On October 21, 2026, the PHP project released an urgent security update for two critical vulnerabilities, nicknamed “PHP2Shell.” PHP is the programming language that powers WordPress and a huge share of the websites on the internet, so this one affected far more than a single plugin or theme.
What was the problem?
The two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were flaws in how PHP manages memory between requests. In the wrong hands, they could let an attacker run their own code on a web server without logging in. Security researchers showed it could be used to take over up-to-date WordPress, Drupal and Joomla sites.
Because the flaw was in PHP itself, keeping WordPress and plugins up to date wasn’t enough. The fix had to happen at the server level. Details leaked a day before the planned announcement, so hosts and security teams worked around the clock to patch servers, and some organizations took websites offline as a precaution until they could update.
How does this affect website owners?
- Any site on an unpatched version of PHP is at risk, whether it runs WordPress or another platform.
- The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older should be treated as vulnerable.
- Older, unsupported versions are the biggest concern. PHP 8.1 and earlier no longer receive official updates, and PHP 8.2 reaches end of life on December 31, 2026.
- “Quick fix” plugins aren’t the answer. Security experts warn against unofficial fixes. The real fix is a patched version of PHP from your host.
If your site was left unpatched, watch for signs of trouble like unexpected errors or slowdowns, and talk to your host or a security professional about checking the server and changing stored passwords and keys.
How to check your PHP version
Your hosting dashboard usually shows the PHP version for each site, and WordPress lists it under Tools, then Site Health, then Info. If you can’t find it or aren’t sure whether your host has patched it, ask them directly. This is not one to wait on.
Osky Blue hosting clients: you’re already covered
If we host your website, there’s nothing you need to do. The required PHP security update has already been applied to every site we host, and our hosting platform added extra firewall protection while the patches rolled out. We’ll keep monitoring for follow-up updates and will reach out if anything ever requires action on your end.
This is exactly why we include proactive updates, security monitoring and support with our hosting: so our clients can focus on their business instead of on server patches.
Looking for website security and a marketing partner?
If this news left you wondering who’s keeping an eye on your website, we can help. Our website hosting and support keeps your site fast, secure and up to date, and our team can also handle the marketing that brings in new customers, from SEO and AI search to paid ads and social media. Contact us to talk about your website and your goals.
Sources: PHP.net, Patchstack. Details are current as of October 23, 2026.