PHP2Shell, the pair of critical PHP flaws disclosed on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2), lets an unauthenticated attacker run code through PHP itself, before WordPress loads. BugsQA’s analysis of WordPress.org data found that about 36% of WordPress sites run a PHP branch with no official fix. Our conclusion: upgrade PHP this week, and test the upgrade on staging first, because for one site in three the fix is a PHP branch change that can break plugins.
The PHP project fixed both flaws in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. No WordPress update fixes them, because they sit in the runtime underneath WordPress, Drupal and every other PHP application. Whoever controls the server’s PHP version (you, your host or your agency) has to act.
To size the exposure, BugsQA pulled WordPress.org’s live PHP and WordPress version statistics on 22 October 2026 and matched each PHP branch to the fixed releases in the PHP advisory. We test PHP upgrades as part of our WordPress security testing.
This post gives three findings first, then explains PHP2Shell, how to check and fix it, what breaks when PHP is upgraded and how a QA team makes the upgrade safe. It ends with the data, free to download.
Three findings from our PHP2Shell analysis
BugsQA’s analysis found that PHP2Shell reached almost every WordPress site, that a third of them cannot fix it with a simple patch, and that AI shortened the path from first bug to working exploit to days. Each finding shows the data, why it matters and what to do.
Finding 1: about 36% of WordPress sites run a PHP branch with no official fix
WordPress.org’s statistics on 22 October 2026 show 64.2% of WordPress sites on PHP 8.2 to 8.5, which can move to a fixed release on the same branch, and 35.8% on PHP 8.1 or older, which received no official PHP2Shell release (WordPress.org PHP stats API).
WordPress sites by PHP2Shell fix path, 22 October 2026
PHP 7.4 alone still runs 15.9% of WordPress sites, more than PHP 8.4 and 8.5 combined.
PHP versions used by WordPress sites, 22 October 2026
- PHP 8.326.7%
- PHP 8.223.7%
- PHP 7.415.9%
- PHP 8.110.5%
- PHP 8.49.5%
- PHP 8.54.2%
- PHP 8.03.8%
- PHP 7.3 and older5.7%
Official fix on the branchNo official release
Why it matters. The PHP security team published minimal backports for PHP 7.4, 8.0 and 8.1, which some hosts and Linux distributions apply. Sites on those branches depend on their host having done so; everyone else has to move to a newer PHP branch, and that is the change most likely to break older plugins and themes.
The caveat. WordPress.org statistics count sites that report to WordPress.org, and some hosts patch PHP without changing the version number shown. The 36% is the share that needs to check, not a confirmed count of vulnerable sites.
What it means for you: check your PHP version before anything else. On 8.2 or newer, ask your host for the patched release. On 8.1 or older, get written confirmation of a backport or plan a tested branch upgrade.
Finding 2: PHP2Shell sits under WordPress, so no WordPress update fixes it
WordPress.org said on 21 October 2026 that “no WordPress update is required or planned for these issues” (WordPress.org). Google Cloud puts the affected range at “all versions of PHP from 5.4 through 8.5.11” (Google Cloud), which covered about 99.6% of WordPress sites by our count; only the 0.4% still on PHP 5.3 or older sat outside it.
WordPress sites on a PHP version in the affected range (5.4 to 8.5.11) before the fix
The PHP advisory says the risk is highest on mod_php setups, where a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs (PHP 2026 news archive). WordPress security plugins, which run inside WordPress, cannot see or block an attack that happens before WordPress starts.
Why it matters. Site owners are used to WordPress fixing WordPress problems through updates. PHP2Shell breaks that habit: the fix lives at the hosting layer, which many site owners never touch.
The caveat. At the time of writing we found no public report of PHP2Shell exploitation in the wild. The fixes are public, though, and published fixes are what attackers study first.
What it means for you: your WordPress update routine does not cover this. Ask whoever manages your server which PHP version each site runs and when it was patched, including staging and old sites on the same account.
Finding 3: AI took PHP2Shell from first bug to working exploits in days
Wiz found the first PHP2Shell bug on 19 August 2026, had confirmed remote code execution against Drupal by 20 August and against WordPress by 21 August, and reported to the PHP project on 24 August (Wiz). Google Cloud says Gemini 4 Argon “made an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch,” and Wiz also used GPT-5.6 Sol.
| Date (2026) | Step | Days from first bug |
|---|---|---|
| 19 August | Wiz finds the first bug | 0 |
| 20 August | Remote code execution confirmed on Drupal | 1 |
| 21 August | Remote code execution confirmed on WordPress | 2 |
| 24 August | Reported to the PHP project | 5 |
| 20 October | PHP announces the security release | 62 |
| 21 October | Fixed versions released, public disclosure | 63 |
Wiz summed it up: “a single researcher completed in a week what previously would have taken a world-class team months of work.” The same pattern hit WordPress Core in July, when a researcher using GPT-5.6 built the wp2shell takeover chain in about 10 hours; our list of WordPress vulnerabilities in 2026 shows AI tools credited with a quarter of this year’s Core fixes.
