Should WordPress site owners be worried? What the new PHP vulnerabilities mean for their sites

Two critical flaws in PHP, dubbed PHP2Shell, have prompted warnings across the web, and WordPress owners have been among the most worried. The bugs, tracked as CVE-2026-109618 and CVE-2026-109619, aren’t in WordPress at all but in PHP, the programming language that powers WordPress and a large share of the web. This means a site can run the latest WordPress, with every plugin and theme up to date, and still be exposed if the server underneath it is running a vulnerable version of PHP.

Researchers at Wiz showed that the flaws could be used to run code remotely on WordPress installations in affected PHP environments, in some cases without the attacker needing to log in. They carried out similar attacks against Drupal and Joomla, which shows that the problem sits below the content management system and explains why hitting “update” in the WordPress dashboard won’t fix it.

WordPress.org has made the same point, stressing that the vulnerabilities aren’t specific to WordPress and that no core update is needed to address them. Its advice is for site owners to check which PHP version their website runs, which they can find under Site Health in the dashboard, and to confirm that their hosting environment has received the security update.

That version number doesn’t always tell the whole story, however, because on managed hosting it is the host, not the customer, that controls PHP and can patch or protect thousands of sites at once without site owners doing anything. Several hosts have already done this: WordPress.com says every site it hosts is protected, including WooCommerce and staging sites, while Automattic says the same of its WordPress VIP, WP Cloud and Pressable platforms, where customers don’t need to take any action.

Other hosting companies have also moved quickly. Hostinger says it deployed firewall protections and other mitigations before rolling out patched PHP versions across its managed hosting, so customers on those plans shouldn’t need to update PHP themselves, although people running their own virtual private servers are likely to be responsible for updating PHP on them. SiteGround took a similar approach, adding server-level protections across its infrastructure and disabling the affected functionality while the official fixes were being rolled out.

As a result, two sites running the same version of WordPress can face very different levels of risk, with one on a managed host possibly already protected while another on a self-managed server stays exposed until someone patches it.

This also means that some of the claims circulating online go too far, since the disclosure doesn’t mean any WordPress site can now be taken over. Whether a site is exposed depends on its PHP version and configuration, whether security updates have been installed and what extra protections its host has added, so rather than calling this “a WordPress bug”, it is more accurate to say that WordPress sites running on vulnerable PHP environments may be at risk.

For those on managed hosting, the first step probably isn’t changing anything on the website but asking the host whether its PHP environment has been patched against CVE-2026-109618 and CVE-2026-109619. Those running their own servers need to identify the affected PHP installations and install the fixes, which are included in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older, unsupported versions are harder to deal with, as the PHP project may no longer issue fixes for them.

The UK’s National Cyber Security Centre has urged organisations to prioritise internet-facing PHP systems and apply the available updates quickly, and where a vulnerable system can’t be secured in time, it advises considering taking it offline until the risk is under control.

Beyond the immediate fix, PHP2Shell is a reminder of how easily the rest of a website gets overlooked. Many businesses think of their website simply as “our WordPress site”, but WordPress is only the top layer, sitting on PHP, the web server, the operating system, the database and the hosting infrastructure, and a weakness in any of these can affect the site above it. A dashboard showing that everything is up to date can only speak for the part it can see.

For most owners, then, the question worth asking right now is who manages the PHP behind their site and whether it has been patched, because the answer will reveal far more about their exposure to PHP2Shell than their WordPress version number ever could.