Your WordPress site needs a PHP update. Is it done?
Every WordPress site runs on PHP, the software underneath it. On October 21, 2026, PHP released fixes for two serious security bugs, known as PHP2Shell. The fix is an update to PHP itself, usually applied by your host, and updating WordPress or your plugins won't do it. Our free scan tells you in seconds whether your site has it.
- ✓Your PHP version, read from what your site already shows the public.
- ✓A plain answer: patched, needs the update, or needs a bigger upgrade.
- ✓What it would take to fix, if anything. No pressure to hire us.
Got it.
We'll email you a plain answer within one business day. Here's what happens next:
your version
the fix
No pressure
What WordPress site owners need to know.
What happened
PHP is the software WordPress runs on, behind the scenes. It also powers Joomla, Drupal and plenty of custom sites. Security researchers found two flaws in it, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), that can let an outsider run their own code on a web server without logging in. PHP released the fixes on October 21, 2026, and anyone running a PHP website has been urged to update.
Who's affected
Any WordPress site, or other PHP site, on a version older than the fixed releases below. Sites still on PHP 7 or 8.0 and 8.1 are in the toughest spot: those versions are past end of life, so the dependable fix is moving to a supported version, not a quick patch.
If you leave it
Most likely, nothing happens today. But flaws like this get scanned for across the whole internet, and a site that gets taken over can end up serving spam, leaking form submissions, or getting flagged by Google. Applying the update closes the door. It's a routine job, much like installing an update on your computer, and there's no setting that does the same thing.
Your next step depends on who looks after your site.
Ask one question
If a web developer or hosting company runs your site, contact them and ask: “Have the October 21 PHP security fixes been applied to my site?” A good answer names the PHP version you're on now. If you don't hear back, or the answer is vague, run the free scan and see for yourself.
The update is on you
No one else is going to apply it. Check your PHP version (in WordPress: Tools, then Site Health, then Info, then Server), then switch to a fixed release in your hosting control panel, or ask your host to do it. On PHP 7, test on a copy first, because older plugins may not support PHP 8. We can do it for you if you'd rather not.
Updating WordPress or your plugins won't fix this
This one trips people up. The flaws are in PHP, the software underneath WordPress, so the fix has to be applied to PHP itself. Your WordPress dashboard can say everything is up to date while the server is still on an unpatched PHP version.
Start free. Fix only what needs fixing.
Free PHP check
- We find which PHP version your site runs
- A plain answer: patched, needs the update, or needs an upgrade
- What fixing it would involve, if anything
Patch or upgrade
One flat fee, agreed before we start. We test on a copy of your site first.
Already on PHP 8.2 or newer. We move you to the fixed release and check everything still works. Free with the care plan.
On PHP 7.x, 8.0 or 8.1. We upgrade to a supported version and fix plugin and theme compatibility along the way. Quoted on the actual work after your free check, so you know the price before we start.
- Backup taken before any change
- Your site stays live the whole time
Monthly care plan
- PHP and plugin updates, applied and tested for you
- Daily backups, kept off your server
- Uptime monitoring: we hear about downtime before your customers do
- The next patch like this one, handled without you lifting a finger
- Includes the quick update. 3-month minimum, then month to month
The questions everyone asks first.
What is PHP2Shell?
PHP2Shell is the nickname for two security bugs in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Under the right conditions they let someone run their own code on a web server without logging in. PHP fixed both on October 21, 2026.
Which PHP versions fix it?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or anything newer in those branches. PHP 8.1 and older are past end of life, so there is no regular release with the fix. The dependable path there is moving to a supported version.
Is WordPress affected?
WordPress itself isn't the bug, but every WordPress site runs on PHP. If your host has you on an unpatched PHP version, your site needs the update like any other.
Will updating WordPress or my plugins fix it?
No. The flaws are in PHP, the software WordPress runs on, so the fix has to be applied to PHP itself, usually through your hosting control panel or by your host. WordPress and plugin updates are still worth doing, but they don't cover this.
How do I check my PHP version myself?
In WordPress, go to Tools, then Site Health, then the Info tab, and open Server. Your hosting control panel usually shows it too. Or send us your web address and we'll check for you.
My host handles updates. Do I need this?
Maybe not. Many hosts update PHP for you, but plenty of plans only do it when you switch versions yourself, and older sites are often kept on an old version on purpose so they don't break. The free check tells you which one you are. If your host has you covered, we'll say so.
Will the update break my site?
A patch release within the same version (say 8.3 to the latest 8.3) almost never breaks anything. Jumping from PHP 7 to PHP 8 can, because old plugins and themes may not support it. That's why we test on a copy of your site first and fix what needs fixing before anything goes live.
How long does it take?
The free check comes back within one business day. A quick update usually takes under an hour of work. A migration from PHP 7 depends on your plugins and theme, and is usually done within a few days.