PHP2Shell is a PHP problem
PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a flaw in PHP, the language WordPress runs on. WordPress core does not contain it, so a WordPress update or a security plugin cannot fix it. What counts is the PHP version your host runs for your site.
In the WordPress dashboard
- Log in as an administrator.
- Go to Tools > Site Health and open the Info tab.
- Expand the Server section.
- Read the PHP version and PHP SAPI rows.
The version is the number you need. The SAPI tells you how PHP is attached to the web server:
| SAPI shown | What it means |
|---|---|
apache2handler | Apache mod_php. Highest risk: the request reaches PHP before any WordPress code runs. |
fpm-fcgi | PHP-FPM. Affected. |
cgi-fcgi | php-cgi or FastCGI. Affected. |
litespeed | LiteSpeed. Affected. |
All of these SAPIs are in scope and need the fixed build. The SAPI only tells you how urgent the update is.
With WP-CLI
If you have shell access:
wp eval 'echo PHP_VERSION, " ", PHP_SAPI, "\n";'
This prints something like 8.3.36 cli. Watch the cli at the end. WP-CLI runs on the command-line PHP binary, which can be a different version from the one your web server uses. Treat the number as a hint and confirm it with Site Health, which reports the PHP that actually served the page.
In your host's panel
Panels show the version per domain, usually as a branch such as "8.3" without the last digits.
- cPanel: Software > MultiPHP Manager. If your host runs CloudLinux, you may see Software > Select PHP Version instead.
- Plesk: Websites & Domains, pick the domain, then PHP Settings.
- Other panels or managed WordPress: look for "PHP version" or "PHP settings". Our host pages list what each host has said so far.
The panel hides the exact build. Use it to learn the branch, and Site Health to learn the build.
Read the number against the fix
The PHP project fixed the flaws in these releases:
| Branch | Fixed in | Your site is fixed if it shows |
|---|---|---|
| 8.5 | 8.5.12 | 8.5.12 or higher |
| 8.4 | 8.4.27 | 8.4.27 or higher |
| 8.3 | 8.3.36 | 8.3.36 or higher |
| 8.2 | 8.2.35 | 8.2.35 or higher |
| 8.1, 8.0, 7.4 and older | no release | affected unless your host backported the fix |
Examples: 8.4.27 is fixed. 8.4.26 is not. 8.3.6 is not fixed either, even though it looks close.
You can paste the full number into the version check and get a verdict.
A low number is not always a vulnerable site
Some hosts and Linux distributions backport the fix and keep the old version number. cPanel, for example, says it shipped backported fixes for ea-php74, ea-php80 and ea-php81. If your number is below the table but your host says it is patched, ask for the package name and the changelog line that lists both CVEs. If the host cannot show you one, its answer does not tell you much.
A patched package also needs a restart of the PHP processes before it takes effect. If you are unsure, ask your host whether the workers serving your site were restarted since 21 October.
What to do next
- Fixed build: nothing more to do for the version. The PHP project advises leaving
session.upload_progress.enabledoff if your site does not use upload progress. On shared hosting your host decides that. - Right branch, older build: ask the host when the update lands, or switch to a newer branch yourself: change the PHP version.
- 8.1 or older: plan a move. We recommend PHP 8.4. Options for code that cannot move yet are on old PHP versions.
- No idea who patches your PHP: start with which situation you are in.
- You see signs of a break-in: go to WordPress site hacked after PHP2Shell.
Last reviewed on 22 October 2026.