A PHP update closes the gap. Whether your website is safe afterwards depends on what lies behind it.
The key points in brief
- Two critical vulnerabilities in the core of the PHP programming language, CVE-2026-109618 and CVE-2026-109619, allow code execution without a login.
- The most important measure is the update to a patched version: PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
- PHP 8.1 and older versions no longer receive an official update. There, only a migration helps.
- A security plugin or the maintenance mode of WordPress offers hardly any protection, because the vulnerability sits in the PHP core, before WordPress.
The vulnerabilities do not affect a single plugin, but the runtime environment your website runs on. What matters is therefore the PHP version on the server, not the theme or the extensions.
Five steps for today
- Ask your host or your agency in writing which PHP version your website uses and whether the update against PHP2Shell has been applied.
- Check the version yourself. In WordPress it is found under Tools, Site Health, Info, Server.
- If an update is not possible soon, discuss a temporary restriction of access with your host.
- Before a migration to PHP 8.3 or 8.4, you need a backup and a test on a copy of the website.
- Watch for traces of an attack: new admin accounts, unknown files and the Security issues report in Google Search Console.
Update or new website?
A PHP update is often enough. If the theme, page builder or plugins no longer support a newer PHP version, a new website is usually the safer choice. It can be delivered in 1 to 2 weeks at a fixed price, and the addresses are preserved.
Whether that applies to you is answered by the free risk check on the landing page on PHP2Shell. It calculates in the browser and stores nothing. How a relaunch without PHP risk works is shown on our page Website relaunch without PHP risk.
