Why it matters: PHP2Shell lives in PHP, not in WordPress or your plugins. The patched releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

A good answer: A specific version number and the date it was last updated. Anything on PHP 8.1 or older is end of life and needs an upgrade plan, not just a patch.

Why it matters: Marketing often owns the website while IT, an agency or a hosting provider owns the server. The gap between those teams is where patches get missed.

A good answer: One named owner, a confirmed patch date and a plan for the next critical update.

Why it matters: Patching can take time, especially on older sites with custom code. A web application firewall can block known exploit attempts in the meantime.

A good answer: Confirmation that a web application firewall is active with a rule for PHP2Shell in place. Treat it as a stopgap, not a fix.

Why it matters: Exploit attempts started quickly after disclosure, and attackers can read memory that may hold passwords and API keys.

A good answer: Someone has reviewed server logs for unusual errors, checked for unexpected files or admin accounts and rotated the credentials the site uses. If anything looks off, bring in Inversion6 incident response.

PHP2Shell is the name for two critical vulnerabilities in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. They can let an attacker run code on a web server without logging in, and they can expose server memory that may hold passwords, tokens and API keys. Wiz Research disclosed the flaws on October 21, 2026, the same day PHP released patched versions.

Yes, if your WordPress site runs on an unpatched version of PHP. The flaw sits in PHP, the language WordPress is built on, so a fully updated WordPress install and clean plugins do not protect you on their own. The same is true for Drupal, Joomla, Magento and other PHP-based sites.

No. Updating WordPress updates the application, not the PHP version running on your server. PHP is updated by whoever manages your hosting: your IT team, your web agency or your hosting provider. Ask them to confirm the PHP version directly.

PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026 to address PHP2Shell. Sites on PHP 8.1 or older run end-of-life versions that do not receive an official fix, so they need an upgrade to a supported version.

Yes. Amazon Threat Intelligence has reported broad exploitation in the wild, and public proof-of-concept exploit code appeared soon after disclosure. Treat patching as urgent, not routine.

Bring four questions to IT: what PHP version the site runs, who owns patching, what protects the site while it is patched and whether anyone has checked for signs of compromise. Inversion6 can help answer any of them through managed detection and response, penetration testing and incident response.

Inversion6 helps organizations confirm their exposure, block exploit attempts and recover if something got through. Inversion6 managed detection and response monitors servers 24/7, autonomous penetration testing verifies that the patch held and the Inversion6 incident response team steps in at the first sign of compromise.