On October 21, 2026 the PHP project released emergency fixes for two critical vulnerabilities known together as PHP2Shell. Because WordPress runs on PHP, every WordPress site owner woke up to the same three questions: am I affected, what do I do, and how do I check? This guide answers them in order.
What is PHP2Shell?
PHP2Shell is the collective name for two critical vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619) that can allow unauthenticated remote code execution on a server running PHP. The flaws were uncovered with the help of AI-assisted security research and fixed by the PHP project in emergency releases on October 21, 2026. The response was worldwide: hosting providers pushed emergency updates and firewall rules, sites went offline as operators patched, and security agencies in the US and Europe urged immediate action. Security vendors reported probing attempts shortly after the advisory.
Is WordPress affected?
Yes, in the same way as every other PHP application: the vulnerabilities are in PHP, not in WordPress. WordPress.org has stated that no WordPress update is required or planned for these issues, because the fix is a PHP update, which on most sites is applied by the hosting provider. The risk is considered highest for servers running mod_php, where a request can trigger the flaw before any application code runs, but all PHP setups serving web requests are concerned, including PHP-FPM, php-cgi and LiteSpeed.
Which PHP versions are affected?
| PHP branch | First fixed release | If you run it |
|---|---|---|
| 8.5 | 8.5.12 | Update to 8.5.12 or newer |
| 8.4 | 8.4.27 | Update to 8.4.27 or newer |
| 8.3 | 8.3.36 | Update to 8.3.36 or newer |
| 8.2 | 8.2.35 | Update to 8.2.35 or newer |
| 8.1 and older | None | End of life: no official fix. Upgrade to a supported branch, or rely on a hosting or Linux distribution backport |
One caveat when checking: Linux distributions often backport security fixes without changing the version number, so a version string older than the first fixed release means the server may be affected, not that it certainly is. Your hosting provider can confirm what they patched.
What should you do?
First, find out which PHP version your site runs: your hosting panel shows it, and so does the Site Health screen in WordPress under Tools. Second, update: on managed hosting this is usually one click or already done, and your host’s announcement will say so. Third, if the site is stuck on an old PHP branch because of plugin or theme compatibility, treat this as the moment to plan the upgrade rather than stay exposed. And if your site ran an affected version while exposed to the public internet, a check of the site’s integrity is a reasonable precaution, not paranoia.
How can an AI agent help?
Novamira gives a connected AI agent three concrete tools for exactly these steps. The agent is told when the server runs a PHP version older than the first fixed release of its branch, with the advisory details, so it can recommend the update without you asking. The free PHP Compatibility Check skill covers the upgrade path: it checks whether your plugins, theme and custom code are ready for a newer PHP version, and proposes a fix for each thing that would break, before you switch versions in your hosting panel. And the free Site Integrity Check skill walks the agent through checking the site itself: known vulnerabilities in installed software, unknown administrators, modified or injected files, malicious code in the database. The site integrity guide covers that check in detail, and both skills work in Read Mode, so on a live site they run with read abilities only.
Where to learn more
The PHP project’s security release announcement has the authoritative details and the temporary mitigations, and WordPress.org’s post covers the WordPress angle. For the Novamira side, the announcement explains what shipped in response, and the skills are built into Novamira, free from the download page.