PHP2Shell: what the PHP vulnerability means for your WordPress site
Two critical flaws in PHP itself made the headlines in October. If your website runs on WordPress, it runs on PHP. Here is what happened, what to do this week, and why it might be the moment to move your site off PHP altogether.
Adminify UK software for small businesses The short answer
- Two critical flaws, nicknamed PHP2Shell, let an attacker take over a web server running PHP without logging in. They affect every PHP version from 5.4 up to 8.5.11, which covers almost every WordPress site on the internet.
- Attackers were using them before the fix was released. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or get your host to confirm in writing that they have.
- Patching fixes these two flaws. It doesn't change the fact that a WordPress site runs code every time someone visits, and that code needs looking after for as long as the site exists. Adminify Folio takes PHP off your live site completely.
What happened?
On 20 October the PHP project announced an emergency security release. Details of the flaws leaked on social media the same day, ahead of the planned disclosure, and the fixes came out on 21 October.
There are two flaws, CVE-2026-109618 and CVE-2026-109619, and both are rated 9.2 out of 10 for severity. Both sit in the core PHP engine, not in a plugin or a theme. Both let someone who has never logged in run their own code on your server. The researchers at Wiz who found them showed working attacks against the latest version of WordPress, as well as Drupal and Joomla.
This wasn't a theoretical risk. Amazon's threat team spotted an exploitation attempt on 17 October, four days before the fix existed. Security firm watchTowr saw attacks on the day of release, and the US cyber agency CISA added both flaws to its list of known exploited vulnerabilities on 26 October. On 23 October PHP disclosed a third, lower risk flaw, CVE-2026-115560, which it will fix in its next regular release.
Why is this different from the usual WordPress scare?
Most WordPress security news is about a plugin. You can remove a bad plugin, or swap it for another. This time the problem was in the language WordPress is written in. A site with every plugin updated, a strong password and two-factor login was still exposed.
There are two other details worth knowing.
It can leak secrets, not just break in. One of the flaws lets an attacker read memory from the server. That can include database passwords, API keys and payment gateway keys. Patching closes the hole, but anything that leaked before you patched is still out there.
AI helped find it. Wiz used AI models to discover the flaws and to adapt the attacks to different setups. The same tools are available to attackers. Expect more flaws like this to be found, faster, and expect the gap between announcement and attack to keep shrinking.
A checklist for this week
Check your PHP version. In WordPress, go to Tools, then Site Health, then Info, and open the Server section. You need 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or later.
Ask your host, in writing. Good managed hosts patched on the day. Cheap shared hosting and servers nobody looks after may not have.
If you're on PHP 8.1 or older, there's no official fixed release. Those versions are out of support. PHP published small source patches for 7.4, 8.0 and 8.1, but your host or a support provider has to apply them. Otherwise you need to upgrade PHP, which often breaks older themes and plugins, or move the site.
Change your secrets. If your site was unpatched at any point after 17 October, change your WordPress admin passwords, database password, API keys and payment gateway keys, and regenerate the security keys in wp-config.php.
Look for signs of a break-in. Check for admin users you don't recognise, PHP files in your uploads folder, and plugins you didn't install.
Turn on your firewall rules, but don't rely on them. Cloudflare and others shipped emergency rules. They block known attacks, not every variation, so they buy you time rather than replace the update.
Is it time to move off WordPress?
Not every site needs to. If WordPress does what you need and someone reliably keeps it patched, it can carry on.
But it is worth asking one question: who patched your site on 21 October, and how did you find out? If the answer is "nobody" or "I'm not sure", that is the real problem, and it will come round again.
A WordPress site is a program that runs every time someone visits. Each page view starts PHP, queries a database and loads every plugin you have installed. That is what makes WordPress flexible. It also means every visitor, including an attacker, is talking directly to that code.
How Adminify Folio is different
Folio is our website platform for small businesses, and it was built to remove that problem rather than manage it.
No PHP on your live site. Your pages are built ahead of time and served as finished files. When a flaw like PHP2Shell comes out, there is nothing on your site for it to attack.
No plugins to keep updated. Forms, galleries, shop pages and the rest are part of Folio, so there is no pile of third party code to patch every week.
You still edit it yourself. Change text, swap images and add pages without touching code.
It's fast. Finished pages load quickly, which helps both visitors and search rankings.
Made and hosted in the UK. Your site and your data stay here, which keeps your privacy notice simple.
We look after it. Security updates to Folio are our job, not something you find out about from the news.
What does moving look like?
We move the site for you. We copy your content across, rebuild the design, and keep your page addresses the same or redirect them, so your Google rankings carry over. You review it on a private preview before anything goes live. To see how it works on a large site, read our case study on moving a 600 page WordPress shop to Folio.
The short version
Patch PHP today, change your passwords and keys, and check for anything odd. Then ask whether you want a website that needs this kind of emergency response at all. If you'd rather not be reading the security news on a Tuesday night, book a call and we'll tell you what moving your site to Folio would involve.