Two critical bugs in PHP, fixed on 21 October 2026, affect almost every WordPress, WooCommerce, Magento and Laravel website. Here is what they mean for your business, how to check your site in two minutes, and what to do if you're on PHP 8.1 or older.
If your hosting company emailed you this week about "CVE-2026-109618", and you have no idea what that means, this is for you. We'll keep it simple.
What Happened
On 21 October 2026 the PHP team put out an emergency update. PHP is the software most websites run on, including WordPress, WooCommerce, Magento, Laravel and Drupal. The update fixes two bugs that people are calling "PHP2Shell".
Someone can send a specially crafted request to a website with the old version of PHP and run their own code on the server, without a password. That is as bad as it sounds.
The PHP team's own announcement says all PHP users are "strongly encouraged to update immediately" and that changing settings is not a full fix. Details leaked a day before the update was ready, according to the PHP Foundation, and the security firm watchTowr says it has seen attack attempts against its test systems since 21 October. That doesn't mean every website has been attacked. It does mean people are trying.
Does It Affect My Website?
If your site is on WordPress, WooCommerce, Magento, Laravel, Drupal, Joomla, OpenCart or anything custom-built in PHP, then yes, unless the PHP on your server has already been updated. That covers most business websites, so assume you're affected until you've checked.
If you're on Shopify, Wix or Squarespace, no. They run the servers and they handle it.
One thing confuses a lot of people: updating WordPress does not fix this. The bug is in PHP, not in WordPress. WordPress.org's own notice says: "No WordPress update is required or planned for these issues."
How to Check in Two Minutes
Your site is safe when PHP is at or above the fixed number for its own series:
- On 8.2, you need 8.2.35 or newer
- On 8.3, you need 8.3.36 or newer
- On 8.4, you need 8.4.27 or newer
- On 8.5, you need 8.5.12 or newer
Compare within the same series. PHP 8.3.30 is not safe, even though it's a bigger number than 8.2.35.
To find yours in WordPress, go to Tools, then Site Health, then the Info tab, and open Server. That number is the one that matters. It can differ from what a developer sees on the command line. In cPanel or Plesk, look for "PHP version". If you can't find it, ask your host.
Some hosts apply the fix without changing the version number. So an older-looking number doesn't always mean you're exposed. Ask your host directly whether the fix is in. If they can't tell you, treat it as not done.
What to Do
It depends on where your site lives.
On managed hosting, such as Kinsta, WP Engine or Pressable: most of them have already updated, or are in the middle of it. Check their status page, then confirm your version yourself.
On shared hosting, such as Hostinger, GoDaddy or Bluehost: the host updates PHP, but you might still be on an old version. Open the PHP selector in your control panel and switch to a fixed version if one is there.
On your own server or VPS: nobody is going to patch it for you. Whoever looks after the server needs to install the updated PHP and restart it. If that's you and you're not sure how, get help this week.
On PHP 8.1 or older: this is the hard one. PHP no longer releases normal updates for 7.4, 8.0 or 8.1. The PHP team did publish source-level patches for those versions, and Linux distributions and some hosting vendors got the fix early. Your host may have patched it, but not every host has, and there's nothing you can click yourself. Ask, and if they can't confirm, plan to move up now.
When you do move, don't stop at 8.2. Its security support ends on 31 December 2026, so you'd be upgrading again in two months. Go to 8.3 or 8.4. That can break old themes and plugins, so it has to be tested on a copy of the site first, with a backup. WordPress.org goes as far as suggesting that self-managed servers on old PHP be taken offline while the upgrade is prepared. Background in our PHP 8.2 end-of-life post.
The Email to Send Your Host
If someone else manages your server, send them this:
We've read about PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Which PHP version is our site on, and has the fix been applied and PHP restarted? If we're on 8.1 or older, has a vendor patch been applied, and what's the plan to move to 8.3 or newer, and when?
A decent host replies within a day.
Could Someone Have Got In Already?
Nobody can rule it out. Over the next few weeks, watch for admin users you didn't create, the site sending visitors to odd pages, files changing on their own, a warning from Google, or your host flagging unusual activity.
If you see any of that, updating alone isn't enough. Have a developer look at the site, and change your admin and hosting passwords once the fix is in.
FAQs
Do I need to update WordPress, WooCommerce or plugins?
Not for this. Keep them updated anyway, but this one is fixed by updating PHP on the server, which only your host or server admin can do.
My host says a settings change protects us. Is that enough?
No. The PHP team's announcement says no settings change fully fixes these bugs. Settings reduce the risk. Updating removes it.
We're on PHP 7.4 and everything works. Why change?
Because 7.4 gets no normal updates any more. Even if your host patched this one, the next hole won't be fixed. Move to 8.3 or newer.
Sources
- PHP.net: Security release of 21 October 2026
- The PHP Foundation: Today's PHP security release
- GitHub advisory for CVE-2026-109618
- GitHub advisory for CVE-2026-109619
- WordPress.org: Critical PHP Security Release, 21 October 2026
- PHP.net: Supported versions and security support dates
- Codeable: What WordPress site owners need to do
- watchTowr: PHP2Shell FAQ and exploitation status
- Plesk: PHP2Shell advisory
- InMotion Hosting: Critical PHP security release