- Home
- News from us
- Guide
What is PHP2Shell? Your WordPress site is patched, but is it clean?
Why the PHP2Shell (CVE-2026-109618) flaw cannot be fixed from the WordPress admin, how to check your PHP version, backdoor risks and lasting fixes.
You arrive at the office in the morning, email a price quote to a client, and get a call in the afternoon: "Your quote never arrived; we found it in spam." The same week, you search your company name on Google and see links under your domain for gambling pages or products you have never sold. Your website opens normally on your screen and every plugin in your WordPress dashboard says up to date, yet the server behind it has already been taken over. The global PHP2Shell crisis unfolding this week creates exactly this situation.
01What is the PHP2Shell flaw and why is it dangerous?
PHP2Shell refers to two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2) disclosed in October 2026 inside the core PHP language engine. They allow attackers to take control of a web server remotely with a crafted request, without needing a username or password.
Two memory-handling bugs sit at the root of the problem. The first (CVE-2026-109618) happens when PHP hits an out-of-memory condition during large uploads or heavy payloads and mistakenly treats corrupted request data as valid during cleanup. The second (CVE-2026-109619) allows leftover internal state from an earlier request to survive after its memory is freed and execute on the next request handled by the same worker.
Because every WordPress and WooCommerce site runs on PHP, any server running an unpatched PHP build is exposed regardless of which theme or security plugin is installed inside WordPress.
02Why is updating from the WordPress dashboard not enough?
Logging into your WordPress admin panel and clicking update on core, themes and plugins does not close the PHP2Shell flaw. The bug does not live inside WordPress files; it lives inside the underlying PHP interpreter that runs WordPress.
Think of WordPress as the furniture inside a building and PHP as the concrete foundation underneath. Updating plugins only rearranges the furniture; fixing a crack in the foundation requires updating the PHP runtime at the server, hosting or container level.
| PHP branch | Vulnerable versions | Safe (patched) version | Status and required action |
|---|---|---|---|
| PHP 7.4, 8.0, 8.1 | All sub-versions | No official patch | End of life; upgrading to a supported branch is required |
| PHP 8.2 | 8.2.34 and earlier | 8.2.35 | Update immediately from the hosting or server panel |
| PHP 8.3 | 8.3.35 and earlier | 8.3.36 | Update immediately from the hosting or server panel |
| PHP 8.4 | 8.4.26 and earlier | 8.4.27 | Update immediately from the hosting or server panel |
| PHP 8.5 | 8.5.11 and earlier | 8.5.12 | Update immediately from the hosting or server panel |
03What does a company with "just a brochure site" stand to lose?
Many business owners assume that if their site does not process credit cards and only shows product catalogues and a contact page, an attacker has nothing to steal. Automated bots are not after your product photos; they are after the Google authority and email reputation your domain has built over years.
| Technical compromise | Real cost to the business |
|---|---|
| Hidden SEO spam pages | Your company name appears on Google next to gambling or counterfeit drug links, destroying your search rankings |
| Conditional visitor redirects | Real buyers arriving from Google or ads are redirected to scam sites, while you still see the normal page when visiting from the office |
| Outbound spam from your server | Your domain and server IP land on global blacklists; legitimate quotes and invoices sent to clients go straight to spam |
| Google red warning screen | Chrome and Safari show visitors a deceptive-site warning, wiping out traffic and customer trust overnight |
| Phishing pages in subfolders | Fake banking login screens are hosted under your domain, leading to suspended hosting accounts and legal notices |
| Form and account data leaks | Incoming quote requests and dealer passwords passing through the server are copied, triggering data-breach reporting duties |
In short, "we have no sensitive data on the website" is a false comfort. What is at stake is your company's commercial reputation and ability to reach customers by email.
04How do you check your site's PHP version in 2 minutes?
Even without an IT team, you can check which PHP version your WordPress site is running in two minutes:
- Log into your WordPress admin panel. Open your usual
/wp-adminaddress and sign in. - Open Site Health. In the left menu, click Tools and then Site Health.
