By Renie Ravin, co-founder of InkySites. Updated 22 October 2026, with every fact below read from its source that day (listed at the end). We will update this page if the picture changes.
What is PHP2Shell, in plain words?
PHP is the programming language WordPress runs on. It sits on your host's web server and runs every time someone opens one of your pages. PHP2Shell is the name for two flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619). PHP's own advisory says they "can allow unauthenticated remote code execution". In plain words, a stranger could run their own code on the server without logging in, and take over your website. WordPress.org says no WordPress update is required or planned. Updating WordPress or a plugin leaves the flaw in place. Your host updating PHP is what closes it.
PHP's security team rates both flaws 9.2 out of 10. A score of 10.0 went round first, and PHP's own foundation says that score was wrong. Cloudflare and watchTowr report attempts to attack the flaws. Patchstack says hosting partners told it of incidents where the flaws were used. CISA's alert of 21 October said it had not seen them used at that time. All of them say to update now. For you, that means one question to your host today.
How do I check my site today without my designer?
- Find out whether your site runs on PHP. WordPress, Drupal and Joomla all do. If you are not sure, the free site check shows what your site runs on, where its code shows it. It needs no email, and nobody contacts you afterwards.
- If you can log in to WordPress, look up your PHP version. Go to Tools, then Site Health, then the Info tab, then Server. Write the number down.
- If you cannot log in, skip that step. Your host can tell you the version, and your host is the one who updates it anyway.
- Find your host. Look for hosting charges on old invoices or card statements, or ask your designer. The free domain lookup shows who answers for your web address. That is often your host, so treat it as a clue and confirm it.
- Send your host the message below and keep the reply. If the hosting account is in your designer's name, the host may only talk to them. In that case, send your designer the same question.
A message you can copy and send:
Subject: PHP2Shell and my website [your web address]
Hello, my website [your web address] is hosted with you under the account [account name or email]. Please can you confirm two things. First, has the PHP on my site been updated for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)? Second, which PHP version is my site running now? If it is 8.1 or older, please tell me what you recommend and by when. Thank you, [your name]
Who updates PHP for my website?
| How your site is hosted | Who updates PHP, and what you do |
|---|---|
| Shared hosting with a control panel | Your host. Ask them to confirm PHP is updated and which version you are on. Keep the reply. |
| Managed WordPress hosting | Your host. Send the same question and get the answer in writing. |
| A VPS or server someone set up for you | Whoever runs it. If it was your designer or a freelancer, send them the host question. |
| You cannot tell who hosts your site | Start with old invoices, card statements or the free domain lookup. Once you know the host, ask them. |
What if my site is on PHP 8.1 or older?
PHP 8.1 and older no longer get updates from the PHP project. For 7.4, 8.0 and 8.1, PHP's security team published fixes only as source code, for people who build PHP themselves. There is no official release to install, and anything older than 7.4 gets nothing. By WordPress.org's statistics, more than a third of WordPress sites run 8.1 or older. Some hosts apply the fix and keep the old version number, so ask your host what they have done. The lasting fix is moving to a supported version, which can break an old theme or plugin, so someone needs to test your site. CISA advises taking systems on 8.1 or older offline until they are patched or upgraded. That decision is for whoever runs the server. Ask your host for a plan with a date.
What have the big hosts said about PHP2Shell?
Hostinger told its shared hosting customers there was "nothing to do", adding: "We manage PHP on these plans and have taken care of it." On a Hostinger VPS, you update PHP and restart it yourself. GoDaddy said its Managed Hosting for WordPress was patched. Its ordinary Web Hosting was "Mitigated, not yet patched" while it waited on updated packages, and VPS customers update PHP themselves. Bluehost said it had "successfully patched the majority of servers", with no action required. All three spoke on 21 October 2026, and we read them on 22 October. The answer depends on the plan, so keep your host's answer about your plan.
What should I avoid doing this week?
- Installing a "fix" plugin or code snippet you find online. Patchstack warns these are not verified and can break your site.
