PHP2Shell: What UK WordPress Website Owners Should Do
Start with evidence of your host's PHP patch status. Then decide whether the work is a routine security update or an incident that needs investigation.
What the advisory means
On 21 October 2026, the PHP project published fixes for CVE-2026-109618 and CVE-2026-109619. These are runtime vulnerabilities with potential for unauthenticated remote code execution. Updating WordPress plugins does not update PHP itself. Use the official PHP advisory as the technical reference.
Ask your host a precise question
Ask which PHP package or build serves your domain, whether both fixes are included, and whether the web workers now run the patched build. Request a vendor advisory or other patch evidence. Distribution backports mean a version banner alone may be misleading.
Please confirm fixes for CVE-2026-109618 and CVE-2026-109619 on the PHP runtime serving our website, provide the relevant vendor/package evidence, and identify any remaining action for our account.
Keep business functions working
Agree backups, rollback and a change window with the technical owner. After updating, test sign-in, enquiries, uploads, payment flows and the integrations the business depends on. Record the checks performed and any limits on verification.
Separate patching from recovery
A vulnerable installation does not prove a breach. Equally, a newly patched runtime does not remove an existing web shell or revoke stolen access. If you see redirects, new accounts or reinfection, preserve available logs and ask for an investigation before evidence is overwritten.
If customer or employee information may be involved, record what happened and involve the person responsible for your privacy response. Technical recovery findings can support that assessment; a clean malware scan alone does not establish whether data was accessed.
For agencies managing many sites
Keep an inventory of domain, host, runtime, patch evidence, business owner and verification date. Prioritise unknown status and high-impact sites, and agree how client updates will be communicated. Request an agency portfolio review.
Request scoped help
WebAdish offers patch verification, coordinated runtime updates and incident recovery for UK businesses. Discuss your PHP security response or review our ongoing security retainers.
Reviewed 22 October 2026. Background reporting: Securelist PHP2Shell report. Neither a public banner nor this guide is a site-specific vulnerability assessment.
Related Recovery Resources
If this article is part of an active incident, use these core pages next.
Scope and fees for PHP response work are agreed before we start.