The PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) are fixed in new PHP releases, so the cure is simple in principle: run a patched version and restart PHP. This guide lists the versions and the practical steps, in the order we would follow them for a client.
Patched PHP versions
- PHP 8.2: update to 8.2.35 or newer.
- PHP 8.3: update to 8.3.36 or newer.
- PHP 8.4: update to 8.4.27 or newer.
- PHP 8.5: update to 8.5.12 or newer.
- PHP 8.1, 8.0 and 7.4: there is no routine upstream release. The PHP project published limited source backports, so use a vendor or long-term-support package, or move to a supported version.
- PHP 7.3 and older: reported as affected with no fix. Upgrading is the only route.
Step-by-step checklist
- Find out your PHP version in your hosting panel or in WordPress under Tools, Site Health, Info, Server.
- Make a fresh backup of files and database before you change anything.
- Ask your host whether the server is already patched, or switch to a patched PHP version in the control panel.
- Restart PHP workers. A patch does not protect you until the old processes are replaced.
- Test the website: home page, forms, checkout, login and the admin area.
- Check for signs of compromise: unknown administrators, new PHP files in uploads, unexpected plugins.
If you cannot update today
The PHP project and security vendors say that no configuration change fully mitigates the flaws, but some settings reduce exposure while you wait. These must be set at server level, not inside the application. Setting session.upload_progress.enabled to 0 closes one of the attack paths. On PHP 8.5, setting fatal_error_backtraces to 0 closes another. Limiting the maximum request size at the web server or CDN also helps, and a web application firewall such as the free rules from Cloudflare can block known attack patterns. Treat all of this as a short bridge to the real fix, not a replacement for it.
Frequently asked questions
Is updating WordPress enough to fix PHP2Shell?
No. These are flaws in PHP itself, not in WordPress. You need to update PHP on the server, although keeping WordPress and plugins current is still important.
Do I have to restart anything after updating PHP?
Yes. PHP workers or the web server must be restarted so that the patched version is actually used. Many hosting panels do this automatically when you change the version.
Will a newer PHP version break my website?
It can, especially if the site uses very old plugins or a custom theme. That is why we back up first and test on a staging copy when possible.
Read next
- PHP2Shell: The Critical PHP Vulnerability of October 2026 Explained
- How to Check and Upgrade the PHP Version of Your WordPress Site
- My WordPress Site Was Hacked: What to Do Step by Step
Need help keeping your WordPress site secure? We offer maintenance, updates and security checks. Contact us
