PHP needs attention separately from WordPress
An up-to-date WordPress dashboard can sit on top of an unpatched PHP installation. The PHP2Shell issues, CVE-2026-109618 and CVE-2026-109619, are in the software your hosting uses to run PHP websites. WordPress, plugin and theme updates do not install these PHP fixes.
Step 1 of 7
In this guide
Find the website in your PHP settings
Find the website in your PHP settings
- Open your hosting account and enter cPanel.
- Choose Select PHP Version or MultiPHP Manager, whichever your host provides.
- Find the PHP setting for the website and note the number shown. A label such as 8.3 identifies the version family, without confirming its security patch level.
Next, check the exact version number in WordPress.
Next: Check the exact version in WordPressCheck the exact version in WordPress
Check the exact version in WordPress
- Log in to your WordPress dashboard.
- Go to Tools → Site Health and open the Info tab.
- Open the Server section and read PHP version, for example 8.3.35.
This is the version your website uses, so it is the number to compare in step 3. Not using WordPress? Ask your host for the exact PHP version your website runs.
Next, compare this number with the patched versions.
Next: Check the release against the security fixesCheck the release against the security fixes
Check the release against the security fixes
- PHP 8.5: the first fixed release is 8.5.12; use that or a later release in this family.
- PHP 8.4: use 8.4.27 or a later release in this family.
- PHP 8.3: use 8.3.36 or a later release in this family.
- PHP 8.2: use 8.2.35 or a later release in this family.
- PHP 8.1 and earlier: arrange a supported-version upgrade, or get confirmation that your host has supplied the security fixes.
- Some hosts put the fix into an older release without increasing the displayed PHP number. This is a backport; ask the host to confirm it if the number alone leaves you unsure.
The PHP security advisory lists the fixed releases. For instance, an upstream 8.3.35 release precedes the 8.3.36 fix; a host backport needs separate confirmation.
A confirmed patch addresses these PHP faults. If you suspect an earlier break-in, still complete step 7.
Next: Choose a patched PHP release in cPanelChoose a patched PHP release in cPanel
Choose a patched PHP release in cPanel
- Back up the website files and database before making the change.
- Check that your plugins, theme and other website software support the PHP release you intend to use.
- Return to Select PHP Version or MultiPHP Manager in cPanel.
- Choose the supported, patched release for the relevant website and apply the setting.
- If you can only select a family such as 8.3 or 8.4, ask the host which full release or backported fix it supplies.
A change from the 8.3 family to 8.4 still leaves the patch question unanswered. Confirm the full release or the host-applied fix.
With the patch confirmed and the change applied, check the website in step 5.
Next: Check the parts visitors actually useCheck the parts visitors actually use
Check the parts visitors actually use
- Load the home page and several other pages.
- Try the contact forms and check they work.
- Sign in to the WordPress administration area.
- Try the plugins and features the business relies on.
- For a shop, check the checkout process as well.
- Look through the PHP error log for problems after the change.
If something breaks, use the PHP error log to help identify a plugin, theme or application compatibility problem and involve the host if needed. Leaving the site on a vulnerable PHP release is not a lasting solution.
When the site works and the patch is confirmed, the update is complete. Investigate any suspected compromise separately in step 7.
Next: Get the hosting provider to confirm the patchGet the hosting provider to confirm the patch
Get the hosting provider to confirm the patch
- Contact hosting support if the required release is unavailable or you cannot confirm the patch.
- Ask them to verify that both CVE-2026-109618 and CVE-2026-109619 are fixed in the PHP installation serving your website, including any CloudLinux backports.
- If either fix is missing, request an urgent server-side update.
After the host applies the fix, return to step 5 and check the website.
Next: Follow up on anything that suggests a break-inFollow up on anything that suggests a break-in
Follow up on anything that suggests a break-in
- Examine the website access and error logs for unusual activity.
- Review WordPress administrator accounts for entries you do not recognise.
- Check for website files that have changed unexpectedly.
- Run a malware scan of the website.
- Ask the hosting provider or IT support to investigate anything suspicious.
Share the findings with your host or IT support so the investigation can continue.
Book IT supportFrequently asked questions
Does updating WordPress deal with PHP2Shell?
PHP is managed through the hosting separately from WordPress. Installing WordPress, plugin or theme updates does not apply the PHP fixes.
Which PHP releases include the PHP2Shell fixes?
The first fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Some hosts supply backported fixes under older numbers, so ask them to confirm the patch when the displayed version is unclear.
Where do I find the exact PHP version my website uses?
In WordPress, go to Tools → Site Health → Info → Server and read PHP version. If your website doesn't use WordPress, ask your host for the exact version.
What if cPanel does not offer the patched PHP release?
Ask the hosting provider to confirm both CVE fixes for the PHP installation serving your website, including any CloudLinux backports. Request an urgent update if the fixes have not been applied.
Will the PHP update clean up a website that was already hacked?
An update addresses the PHP faults, but an earlier break-in needs investigation too. Review logs, administrator accounts and file changes, run a website malware scan, and involve your hosting provider or IT support.
