PHP2Shell and WordPress: What to Ask Your Host
FastSiteLab · · Checked 23 October 2026
If your business uses WordPress, ask your hosting provider to confirm the PHP fixes, check the separate 23 October advisory against your configuration, and tell you when the work is done. Updating WordPress or its plugins does not patch the PHP runtime. Keep those updates on schedule too.
What changed in PHP?
On 21 October, PHP released 8.2.35, 8.3.36, 8.4.27 and 8.5.12 with fixes for two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Your host may instead supply a documented distribution or LTS vendor backport. PHP also lists minimal source backports for 7.4, 8.0 and 8.1; those branches are outside its regular support.
On 23 October, PHP issued a separate informational advisory for CVE-2026-115560. It applies only when an application switches from a configured php_binary or php_serialize session handler to php at runtime before session_start(), while session upload progress is enabled. PHP recommends disabling session.upload_progress.enabled until the next regular bugfix release for affected setups. Ask your host to assess and handle this setting; the 21 October version numbers alone do not settle this follow-up. PHP's dated announcements.
Four checks to request
- Identify the PHP package and version actually serving the site, or provide the vendor's documented backport.
- Confirm both 21 October fixes and assess whether the unusual 23 October configuration applies.
- Confirm all relevant PHP workers were restarted after the change.
- Afterward, check login, forms, checkout if present, uploads and scheduled tasks. Report anything broken or suspicious.
Copy this message to your host
Hello, our WordPress site runs on your hosting. Please confirm the PHP package and version serving it, or the documented vendor backport, and whether it includes the 21 October 2026 fixes for CVE-2026-109618 and CVE-2026-109619. Please assess whether the 23 October session upload progress advisory (CVE-2026-115560) applies to our configuration and handle PHP's recommended mitigation if needed. Were all relevant PHP workers restarted after the change? Please tell us when the work is complete and whether we should check any site functions or investigate any suspicious activity.
Does a patch mean the site was safe before?
No. A vulnerability announcement does not prove your site was breached, and installing a patch does not establish whether anything happened earlier. If you have suspicious logs, unexpected administrator accounts or altered files, ask for an investigation with a defined scope.
Need help assessing your site's exposure? See our scoped Website Security Check service.