Why it matters. If one researcher with AI can find and weaponise a PHP runtime flaw in days, others can turn the now-public fix into an exploit just as fast.
The caveat. The fast part was discovery and exploit development; coordinated disclosure and patching still took two months, which is the normal, responsible pace.
What it means for you: the window between a public fix and real attacks is now short. Treat critical PHP and WordPress security releases as same-week work, with testing built in so speed does not break the site.
What is PHP2Shell?
PHP2Shell is the name Wiz gave two memory-safety flaws in the core PHP runtime, disclosed with the PHP project on 21 October 2026. The PHP project describes them as follows:
| CVE | What goes wrong | Severity |
|---|---|---|
| CVE-2026-109618 | Remote code execution via out-of-memory corruption: PHP can be interrupted while internal request data is only partly set up, and request cleanup then treats the invalid data as valid | CVSS v4.0 9.2, critical |
| CVE-2026-109619 | Remote code execution via stale global state: request data can survive after its memory is freed, and a later request on the same worker may use it | CVSS v4.0 9.2, critical |
Both flaws can expose applications to unauthenticated remote code execution and memory disclosure. The PHP project notes that mitigations are not a complete fix and that updating is the only complete solution.
Which PHP versions are affected and which are fixed?
Every PHP version from 5.4 up to 8.5.11 is affected by at least one of the two flaws. The PHP project released fixes on its four supported branches:
| PHP branch | Fixed version | Status |
|---|---|---|
| 8.5 | 8.5.12 | Supported |
| 8.4 | 8.4.27 | Supported |
| 8.3 | 8.3.36 | Supported |
| 8.2 | 8.2.35 | Supported until 31 December 2026 |
| 8.1, 8.0, 7.4 | No official release | End of life; minimal backports published for vendors |
| 7.3 and older | No fix | End of life |
How do I check and fix PHP2Shell on a WordPress site?
Check your PHP version first, then patch within the branch if you are on 8.2 or newer, or plan a branch upgrade if you are not:
- Find the PHP version: in WordPress, open Tools, then Site Health, then Info, then Server.
- Compare it with the fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later on the same branch.
- On 8.2 to 8.5: ask your host for the patched release, or apply it yourself on a server you manage. Ask managed hosts to confirm the exact version and date.
- On 8.1 or older: ask your host whether it applied the PHP security team’s backport. If not, plan a move to PHP 8.3 or 8.4 and test it first.
- Check every server running PHP: staging copies, old marketing sites and forgotten subdomains often run the oldest PHP you own.
What if I can’t upgrade PHP this week?
If you cannot upgrade this week, reduce exposure while you plan. No mitigation is a complete fix, so treat these as stopgaps: put the site behind a web application firewall and ask your provider whether it has published PHP2Shell rules, take unused sites offline, and confirm with your host which server setup you run, since mod_php setups carry the highest risk.
What breaks when you upgrade PHP on a WordPress site?
A PHP branch upgrade, for example from 7.4 or 8.1 to 8.3, most often breaks plugins and themes rather than WordPress Core. Each PHP release removes or tightens old behavior, and older or unmaintained plugins are the code most likely to rely on it. Check these after a PHP upgrade:
- Fatal errors and white screens: the homepage, key landing pages and wp-admin, plus the PHP error log right after the switch.
- Forms and checkout: contact forms, WooCommerce checkout, payment callbacks and email sending.
- Page builder and theme output: pages built with Elementor or another builder, custom templates and shortcodes.
- Logged-in features: login, account pages, membership and role-restricted content.
- Scheduled tasks and integrations: cron jobs, CRM and email marketing sync, backups and imports.
- Admin workflows: the editor, media uploads and the plugin settings your team uses weekly.
Should you test the PHP upgrade on staging first?
Yes. Run the PHP upgrade on a staging copy, work through the checklist, fix or replace any plugin that fails, and only then switch production. That turns an urgent security fix into a planned one. A plugin that breaks on PHP 8.3 and has no update was already a risk: unmaintained plugins are where most WordPress vulnerabilities live.
How a QA team makes a PHP upgrade safe
A QA team makes a PHP upgrade safe by testing the site on the new version before production switches, so the security fix does not take checkout or logins down with it. BugsQA does this for WordPress sites and agencies:
- Staging first: the upgrade checklist above, on your theme, plugins and host.
- Plugin compatibility: every plugin that errors or misbehaves on the new PHP version listed with a fix or replacement.
- Same-day retest: a nearshore team in Colombia working US hours, so the switch to production happens with a clean report.
