PHP2Shell: Is Your WordPress Site Affected?

Contents4 sections

On October 21, 2026, at 9:55 p.m. Tokyo time, Japanese Prime Minister Sanae Takaichi posted on X: “To everyone, a most urgent request: please act tonight.” She was talking about PHP, the language that runs WordPress and a large part of the web. If the fix could not be installed quickly, she listed taking websites offline for a while among the effective measures.

During the night, several Japanese services went into emergency maintenance, including pixiv, Niconico, the online store platform BASE and the hosting company Sakura Internet. The Ministry of Finance took some of its pages offline. Here is what happened, without jargon, and what you can check on your own site.

The flaw in plain words

WordPress is written in PHP, a language installed on the server that hosts your site. When a visitor opens a page, the server runs PHP, which builds the page and sends it to the browser. According to W3Techs, PHP runs 69.3% of the websites whose server-side language is known.

With these two flaws, an attacker can send a simple request to the server, from anywhere, and make it run their own commands. They need neither a password nor an account on the site. They can then read, change or delete what is on the server. The PHP project says every installation that serves web pages is affected, whatever the type of server.

The two flaws have official numbers, CVE-2026-109618 and CVE-2026-109619, and a nickname, “php2shell”. On the usual severity scale, they are rated 9.2 out of 10. The fix came out on October 21 at 14:00 UTC (4 p.m. in Paris, 11 p.m. in Japan).

Taking your site offline: the same advice in Japan, France and the United States

The Prime Minister’s message surprised people in Japan, and the business outlet Business+IT called it an “exceptional situation”. The advice itself is shared. Japan’s National Cybersecurity Office (NCO) said the same thing that evening. In France, CERT-FR, the alert team of the national cybersecurity agency ANSSI, recommends isolating affected systems before moving to a fixed version. In the United States, the cybersecurity agency CISA asks for systems that cannot be patched right away to be taken offline.

For a brochure site, a few hours offline cost little. For an online store, the decision is made with the host, depending on what it has already fixed.

Is your WordPress site affected?

Yes, like any site that runs on PHP. Still, you have nothing to install in WordPress, because the flaw is in the server. On shared hosting, the most common kind, your host updates PHP. Your job is to check that it has.

What hosts are saying

Hostinger says the fix has been installed on all its servers since October 22 at 6:44 UTC, except virtual private servers (VPS), which customers manage themselves. It also added the fix to older PHP versions, from 5.2 to 8.1. Kinsta said the same day that all the sites it hosts are protected, and that it had seen no breach linked to the flaw. At o2switch, we checked ourselves on October 22 that the fix was in place.

If your host has published nothing, ask in writing, quoting both numbers, CVE-2026-109618 and CVE-2026-109619.

Check your site’s PHP version

In the WordPress dashboard, open Tools, then Site Health, Info tab, Server section. The “PHP version” line shows the version in use. Your host’s control panel shows it too.

The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. You do not have to switch versions; you only need the latest update of yours. PHP 8.1 and older versions are no longer supported by the PHP project. Some hosts, such as Hostinger, add the fix to them anyway, but CERT-FR advises moving to a supported version. And PHP 8.2 will lose support after December 31, 2026.

The displayed number is not always enough

On our Hostinger server, PHP 8.4 still shows 8.4.26, while the fixed version is 8.4.27. That is expected: Hostinger adds the fix to the version already installed, without changing its number. It says so in its announcement and gives the right marker, the date PHP was built. If that date is October 21, 2026 or later, the fix is there. At Hostinger, you can read it in the PHP information of the control panel.

What if your site has already been hit?

On the day of the fix, CISA had seen no attacks. Since then, Amazon has reported that its honeypot servers logged an attempt on October 17, four days before the flaws were announced. Attackers move fast: according to Rapid7, the first attacks come within 5 hours (median) for a heavily exploited flaw.

A site hit through this flaw looks like any hacked site. It redirects to other sites, shows pages you did not create, gets a warning from Google or is suspended by its host. What to do, and in what order, is in our guide Hacked WordPress site: what to do, and in what order.

Your host is not answering, or you have doubts about your site? Tell us what is happening: we step in urgently, on a quote if you are not a client yet.