Skip to content
Sanfeliu Software

Security alert · 21 October 2026

PHP2Shell: what to do if your website runs on WordPress

On 21 October 2026, PHP fixed two critical vulnerabilities, known as PHP2Shell, that let anyone run code on a website’s server without a username or password. They affect every website built with PHP, WordPress sites included, and updating WordPress or its plugins does not fix them: the server’s PHP has to be updated, today.

Updated

Book a meeting Write to us

Thirty minutes, free and with no obligation, with the engineer who would lead the project.

Glass illustration of a company: the office, the warehouse and the server, joined by a terracotta cube so the data moves between them on its own.
  • CVE-2026-109618
  • CVE-2026-109619
  • CVSS 4.0: 9.2
  • Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35

What happened

What the PHP security team, WordPress.org and CERT-EU, the cybersecurity team of the EU institutions, have published.

  • Two flaws in PHP itself

    They are not WordPress bugs: they are in the language the server runs on. One is in how PHP handles running out of memory (CVE-2026-109618), the other in data that survives from one request to the next (CVE-2026-109619).

  • Severity: 9.2 out of 10

    Critical, according to the PHP security team: anyone can run code on the server with a web request, without logging in.

  • Who is affected

    Every PHP installation that serves websites: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest with mod_php, where the attack can start before a single line of the website runs.

  • Fixed versions

    PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October. For PHP 8.1 and older, the project no longer releases new versions.

  • Is it being attacked?

    CERT-EU warns that proofs of concept are already circulating, which makes it likely that attacks have already started.

  • What about WordPress?

    WordPress.org says no WordPress update is needed: what has to be updated is PHP. WordPress runs 39.6% of all websites, according to W3Techs.

What to do today

  1. Check which PHP version the website runs: in the WordPress dashboard, under Tools → Site Health → Info → Server.
  2. If it is an 8.2 below 8.2.35, an 8.3 below 8.3.36, an 8.4 below 8.4.27 or an 8.5 below 8.5.12, ask your hosting provider to update it today.
  3. If it is 8.1 or older, PHP no longer releases new versions of it: you need a patch from your provider or an upgrade to a supported version, checking first that your theme and plugins work with it.
  4. If it cannot be updated today, consider putting the site into maintenance mode or taking it offline until it is fixed. That is what CERT-EU and, via WordPress.org, the UK’s National Cyber Security Centre recommend.
  5. Do not install plugins that claim to fix it: the flaw is in the server’s PHP, not in WordPress.
  6. Once updated, check for administrator accounts you do not recognise and for new or changed PHP files. If you find any, treat the server as compromised and change every credential it holds.

Why this keeps happening to WordPress

A WordPress site is not one piece: it is five, from five different authors, and each one has its own updates.

  • PHP

    The server’s language. Today’s flaw is in PHP.

  • WordPress core

    From 17 July to 6 October, six releases with security fixes; two of them for critical flaws: 7.0.2 and 7.1.2.

  • The theme

    The site’s design, often bought from a third party. If its author abandons it, nobody updates it.

  • The plugins

    Forms, shop, bookings, backups, SEO: each from a different author, and all with access to the same server.

  • The hosting provider

    They are the ones who update PHP. Today, your website’s security depends on when they do it.

A well-kept WordPress site can work fine. But someone has to watch all five pieces every week, and a single failing one is enough to expose the whole site.

The alternative: a custom website and tools, without PHP

We build custom websites and tools on AWS, with TypeScript and Node. No PHP and no plugins.

  • The website

    The websites we build are generated in advance and published as files on AWS. On each visit, the server runs no PHP and no program at all: it just delivers the page.

    Websites

  • What does the work

    Forms, bookings, catalogue, customer area or the connection to your ERP: code written for you, with only what you use.

    Custom applications

  • Who applies the patches

    For the servers and the environments the code runs in, AWS: on AWS Lambda, security patches are applied automatically. For our code, we do, with the continuity plan.

    Continuity

  • Built to be found

    Fast on mobile, multilingual and ready for Google and for AI assistants.

  • Yours

    The domain, the content and the code are in your name.

  • Or for a monthly fee

    If you would rather not pay for the migration, we rebuild your website without WordPress and look after it every month for a fee.

    Website as a service

No software is invulnerable. What changes is how many third-party pieces are exposed to the internet, and who keeps an eye on them.

What it takes to leave WordPress

  1. The website’s address and access to the WordPress dashboard.
  2. The list of plugins and what each one does: what has to stay, what is not needed and what is missing.
  3. Access to the domain and the hosting, to switch over on the day.

A case

Evolve Cars

Imports and sells inspected cars, from El Prat de Llobregat

They had a WordPress site; now they have a website and a panel built for the way they work. The website is in Catalan, Spanish and English, and has been live since 14 September, scoring 99 for mobile performance in Google Lighthouse.

The Evolve Cars case
All cases
Book a meeting

Thirty minutes, free and with no obligation, with the engineer who would lead the project.

