every PHP worker must be restarted after the update. Sources: The Hacker News; watchTowr FAQ.

PHP 8.1, 8.0 and 7.4 received no official release; the PHP security team published source patches that hosts and Linux distributions have to build. PHP 7.3 and older are affected with no fix. Sources: watchTowr FAQ; Wordify.

This matters because a patched PHP build can keep the same version number when distributions backport the fix under the same version. The PHP build date is the reliable check, not the dashboard label alone. Source: PHP2Shell host patch status tracker.