This is how you protect your WordPress website.
At the end of October 2026, a very serious vulnerability shattered the web community, affecting a significant portion of the servers that serve websites. The vulnerability discovered by security experts (known in the industry as “PHP2Shell”) opens a loophole for attackers on servers running older PHP versions. If you’re a website owner, it’s crucial to check your system now.
In this article, I will show you exactly what the problem is, who it affects, and how you can check whether your website is safe even without technical knowledge.
What exactly happened?
The latest critical PHP vulnerabilities (including CVE-2026-109618 and CVE-2026-109619) were released in the third week of October 2026. The essence of the vulnerability is that under certain conditions, attackers can run malicious code remotely on the server, which in the worst case can lead to a loss of full control over the website, data leaks, or infecting visitors.
Since WordPress is a PHP-based system in itself, the security of the engine running in the background is critical. Your website is full of the best security plugins in vain, if the server environment itself is vulnerable, the walls can collapse.
Who is affected by the problem?
This issue affects older PHP versions. If your hosting is running one of the following versions, your site may be at risk:
- PHP 7.4 (has not been supported for a long time)
- PHP 8.0 and 8.1
- Certain subversions of PHP 8.2
The solution is PHP branch 8.3 (with a minimum of version 8.3.36), and the more recent releases that have already been prepared for this, in which the developers have already patched these vulnerabilities.
How to check the PHP version of your website (in WordPress)?
You don't have to be a programmer to figure out what kind of engine drives your website. With WordPress’ built-in tools, you can check in no time:
- Go to your WordPress dashboard (Admin interface).
- In the menu on the left, find the Assets menu, and then click Site Health option.
- On the page that appears, at the top, switch to Information tab.
- Scroll down and open the Server section.
- Here, right around the first or second row, you will find the PHP version value.
How do you evaluate the result?
- 8.3 or later (e.g. 8.3.36): I have great news, your website runs in the most up-to-date and secure environment. There is no further action to be taken.
- 7.4, 8.0, 8.1 or 8.2: Intervention is required. Your hosting should be updated to the latest version of PHP as soon as possible.
What to do if you need to update?
You can switch the PHP version not within WordPress, but through your hosting provider’s interface (e.g. cPanel, Rackhost admin, DirectAdmin). For most providers, this is available under “Select PHP Version”, “PHP Settings”, or “MultiPHP Manager”. Here, simply select version 8.3 from the drop-down menu and save the settings.
Tip: After changing the version, be sure to click through the main features of your website (add to cart, submit forms) to make sure that both the plugins you use and your template are flawlessly compatible with the new environment.
If your website is maintained by a professional, chances are you’ve already taken care of this update. In recent days, I have also switched my managed systems and dedicated servers to new, secure protocols.
If you don’t have an active maintainer, aren’t sure, or simply don’t want to touch server settings, don’t let your security hang in the air. Contact your hosting provider or feel free to contact me for an ad-hoc order and I’ll help you secure your system.
