01 / Confirm
Confirm the environment
Identify the web-facing PHP runtime, hosting provider and applications that depend on it. A version number alone may not show a vendor backport.
PHP2Shell / PHP security
Worried about PHP2Shell? Get a clear next step.
Find out what PHP your site actually runs, confirm your host’s security updates and plan any changes safely. We can help you patch the stack you have or scope a move from WordPress when that fits your business.
PHP / A practical plan
- 01Confirm
Find the runtime and your host’s patch status.
- 02Update
Plan a supported, tested PHP upgrade.
- 03Choose
Keep the stack or scope a sensible migration.
Patch the runtime. Then decide what needs to change.
## #
# #
#
#
#
# #
# #
# #
##
#
# #
#
##
### # #
+## # #
## #+####
#+## +#
## +#+#+
# ###
# # +##
++++ # #
# ##
# ++ #### #
+#+ #
# # #
# + ## ## #
## # # +
### ###+
. : :
:: . : :
. . .. :: :
:: : ::: . : :
. . : . : ::
. .. ::: :::: .. : :
::::: ... : : :::
. :: : :: ... . .
. :: : : .. :: . .
:: : : : . : ..
.. .
: : . .. .
...:: :: :: .. . . .
. .::: :.. . . .
: ... .. . .
####
####
###
###
####
####
####
####
####
#####
####
###
#####
####
###
# ##
#
# #
#
##
### ##
# #
#
#
# ##
##
#
# #
+#### ###+
# +#+ + ##
#### +# #
++# ###+
## + ##+#
## ###
##+ # #
# + ##+#
# #+##
### #+# +#
+ # +
# +# #+ #
###+ ##+#
#### ##
## #+
.: :: : : ::
: :: . . : :
::: .
...
..: . . :
. .
.. : : . :
..:::: : : .
:.:::: :: .::
: : : : . :.
... :..
. . . : : . . ..
. .
. :: :: . . ..
.. . : . .
####
####
#####
###
####
####
####
####
####
####
#####
####
###
####
#####
Advisory / Reviewed October 25, 2026
This is a PHP issue.Start with your host.
PHP2Shell refers to critical PHP runtime vulnerabilities disclosed on October 21, 2026: CVE-2026-109618 and CVE-2026-109619. Updating WordPress, a theme or a plugin alone does not patch the runtime.
Ask your host to confirm a fixed PHP release or a vendor security backport. PHP’s October 23 follow-up also advises disabling session upload progress until the next regular bugfix release; your host should review that guidance for your environment.
Read the PHP security advisory and follow-up and Automattic’s WordPress hosting guidance. Some managed hosts have already applied protection. This page does not establish that your site is vulnerable or compromised.
Swipe to explore1 / 1
02 / Update
Plan and test the update
Coordinate the host update, check application compatibility and verify the important pages, forms and business flows afterward.
#
#
#
##
##
## ##
##
#
#
#
#
## #
+## ++#
### #+##+
+ + ##+##
+# # #
# # +##
# # +
# + #
# # ##
###+ ## +
# #+ #
### # +
### + #+
### ##+
+#+ # # +#
+## #++
.. :: ::: : :
. : :: : ::
..: : . ::
::: :: :
. : :: :: :
:: : . : : : :
. :
. ..
. :: : :: ::
: : :..
:: :: . . .. .::
.: : . ..
::: : . . . .
: .... . .. .
::::. .. . .. .. .
####
####
####
####
#####
#####
####
####
# ##
####
####
####
####
####
####
#
#
# ##
#
# #
# #
# #
#
#
## #
#
#
# #
##
### #+ #+
###
#++# ####
+# ++ +
### + +
+ ++###
++# ### #
## ++++#
+ + +++#
+##+# # ++
#+ ++
#+#
# # ##
+ #++# ##
. . : ::: .: :::
... : :. : ::
: :::: : :
. . . : :: :
: . . :: :
: : : ::: : :
.. :: . .
.:: :: :. . . :
: : ::.
. : : . .::
: . . .. :
: : :: . . . :
. . .
.:: ..
: : :: .
####
####
#####
####
###
####
##### #
####
####
####
####
####
####
####
####
Your options
Fix what needs fixing.Choose what comes next.
A vulnerability is a reason to review the stack. The right long-term choice depends on what your site does and who will maintain it.
Swipe to explore1 / 1
01 / Keep
Keep WordPress
Retain the site when its features and editing workflow suit you. Scope supported hosting, updates, backups, access and ongoing care.
02 / Simplify
Simplify the stack
For a site weighed down by plugins or hosting constraints, consider a lighter build. We review content editing, forms, integrations and redirects before proposing a migration.
03 / Investigate
Investigate a possible compromise
Patching does not remove an existing attacker’s changes. If you see redirects, unfamiliar users or a host warning, use the recovery inquiry so we can review that separately.
04 / Ownership
Define ongoing ownership
Agree who handles runtime updates, dependencies, monitoring and recovery. A new framework still needs maintenance.
#
###
#
#
#
#
# ##
#
#
# #
## #
#
# #
#
#
++# # # +##
### + #
### ##
## ### ##
#+# # +
+ #+
##
++ # ##
+# #+
#+ # #+#
## # +#
+ #+ + ##++#
+##+ ++
+## ++#
## +
. : : ::
:.:::: :::
. : . :::
: : ..: :::
: . :. :
: : . :
. :: : :::
: : ... ..
.. : : .::: .
. .. : . . ..
. . : : . . ::
:: :: . . :
.. :: : :.. . . ..
:: : . . . . . .. .
.. : : : . . .
#####
####
#####
####
####
####
####
####
####
###
####
#####
#####
### #
####
#
## #
# #
# #
#
##
# #
#
# #
##
# # ##+ +
+++# ###
##+# #+
+# ###
# ## ##
#+# #++
+#+ +#
### ++
#+ # #+
+## +
# + #
+###+ #
+##+# # ++#
## # #
+##+ #
:: : : ::::::
:: .: : :: ::
.. . :: ::. .: :::::
.. . : .. . : ::::::
. . . : . : :
. ..: : :
::: : . .. : .
:: : . . . ..: :
: :: : :
: : . . .
. ::::: ::. .. .. ..
:: :: . .. . .
::: :: . . . ... ..
. ::::: . . . . ..
:: ... .
#####
####
####
####
#####
####
###
####
####
####
#####
#####
#####
#####
####
PHP / Questions
Make an informed move.
01
Does this affect only WordPress?
No. These are PHP runtime vulnerabilities, so other PHP applications can be affected. Your hosting environment and the applied security fixes matter.
02
Does visiting this page check my website?
No. We have not scanned or tested your site. An assessment needs an agreed scope and, where required, authorization and access.
03
Do I need to leave WordPress to fix this?
No. Runtime patching is the immediate concern. Migration is a separate decision based on your features, editing needs, hosting and maintenance.
04
Can a firewall replace the PHP update?
A firewall can reduce exposure to certain attack paths. PHP’s advisory says an update is the complete solution for the disclosed vulnerabilities; follow the current vendor guidance and any subsequent advisories.
PHP security inquiry
Show us the stack.We’ll scope the next step.
Share your site address and host. If you know the PHP version or have a host advisory, include it. Tell us whether you want patching, a review or migration help.
We look at the site address, host and anything you know about the PHP version, then confirm what we can review and the next step: patching, a stack review or migration help.
- Site address, host and PHP version if known
- Patching, a review or migration help
- Access, testing permissions, availability and pricing agreed first
Already seeing signs of a breach? Use the website recovery form so the inquiry describes the right problem.