23 October 2026 · Turing Websites
WordPress PHP Security Update: PHP2Shell
Get help updating WordPress PHP, fixing theme and plugin compatibility, and checking WooCommerce checkout after PHP2Shell. Includes an editable checklist.
Request urgent PHP update helpIn short
PHP2Shell is fixed in the PHP runtime that serves your WordPress site. Updating WordPress, themes or plugins does not apply that fix. Ask your host to confirm both CVEs are patched, then check compatibility, forms and WooCommerce orders. Turing Websites can carry out the supported update and repair work.
Keep your WordPress enquiries, bookings and WooCommerce orders working while PHP is updated. Turing Websites can apply supported PHP changes where you control the hosting, work with your managed host and repair theme, plugin or application compatibility faults.
Get WordPress PHP update help with your URL, host and the customer action to check. The PHP security update service covers hands-on update, repair and verification work.
Guidance checked: 23 October 2026. This guide covers WordPress and WooCommerce. For the server choices on Amazon, use our AWS PHP update guide.
Confirm who updates your WordPress PHP
PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619. The flaws sit in PHP itself, beneath WordPress. The WordPress security announcement tells owners to check with their host and explains why a WordPress core update does not deliver this fix.
| Your setup | What to establish | Useful next action |
|---|---|---|
| WordPress.com or another Automattic-hosted service listed below | The provider's published protection status | Follow its current guidance; investigate any separate site symptoms |
| Managed WordPress hosting | Whether both fixes are applied to this site's serving runtime | Ask the host for package/CVE confirmation and any remaining restart or deployment |
| Your own VPS, dedicated server or cloud instance | Who maintains the PHP packages or container image | Apply the supported security update and check the application |
| WordPress on AWS Lightsail | Whether the instance uses an AWS-packaged or Bitnami blueprint | Follow the matching AWS update route; the PHP installations differ |
Automattic says WordPress.com, WordPress VIP, WP Cloud, Pressable and Tumblr are already protected. WordPress.com's notice includes every plan, WooCommerce and staging sites. Those owners do not need an emergency PHP change for these CVEs.
Check the serving runtime and its patched package
In WordPress, open Tools → Site Health → Info → Server. Record the PHP version and server API, then ask the hosting owner to confirm the package serving this URL. The command-line PHP can be a different installation.
The PHP project's fixed upstream releases are:
| PHP branch | Fixed upstream release |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
A later maintained release on the same branch also includes these fixes. Vendor backports can retain an older-looking version, so ask for evidence covering both CVEs. PHP 8.1 and older have ended routine upstream support. Exceptional source backports for some older branches do not restore that support; a maintained runtime gives the site an ongoing update path.
Use our general PHP2Shell guide for package and mitigation distinctions.
Keep themes, plugins and customer data compatible
Start with a recoverable copy of the database, uploaded files, application code and server configuration. Keep the current records intact while you check the update on a separate environment. Disconnect staging from customer emails, live payments and production webhooks.
Check the active theme, child theme, plugins and custom code against the intended PHP branch. An urgent security patch within a supported branch and a move from an obsolete branch can involve different compatibility work. Repair deprecated calls, extension requirements and integration faults against the site's own behaviour.
For a supported system, we can carry out that technical work and help the hosting owner verify the running PHP change. Your site's bookings and orders determine the checks.
Verify an enquiry or order from start to finish
| Customer action | Check after the update |
|---|---|
| Contact form | A permitted test message reaches its saved record and notification destination |
| Booking | Availability, the appointment record and confirmation match |
| WooCommerce checkout | Supported test-mode payment, order status, tax, delivery and receipt agree |
| Account or membership | A test user can sign in and complete the relevant task |
| Connected workflow | The destination receives one intended record with the expected fields |
Record the tested environment, time and result. For a live shop, preserve orders created during the change window and reconcile them before any database recovery. A database restored from yesterday can replace today's orders; recovery must account for that difference.
Download the editable WordPress PHP update checklist (TXT)
and keep the runtime evidence and customer-action results together. It is free to use with your host or developer.
Get help with the update and compatibility fixes
Send your WordPress PHP update enquiry. Include the public URL, hosting provider, any patch confirmation and what needs to work: enquiries, bookings, membership or checkout.
If an update is blocked, use the current PHP advisory with the hosting owner. Temporary configuration controls are incomplete. The UK NCSC guidance explains when taking an affected system offline should be considered. Suspected compromise belongs with the host's security team or an appropriate incident-response specialist as well as any application repair.
Keep passwords, hosting keys, customer records and raw logs in a secure support channel. For disrupted deliveries after a website update, our sister team covers PHP webhook and automation recovery.
PHP security · WordPress · WooCommerce · website repair