22/10/2026
What a morning with the PHP2Shell issue...
There are two critical security flaws in PHP itself, now being called PHP2Shell (CVE-2026-109618 and CVE-2026-109619). They affect the engine that runs WordPress, so updating WordPress or your plugins won't fix them.
The fix has to come from your host.
My emails have been going crazy, so here is a quick rundown on what the main hosts have said so far:
20i: patches fully deployed across their hosting platforms, with fixes backported to every PHP version they offer, so sites on older versions are protected too. Unmanaged VPS customers need to apply the updates themselves.
Kualo: all shared and reseller servers are patched, and uploads and forms are working normally again. Around four in five managed and dedicated servers are patched too, with the rest protected until their updates arrive.
SiteGround: protections were in place across all servers before the fix was released. No action needed from customers.
Hostinger: all plans except VPS are taken care of, with firewall rules blocking attacks while the fix rolls out. VPS customers need to update PHP themselves.
Cloudways: patched on Autonomous. On Flexible, most servers are done, with the rest due this morning and temporary protection in place meanwhile.
Kinsta: temporary protections rolling out, with the full patch to follow once tested. Customers will get an email when it's applied.
Namecheap EasyWP: extra protection switched on for all sites, with the PHP update rolling out.
GoDaddy: Managed WordPress is patched. Standard Web Hosting is protected while it waits on updated packages. VPS customers need to update PHP themselves.
Bluehost: most servers patched, and you might notice temporary limits on upload sizes.
Cloudflare: firewall rules are live on all plans, including Free, but Cloudflare itself says this is a stopgap, not a replacement for patching.
Host not mentioned here? Please check with them directly and ask whether PHP2Shell has been patched on your server.
What you can do:
In WordPress, go to Tools → Site Health → Info → Server and check your PHP version. Patched versions are 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
Still on PHP 8.1 or older? Now's the time to upgrade.
If you're one of my maintenance clients, I'm already checking your sites, so there's nothing you need to do. If you're not and you'd like a hand, just drop me a message.
