WordPress Maintenance: Why PHP Updates Matter After PHP2Shell

PHP is a programming language that runs on web servers. When someone visits your site, PHP builds the page, pulls in your content and sends it to their browser.

It’s everywhere. PHP is used by 69.2% of websites whose server-side language is known (W3Techs, October 2026). WordPress alone powers 39.5% of all websites, and 58.3% of sites with a known content management system (W3Techs, October 2026).

There are good reasons for this:

• It’s free and open source. No licence fees, for you or your host.
• It runs almost anywhere. Nearly every web host supports PHP, so hosting stays affordable.
• It has a huge ecosystem. WordPress, WooCommerce, Drupal and Joomla are all built on PHP, with thousands of plugins and themes.
• It’s easy to find help. There are developers everywhere who know it.

But popularity has a downside. When a flaw is found in PHP, it affects millions of websites at once. That makes PHP sites a big target for attackers.

On 21 October 2026, the PHP team released fixes for two critical flaws, nicknamed PHP2Shell (SOCRadar):

• CVE-2026-109618 is linked to how PHP handles running out of memory in the middle of a request.
• CVE-2026-109619 is linked to data left over from one request being reused by the next one.

Both are rated 9.2 out of 10. Both can let an attacker run their own code on your server without logging in. That’s about as serious as it gets. An attacker who gets that far can change your site, steal data or use your server to attack others.

Attacks started before the fix was even out. The first attempts were seen on 17 October. On 26 October, the US cybersecurity agency CISA added both flaws to its list of vulnerabilities known to be used in real attacks.

Which PHP versions are safe?

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older on those branches is affected.

PHP 8.1, 8.0 and 7.4 no longer get normal updates. The PHP team only published minimal fixes for them, and some hosts have added their own. PHP 7.3 and older get no fix at all.

Why updating WordPress isn’t enough

This is the key point. PHP2Shell isn’t a WordPress bug. No WordPress update fixes it. The fix is a PHP update on your server (Codeable).

So your WordPress dashboard can say “everything is up to date” while your server is wide open. Unless someone is checking the layer underneath, nobody notices.

Old PHP is common. Of websites using PHP, 26.5% run PHP 7 and 7.6% still run PHP 5 (W3Techs). That’s more than a third of PHP sites on versions that no longer get official security updates.

You might think your business is too small to be a target. It isn’t. These attacks are automated. Bots scan millions of sites looking for anything they can break into. They don’t care whose site it is.

A hacked site can cost you far more than maintenance would:

• lost sales while your site is down
• Google warnings that scare visitors away
• spam sent from your server, which can get your emails blocked
• a possible data breach you may need to report under GDPR
• the cost of cleaning up and rebuilding trust

1. WordPress core updates. Security fixes go on as soon as they’re out.
2. Plugin and theme updates. Most WordPress security problems start with an out-of-date plugin.
3. A supported PHP version. Your site should run on PHP 8.2 or newer, and get each security release.
4. Daily backups. If something goes wrong, you can roll back fast.
5. Malware scans and a firewall. These catch problems early and block common attacks.
6. Uptime monitoring. You hear about problems before your customers do.
7. Testing before updating. For online shops, updates should be tested on a copy of the site first.
8. Someone watching the news. When something like PHP2Shell lands, you need someone who knows about it that day.

1. Check your PHP version. In WordPress, go to Tools, then Site Health, then Info, then Server.
2. Ask your host if they’ve applied the 21 October PHP security release. Some hosts patch PHP without changing the version number, so the number alone may not tell you.
3. Plan a move if you’re on PHP 8.1 or older. Take a full backup and test on a staging copy first. Old plugins and themes may not work on newer PHP.
4. Not sure? Ask us for a free check. We’ll tell you where your site stands.

Our WordPress maintenance plans take the work off your plate, for businesses across Ireland. You get on with running your business. We keep your site updated, backed up and protected. All prices are per month, ex VAT, and you can cancel any time.

• Security Shield (€39). For sites hosted elsewhere. A firewall, regular malware scans, blacklist monitoring, alerts and free clean-up if your site is ever infected.
• Hosting & Care (€49). Hosting plus WordPress, theme and plugin updates, daily restorable backups, everything in Security Shield and 30 minutes of changes a month.
• Care Plus (€129). Our most popular plan. Adds uptime monitoring, two hours of changes a month and a monthly security and speed report.
• Commerce Care (€249). For online shops. Updates are tested on a staging site first, with checkout monitoring, four hours of changes a month and a four-hour response to requests.

See all our hosting and care plans. Already been hacked? Our WordPress malware removal service gets you back online and locked down.