Updated WordPress and Still Hacked? Patch PHP Now (PHP2Shell)

Watch the 2-minute video:

Monday morning. You open your WordPress site and it isn’t yours anymore. The homepage says HACKED, the prices are $0.00, and there’s a new administrator you never created.

But you updated WordPress. Every plugin. Every theme.

The hole wasn’t in WordPress. It was under it, in PHP.

What happened: PHP2Shell

On October 21, 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two critical vulnerabilities that security researchers nicknamed PHP2Shell:

In plain words: one crafted HTTP request, with no login, can let an attacker run code on your server as the web server user. On Apache with mod_php, the PHP team says the attack can fire before any of your application code even runs.

As of October 21, 2026, none of the official advisories report attacks in the wild. That’s your window: patch before it closes.

Who is at risk

• Any server running PHP, not just WordPress: WooCommerce, Laravel, Drupal, Moodle, custom PHP apps and many appliances. WordPress itself needs no update and none is planned.
• Highest risk: Apache with mod_php. Also affected: PHP-FPM, php-cgi, FrankenPHP and LiteSpeed (LSAPI).
• PHP 8.1 and older get no official fix from the PHP project. Some Linux vendors backport it; otherwise you must upgrade.
• Note: PHP 8.2 reaches end of life on December 31, 2026, so plan your move to 8.3 or 8.4 now.

Step 1: Check your PHP version

In WordPress: Tools > Site Health > Info > Server > PHP version.

Other ways:
– Your hosting control panel (cPanel “Select PHP Version” or “MultiPHP Manager”, Plesk “PHP Settings”).
– On your server: php -v (this is the command-line PHP; your web PHP can be a different version, so also check Site Health or a phpinfo() page that you delete afterwards).

Safe versions (or newer):

Step 2: Update PHP, then restart

Shared or managed hosting

1. Open your hosting panel and pick a patched version (for example 8.4).
2. If you can’t see a patched version, ask your host today: “Is our PHP patched for CVE-2026-109618 and CVE-2026-109619?” Many hosts are patching and adding WAF rules, but don’t assume.

Your own server (Ubuntu / Debian)

sudo apt update
sudo apt upgrade 'php*'
sudo systemctl restart php8.3-fpm apache2   # use your PHP version and web server
php -v

RHEL, Rocky, AlmaLinux:

sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm httpd

Windows: download the new build from https://www.php.net/downloads.php?os=windows and restart IIS or your PHP service.

Two important notes:
– Restart every PHP worker. Until you restart PHP-FPM (or Apache with mod_php), the old, vulnerable PHP is still running in memory.
– Distro packages may show an older version number with the fix backported (for example Ubuntu’s own php8.3 package). Check your vendor’s security notice for the CVE numbers instead of only the version string. If you use Ondřej Surý’s PPA, you’ll see the upstream numbers like 8.3.36.

Step 3: Can’t update tonight? Use the stopgap

These settings reduce exposure to the known attack paths. They are a seatbelt, not the fix. Put them in php.ini or your FPM pool config (not ini_set() and not .user.ini), then restart PHP:

; temporary stopgap for PHP2Shell
session.upload_progress.enabled = 0
post_max_size = 32M          ; 8M if the site needs no uploads
upload_max_filesize = 16M    ; keep it below post_max_size
; PHP 8.5 only:
fatal_error_backtraces = 0

sudo systemctl restart php8.3-fpm

Also limit request body size at the web server or proxy (for example client_max_body_size 32m; in Nginx or LimitRequestBody in Apache).

The PHP team also lists memory_limit=-1 (set with php_admin_value so apps can’t change it) as a mitigation for CVE-2026-109618. Only do this together with the request size limits above, because unlimited memory with unlimited uploads can let one request exhaust the server.

If you can’t patch or mitigate, the UK NCSC and WordPress both say: consider taking the site offline until you can.

Already hit? Clean up

1. Users: Users > All Users, filter by Administrator, and delete anyone you don’t know (like wp-support0). Reassign their content to yourself.
2. Uploads: no PHP belongs in wp-content/uploads. Find and remove it:
   
   bash find wp-content/uploads -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \)
   
   Then block PHP there (Apache:
   <FilesMatch "\.(php|phtml|phar)$"> Require all denied </FilesMatch>
   in wp-content/uploads/.htaccess;
   Nginx: location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ { deny all; }).
3. Passwords: change every WordPress admin password, your hosting and SSH passwords, and the database password (update wp-config.php). Generate new salts at https://api.wordpress.org/secret-key/1.1/salt/ so every session is logged out.
4. Check Plugins and mu-plugins for anything you didn’t install, look at recently modified files (find . -mtime -3 -name "*.php"), and restore from a clean backup if in doubt. WordPress’s guide: https://wordpress.org/documentation/article/faq-my-site-was-hacked/

Back to Monday

Patched. Restarted. Clean. Your site is yours again.

Watch the video:

Quick checklist
– [ ] PHP version checked in Site Health
– [ ] Updated to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or newer (or vendor backport)
– [ ] PHP-FPM / Apache restarted
– [ ] Stopgap settings if you couldn’t update yet
– [ ] Unknown admins and PHP files in uploads removed
– [ ] Passwords and salts changed

Sources

• WordPress.org, “Critical PHP Security Release” (Oct 21, 2026): https://wordpress.org/news/2026/10/critical-php-security-release/
• PHP project announcement: https://www.php.net/archive/2026.php#2026-10-21-5
• PHP security advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618): https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
• PHP security advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619): https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
• UK NCSC: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
• CISA alert: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
• Help Net Security: https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/
• NCSC-NL list of affected third-party products: https://github.com/NCSC-NL/php2shell

Take away support: IT fixes, delivered in under two minutes. Subscribe on YouTube and follow on Facebook for the next one. By Abd Almouhimen Shamout, mouhimen.dev