- Counting on a WordPress or plugin update to fix this. Keep updating them as usual, but WordPress.org says no WordPress update is required or planned for PHP2Shell, so the fix has to come from PHP.
- Relying on a firewall alone. CISA says one "may provide some protection" until PHP is updated, and Hostinger says its own rules are "not a substitute for the PHP update."
Should I stay on WordPress after PHP2Shell?
A flaw in PHP is no reason on its own to rebuild your website. If your host has patched it, and you now know who to ask next time, you are in a reasonable place. Staying on WordPress makes sense if your site runs a shop, bookings, a members' area or plugins you use every week. It also makes sense if someone you trust keeps it updated. If you are weighing it up, we have honest comparisons with managed WordPress hosting and with WordPress care plans. Whatever you decide, write down who hosts your site and which PHP it runs. Next time, you will know where to start.
Where does InkySites fit in?
InkySites sites are plain static pages with no WordPress or database behind them, and no admin login to break into. So there is little to hack and no PHP to update. We build a fresh version of your current site from its public pages and email it to you free within 48 hours, with no card and no login needed. If you like it, it is $29 a month for hosting and unlimited reasonable changes. Your web address and your site's complete code stay yours to take any time you ask. A well-run managed host gets most owners most of the way too.
Questions people ask.
Is my WordPress site affected by PHP2Shell?
If your site runs on WordPress, it runs on PHP. Patchstack says any site on a vulnerable PHP version is exposed. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Some hosts fix older versions and keep the old number, so the version alone does not settle it. Ask your hosting company whether PHP on your site has been updated for PHP2Shell, and keep the reply.
Will updating WordPress or my plugins fix PHP2Shell?
No. The flaws sit in PHP, the language underneath WordPress. WordPress.org says "No WordPress update is required or planned for these issues," and tells owners to check with their host. On almost every small-business site, the hosting company updates PHP. So the fix comes from your host. Ask them to confirm it in writing.
Do I need my web designer to fix PHP2Shell?
Usually not. Your hosting company updates PHP, so your host is the one to ask. If you cannot log in to WordPress, your host can still tell you which PHP version your site runs. You need your designer only if the hosting account is in their name, because the host may deal only with the account holder. Then send your designer the same question. If they do not reply, inkysites.com has a guide for that.
Should I install a plugin that claims to fix PHP2Shell?
No. Patchstack says to avoid unofficial "fix" plugins and copy-pasted snippets, because they are not verified and can break your site. The flaw is in PHP on your host's server, and updating PHP is your host's job. Ask your host to confirm your site is on a fixed version: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
What if my website runs PHP 8.1 or older?
PHP 8.1 and older no longer get official updates from the PHP project, so there is no fixed release to install. Some hosts apply the fix and keep the old version number. The lasting fix is moving to a supported version, and someone should test your site after the move. PHP 8.2 also stops getting security fixes after 31 December 2026. Ask your host what they have done and for a plan with a date.
Where these facts come from
Each was read on 22 October 2026.
- The fixed versions, the risk of remote code execution, and the source-only fixes for 7.4 to 8.1: PHP's security advisory of 21 October 2026. The 9.2 rating: PHP's notice of 20 October 2026. The early release and the wrong 10.0 score: the PHP Foundation. The end of 8.2's security fixes: php.net's PHP 8.2.35 release notes.
- No WordPress update needed, and where to find your PHP version: WordPress.org, 21 October 2026. The share of WordPress sites on 8.1 or older: our sum of WordPress.org's PHP version statistics.
- CISA's position on exploitation, firewalls and taking unsupported systems offline: CISA's alert of 21 October 2026.
- Exposure of every site on a vulnerable version, reports from hosting partners, and the warning about fix plugins: Patchstack. Cloudflare's report of attack traffic: Qualys, which also notes that fixes may keep an older version number. Exploitation attempts: watchTowr.
- The hosts' words: Hostinger, GoDaddy and Bluehost, each of 21 October 2026.
Not sure what your website runs on?
Run the free site check on inkysites.com. It shows what your site runs on, such as WordPress, where its code shows it. It needs no email, and nobody contacts you because you used it.