- Switch to the Info tab. Click Info at the top of the page and expand the Server section.
- Read the PHP version line. If the number is lower than
8.2.35,8.3.36,8.4.27or8.5.12(or starts with7.4,8.0or8.1), your server is exposed.
If you do not have WordPress admin access or run a custom PHP site, send us your website address using the link at the bottom of this page; we can check your public server headers and report back within minutes.
05Why might a patched site still not be clean?
The most overlooked truth in incident response is simple: patching locks the door, but it does not remove someone who already walked inside.
Automated scanning and exploitation against PHP2Shell began on the morning of October 21, 2026. If your hosting provider or system administrator applied the patch on October 24 or later this week, your server sat unlocked during the days in between. When automated bots breach a PHP server, their first move is to plant a persistent backdoor:
- They drop disguised command scripts that look like harmless image or cache files (
logo.icoorcache.php). - They insert a hidden administrator account directly into the WordPress database (
wp_users) that does not show up in the normal user list. - They add a scheduled server task (
cron) that quietly re-downloads the malware every night even if you delete the infected file.
Updating PHP only changes the lock on the front door. Knowing whether the server is actually clean requires auditing files modified since October 21, inspecting database admin records and reviewing scheduled tasks.
06How do you move off fragile WordPress and WooCommerce stacks for good?
Trying to run B2B dealer ordering, live stock or high-volume e-commerce by stacking thirty plugins on top of a blogging engine means living with a new security fire drill and plugin conflict every month. Updating a plugin risks breaking checkout; delaying the update leaves the server exposed.
In the systems we build at LABONNI, we remove that cycle at the root:
- Serverless edge architecture: Your marketing and content pages are served directly from global CDN edge nodes without a live PHP interpreter sitting behind them. Where there is no running PHP process or open server shell, there is no server to hijack.
- Purpose-built B2B core: Wholesale pricing tiers, dealer credit limits, open-account balances and accounting integrations run on a dedicated software core rather than fragile third-party plugins. Our ready-made dealer portal Bayibox and our auto parts B2B and e-commerce platform are built on this foundation.
- Zero maintenance dread and full data ownership: You never worry about PHP upgrades or broken plugin updates. We take no cut of your revenue. Your data and domain stay with you, and you can export your records at any time.
When migrating from an existing WordPress or WooCommerce site, we carry over your products, customer accounts and existing Google URLs (with proper redirects) without losing search rankings. You can review our plans and models on our pricing page.
07Frequently asked questions
My hosting provider says they updated the server. Am I still at risk?
Yes. Updating PHP blocks future attacks using this flaw, but it does not clean up anything that happened between October 21 and the day the patch was applied. If an automated bot planted a webshell or hidden admin user during that window, it remains active on the patched server.
Does a security plugin like Wordfence protect me from PHP2Shell?
Plugin-based firewalls run inside WordPress after PHP has already started processing the request. Because PHP2Shell occurs inside the core PHP runtime itself during request memory handling, relying on a WordPress plugin alone is not enough; server-level PHP patches and network-edge filtering (such as Cloudflare WAF) are required.
Will upgrading PHP from 7.4 to 8.3 break my website?
If your site relies on an older theme or plugins that have not been updated in years, there is a high chance of compatibility errors. Rather than flipping the PHP version on a live store and risking downtime, test on a staging copy first or use the moment to move onto a modern stack.
How do you check whether our site is clean?
We start with a free check of your public server headers, exposed PHP version signals and any visible redirect or spam indicators. When a deeper server audit is needed, we inspect files modified after October 21, database administrator tables and scheduled tasks, and deliver a written report.
Will our orders stop if we move from WooCommerce to Bayibox or a custom system?
No. Your new system is set up and tested on a staging address first, with your product catalogue and dealer data imported. Once your team approves everything, we point your domain to the new platform in minutes with zero interruption to daily orders.