How to fix PHP2Shell on a WordPress site

1. Find the exact PHP version

• WordPress: Tools → Site Health → Info → Server shows the full version, such as 8.3.36.
• A hosting control panel (for example cPanel MultiPHP Manager) usually shows the branch; ask the host for the patch number.
• If the site sends an X-Powered-By: PHP/… header, it shows the version. A missing header means unknown, not safe.

2. Decide what to change

• Already at or above the fixed release for its branch: no update needed; still confirm with your host and check logs.
• Supported branch (8.2–8.5) below the fix and you control PHP: update to the fixed release.
• Your host controls PHP: open a ticket quoting CVE-2026-109618, CVE-2026-109619 and the target version.
• PHP 8.1 or older: plan an upgrade to 8.3 or newer after testing themes and plugins on a staging copy; ask the host about a backported build meanwhile.

3. Restart and verify

After the update, PHP-FPM or the web server must restart so the new interpreter loads. Re-open Site Health and confirm the new patch number. A host saying “done” is not confirmation. Then load the homepage, one inner page and the login screen.

4. Look for warning signs

• Unfamiliar .php files in wp-content/uploads or other writable folders.
• Recently changed PHP files nobody on your team recognises.
• Bursts of POST requests to unfamiliar paths, or eval or base64_decode in error logs.
• Administrator accounts you did not create.

How Oruanyi can help

• Free passive scan at oruanyi.com/scan: public pages only, after you confirm by email.
• Authorized security scan: exact PHP version, deprecated software and common security gaps, with a written report and recommended fixes. One-time, non-refundable; priced on oruanyi.com/scan.
• PHP security remediation: only after a scan finds PHP2Shell or another critical PHP issue, quoted in writing first. Price options are on oruanyi.com/scan.
• Before any work, the site owner, or senior management authorized to decide, confirms in writing.

Sources

1. GHSA-w8hw-w9fx-j79w — RCE via OOM corruption (CVE-2026-109618), PHP security advisory
2. GHSA-6wmf-4rv5-p3rp — RCE via stale global state (CVE-2026-109619), PHP security advisory
3. PHP 8 ChangeLog, php.net
4. Supported PHP versions, php.net