Is Your WordPress Website Safe? What to Do About the New PHP Security Flaw

Is your WordPress website safe? This week, a serious security flaw was found in PHP, the software that runs WordPress and most business websites. Security experts call it php2shell. A fix came out on 21 October 2026, and attackers are already trying to use the flaw.

So, if your website runs on WordPress, WooCommerce or any other PHP software, there’s one thing to do this week: make sure your server runs a fixed version of PHP.

I’m Jay, a freelance web developer in Melbourne, and I look after WordPress websites for businesses across Australia. In this guide, I’ll explain what happened in plain English, how to check your website in a few minutes, and what to do if it isn’t fixed yet.

What happened#

On 21 October 2026, the PHP project fixed two flaws, CVE-2026-109618 and CVE-2026-109619, now known together as php2shell. Both are rated 9.2 out of 10, which counts as critical.

Both flaws come down to how PHP cleans up its memory when a request goes wrong. In the worst case, an attacker could run their own code on your server without logging in. That could let them read data they shouldn’t see, plant malware or take your site down.

The fix was planned for 22 October. However, details leaked early, so PHP released it a day ahead. Since then, several security firms have reported attackers trying to use the flaws against live websites.

Is my website affected?#

Probably, unless your host has already installed the fix. Every PHP version before 8.5.12, 8.4.27, 8.3.36 and 8.2.35 is affected, going back at least to PHP 5.4. That includes:

• WordPress and WooCommerce websites
• Magento, Drupal, Joomla and other PHP-based platforms
• Custom PHP websites and web apps

Importantly, updating WordPress, your theme or your plugins won’t fix this. The flaw is in PHP itself, which runs on your hosting server underneath WordPress. As a result, only a fixed version of PHP closes the hole.

On the other hand, if your website is on a fully hosted platform such as Shopify, Squarespace or Wix, the platform manages its own servers, so there’s nothing for you to update.

How to check if your WordPress website is safe#

How you check depends on your hosting. First, find out which of these three you have.

Hostinger shared, cloud or WordPress hosting#

Hostinger says it installed the fix on all its managed hosting servers by 22 October 2026. To confirm it on your own site:

1. Log in to Hostinger and open Websites → Dashboard → PHP Info.
2. Look for the Build Date.
3. If it says 21 October 2026 or later, your site has the fix.

Note that the PHP version number may not change, because Hostinger built the fix into the version you already run. So check the build date, not the version.

Other managed hosting (VentraIP, SiteGround, Crazy Domains and others)#

Most managed hosts update PHP for you. Even so, don’t assume. Send your host’s support team one question: “Have you installed the PHP fix for php2shell (CVE-2026-109618 and CVE-2026-109619) on my server?” Keep their written answer.

A VPS or your own server#

If you or your developer manage the server, nobody else will update PHP for you. In that case, act now:

1. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your Linux distribution’s patched package.
2. Restart PHP and your web server afterwards. Until you do, the old, unfixed version keeps running.
3. If you can’t update straight away, ask your developer to restrict access to the site until you can.

Finally, whichever group you’re in, it’s worth checking for signs of trouble: new admin users you don’t recognise, unfamiliar files, or pages that suddenly redirect elsewhere.

Fixed PHP versions#

If you can see your PHP version, compare it with this table.

Your PHP version	Fixed in	What to do
PHP 8.5	8.5.12	Update to 8.5.12 or later
PHP 8.4	8.4.27	Update to 8.4.27 or later
PHP 8.3	8.3.36	Update to 8.3.36 or later
PHP 8.2	8.2.35	Update to 8.2.35, then plan an upgrade (see below)
PHP 8.1, 8.0, 7.4	No official PHP release	Upgrade to PHP 8.3 or newer, unless your host confirms it has patched your version
PHP 7.3 or older	No fix	Upgrade to PHP 8.3 or newer

One exception: hosts and Linux distributions often build the fix into an older version number. That’s why the build date or your host’s confirmation matters more than the number itself.

While you’re at it, upgrade your PHP version#

php2shell is a good reminder to check how old your PHP is. Older versions miss many other security fixes, and PHP 8.2 stops getting security fixes on 31 December 2026. So, if your site runs PHP 8.2 or older, plan to move to PHP 8.3 or newer before then.

Here’s how to upgrade without breaking anything:

1. Back up your website first, including the database.
2. Check your theme and plugins support the new PHP version. Most current ones do; old or abandoned plugins are the usual problem.
3. Switch the PHP version. On Hostinger, go to Websites → Dashboard → PHP Configuration and choose 8.3 or newer.
4. Test your key pages straight away: the homepage, contact form, checkout and any booking forms.
5. If something breaks, switch back and fix the plugin before trying again.

If you’d rather not do this yourself, it’s exactly the kind of job a website care plan covers.

Not sure where your website stands?#

Not sure where your website stands?

If you’re not sure how your website is hosted, or the steps above sound like a lot, I can check it for you. I’ll confirm whether your PHP has the php2shell fix, tell you which PHP version you’re on, and explain what needs to change.

To get started, message me on Fiverr with your website address. Messages, orders and payments are all handled securely on Fiverr.

I’m a freelance web developer in Melbourne, and I work with businesses across Australia and around the world. While you’re here, you can also run a free website speed test on your site.

Common questions#

What is php2shell?#

php2shell is the name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. In the worst case, they let an attacker run their own code on a web server without logging in.

Will updating WordPress make my website safe?#

No. The flaw is in PHP, not WordPress, so updating WordPress, themes or plugins won’t fix it. Only a fixed version of PHP on your server does.

Is my Hostinger website safe?#

Hostinger says it installed the fix on all its managed hosting by 22 October 2026. To confirm it for your site, check that the PHP Info build date is 21 October 2026 or later. If you’re on a Hostinger VPS, however, you need to update PHP yourself.

Which PHP versions fix php2shell?#

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older have no official fix, so upgrade to PHP 8.3 or newer unless your host confirms it has patched your version.

How do I know if my website was attacked?#

Look for admin users you didn’t create, files you don’t recognise, or pages that redirect to other sites. If you see any of these, contact your host and a developer straight away.

Sources#

• Two critical PHP flaws: how to find, mitigate and patch PHP2Shell, Qualys, 21 October 2026
• PHP2Shell RCE exploited: CVE-2026-109618 and CVE-2026-109619, watchTowr, updated 22 October 2026
• php2shell (CVE-2026-109618 and CVE-2026-109619) fixes available, Ubuntu, 21 October 2026