- Ongoing: the same retest after each WordPress, plugin and PHP security release.
The wider data on how fast fixes now arrive, and why follow-up is the gap, is in our 2026 QA security testing research.
How we analysed PHP2Shell exposure
BugsQA pulled WordPress.org’s PHP and WordPress version statistics from its public API on 22 October 2026 and grouped PHP versions by whether the PHP project released an official fix on that branch. Affected and fixed versions come from the PHP project’s 2026 news archive and Google Cloud’s response post; the discovery timeline comes from Wiz. You may reuse the data under CC BY 4.0 with a link to this page.
Raw data: PHP and WordPress versions
The tables behind the findings, each with a CSV download.
PHP versions used by WordPress sites, October 2026
| PHP version | Share of WordPress sites | PHP2Shell fix |
|---|---|---|
| 8.3 | 26.7% | 8.3.36 |
| 8.2 | 23.7% | 8.2.35 |
| 7.4 | 15.9% | No official release |
| 8.1 | 10.5% | No official release |
| 8.4 | 9.5% | 8.4.27 |
| 8.5 | 4.2% | 8.5.12 |
| 8.0 | 3.8% | No official release |
| 7.3 and older | 5.7% | No fix (5.4 to 7.3 affected; older versions outside the affected range) |
Source: WordPress.org PHP version statistics API, 22 October 2026. Download PHP and WordPress versions (CSV).
PHP2Shell fixed versions by branch
| PHP branch | Fixed version | Status | Share of WordPress sites |
|---|---|---|---|
| 8.5 | 8.5.12 | Supported | 4.2% |
| 8.4 | 8.4.27 | Supported | 9.5% |
| 8.3 | 8.3.36 | Supported | 26.7% |
| 8.2 | 8.2.35 | Supported until 31 Dec 2026 | 23.7% |
| 8.1 | No official release (minimal backport for vendors) | End of life | 10.5% |
| 8.0 | No official release (minimal backport for vendors) | End of life | 3.8% |
| 7.4 | No official release (minimal backport for vendors) | End of life | 15.9% |
| 7.3 and older | No fix | End of life | 5.7% |
Frequently asked questions
What is CVE-2026-109618?
CVE-2026-109618 is a critical PHP vulnerability, rated CVSS v4.0 9.2, disclosed on 21 October 2026 as part of PHP2Shell. Out-of-memory handling can interrupt PHP while internal request data is only partly set up, and request cleanup may then treat that invalid data as valid, which can lead to remote code execution. It is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
What is CVE-2026-109619?
CVE-2026-109619 is the second PHP2Shell vulnerability, also rated CVSS v4.0 9.2. Internal state owned by one request can survive after its memory is freed, and a later request handled by the same PHP worker may use it before it is reset, which can lead to remote code execution. It is fixed in the same releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Do I need to update WordPress for PHP2Shell?
No. WordPress.org confirmed on 21 October 2026 that no WordPress update is required or planned for PHP2Shell, because the flaws are in PHP, not WordPress. You need to upgrade the PHP version your server runs to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later, or confirm your host has applied a backport if you run PHP 8.1 or older.
Is PHP 7.4 or 8.1 still safe to run?
PHP 7.4 and 8.1 are end of life and receive no official PHP releases, so they did not get an official PHP2Shell fix. The PHP security team published minimal backports for 7.4, 8.0 and 8.1, which some hosts and Linux distributions apply. Unless your host confirms that backport is applied, treat these versions as vulnerable and plan an upgrade to PHP 8.3 or 8.4 with a staging test first.
How do I check which PHP version my WordPress site uses?
In the WordPress dashboard, open Tools, then Site Health, then the Info tab, and expand the Server section. It shows the PHP version and the server software. Your hosting control panel shows the same, and many hosts let you change the PHP version per site there. Check staging and old sites on the same account too.
Will upgrading PHP break my WordPress site?
Upgrading within a branch, such as from 8.3.30 to 8.3.36, rarely breaks anything. Moving to a new branch, such as from 7.4 or 8.1 to 8.3, can break older plugins and themes, usually with fatal errors, broken forms or page builder layouts. Test the new PHP version on a staging copy, check forms, checkout, logins and integrations, and replace plugins that fail before switching production.
Get the PHP upgrade tested before it goes live
PHP2Shell turns a routine server setting into an urgent fix for every WordPress site, and for about a third of them it means a PHP branch upgrade that can break plugins. The fix is quick to apply and slow to recover from if it breaks checkout on a Friday.
BugsQA tests WordPress sites on staging before PHP and WordPress security updates reach production: forms, checkout, logins, roles and integrations, with a clear list of anything that broke and why. Send us your site list and current PHP versions, and we will tell you what the retest covers. See WordPress security testing or contact us.
- security
- wordpress
- php
