What it does
PHP Patch Status adds one test to Tools › Site Health › Status. It reads the PHP version that is serving your site at that moment and compares it with the release that fixed CVE-2026-109618 and CVE-2026-109619 on that branch: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
That is all it does. It has no settings screen and creates no database tables, and it sends no requests to our server or anyone else's. The fixed versions are written into the plugin, so new facts arrive with a new plugin release.
Download php-patch-status.zipInstall it
- Download the zip above.
- In WordPress, go to Plugins › Add New Plugin › Upload Plugin and choose the file.
- Activate it.
- Open Tools › Site Health. The result appears in the list with the label "Security".
With WP-CLI on the server:
wp plugin install https://php2shell.dev/downloads/php-patch-status.zip --activate
On a multisite network, network-activate it or activate it on the main site. The PHP version is the same for every site on the network.
What the results mean
| Result | What the plugin saw | What to do |
|---|---|---|
| Good | Your PHP is at or above the fixed release for its branch. | Make sure PHP was restarted after the update. After patching shows how. |
| Recommended | The version number is older, but the build carries a distribution suffix such as -0ubuntu or +deb12u. | Distributions copy fixes into old numbers. Check the package changelog: pick your system. |
| Critical | The fix is missing on a branch that has one. | Update PHP, or ask your host to. Shared hosting has a ticket you can send. |
| Critical | Your branch (8.1, 8.0, 7.4 or older) has no fixed release from the PHP project. | Move to PHP 8.4. Change the PHP version walks through it. |
| Recommended | Your branch is newer than the plugin knows. | Update the plugin. |
When PHP runs as an Apache module (mod_php), the test adds a note: the PHP project rates that setup as the most exposed.
What it cannot see
- Whether every PHP process was restarted. Site Health runs inside one PHP worker. Other pools on the same server may still run the old code.
- Whether the site was attacked before you patched. A Good result says nothing about the past. If the fix arrived late, read hacked WordPress.
- Backports it cannot name. Read a Recommended result as "probably fine, confirm it". It does not mean "fixed".
Not a fix
The plugin only reports. It does not change PHP, block requests or patch anything. A security plugin or firewall rule cannot fix these flaws either. Only an updated PHP can.
Source and licence
GPL-2.0-or-later. The zip holds three files: the plugin, a readme and the list of fixed versions. Read them before you install. It is about 130 lines of PHP.
php2shell.dev is not affiliated with The PHP Group, the PHP Foundation or WordPress.
Last reviewed on 22 October 2026.