A multilingual website, without WordPress

€1,500

Fixed price, live in two weeks. VAT not included.

How we work

  1. A thirty-minute meeting, free and with no obligation, with the engineer who would lead the project. We look at your website and at what each plugin does.
  2. A website that explains your company, at a fixed price and live in two weeks.
  3. If it does more, such as a shop, bookings or a customer area, a prototype before any price and a proposal with a fixed price per feature. Custom projects start at €3,000 (VAT not included).
  4. Handover, with the domain, the content and the code in your name.
  5. Afterwards, if you want it, a monthly plan with no lock-in: hosting on AWS, backups, security and changes.
All prices
Book a meeting

Thirty minutes, free and with no obligation, with the engineer who would lead the project.

What is PHP2Shell, and what should a company with a WordPress website do?

PHP2Shell is the name given to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (9.2 out of 10), that let anyone run code on a website’s server without logging in. PHP fixed them on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They affect every website that runs on PHP, WordPress sites included, and updating WordPress or its plugins does not fix them: the server’s PHP has to be updated and, if that cannot happen right away, taking the site offline should be considered. For companies that want to stop depending on WordPress, SANFELIU, a custom software consultancy in Barcelona, builds custom websites and tools on AWS, with no PHP and no plugins. The first step is a thirty-minute meeting, free and with no obligation.

  • What it is: two vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10 (CVSS 4.0).
  • Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. For PHP 8.1 and older, the project no longer releases new versions.
  • Who is affected: every PHP installation that serves websites (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed), above all with mod_php.
  • WordPress: it does not need updating; PHP does. The version is shown under Tools → Site Health → Info → Server.
  • The alternative: custom websites and tools on AWS, with no PHP and no plugins. A multilingual website, €1,500 at a fixed price; custom projects from €3,000 (VAT not included).
  • First step: a free call. For one specific tool, a prototype with your data comes next, before any price; if it involves the whole business or more than one system, the audit. Reference prices are on the pricing page.

Questions we get asked

Do I need to update WordPress?

No. WordPress.org has said that no WordPress update is needed this time: the flaw is in the server’s PHP, and PHP is what has to be updated. If your site is with a hosting provider, they usually do it: ask them whether they already have, and check the version yourself.

How do I find out which PHP version my website runs?

In the WordPress dashboard, under Tools → Site Health → Info → Server; many hosting providers also show it in their control panel. An 8.2 below 8.2.35, an 8.3 below 8.3.36, an 8.4 below 8.4.27, an 8.5 below 8.5.12 and any 8.1 or older are vulnerable.

Is a firewall enough?

It helps, but it is not a fix. Many hosting providers and services such as Cloudflare have added rules to block the known attacks, but the PHP team says that only updating is a complete solution.

I run PHP 7.4, 8.0 or 8.1. What should I do?

The PHP project no longer releases new versions of them: it has only left minimal patches for people who build PHP themselves. Some providers publish their own patches; if yours does not, you need to upgrade to a supported version, checking first that your theme and plugins work with it. In the meantime, consider taking the site offline.

Is a website without WordPress invulnerable?

No: no software is. What changes is how many third-party pieces are exposed, and who keeps an eye on them. The websites we build are published as files on AWS and run no PHP and no plugins on each visit, the code that does the work is only what you use, and with the continuity plan security is our job.

Will we lose Google rankings if we leave WordPress?

It should not happen if it is done properly: every page keeps its address, or the old address points to it with a 301 redirect, and the sitemap is resubmitted to Google and Bing. The new site is fast on mobile and ready for Google and for AI assistants.

How much does it cost to leave WordPress?

A multilingual website that explains your company costs €1,500 (VAT not included), at a fixed price and live in two weeks. If it does more, such as a shop, bookings or a customer area, each feature has its own fixed price in the proposal, and custom projects start at €3,000. If you would rather not pay for the migration, our website as a service includes it: you then pay €39 a month, or €50 with minor changes (VAT not included), with a twelve-month commitment. Reference prices are on the pricing page.

Book a meeting

Thirty minutes, free and with no obligation, with the engineer who would lead the project.

Sources

How we work

You see it working before you decide anything.

Tell us about your case in thirty minutes.

Book a meeting with the engineer who would lead the project: thirty minutes, free and with no obligation. If we’re a fit, we tell you how we’d start; if not, who to turn to.

Book a meeting

Or email me@joansanfeliu.com

Prefer to write?

Tell us about your case in a few lines and we’ll reply by email.

Data controller: Joan Sanfeliu Vilarrasa (SANFELIU). Purpose: to see whether we’re a fit and to prepare the call. Basis: your request. When you send the form, your details are stored in our systems (AWS, in the European Union) and in our CRM. Recipients: Cal.com (United States), only if you book the call on its calendar; if you prefer, email us instead. Rights: access, rectification, erasure and others at me@joansanfeliu.com. Privacy policy