On October 21, 2026, serious security weaknesses were disclosed in PHP, software that powers websites, and fixed versions were released. If your site uses WordPress or similar software, check your hosting provider’s official notice today. If anything is unclear, contact your web agency or maintenance provider. Using PHP does not mean your site has been compromised. The main question is whether the PHP running on your server has received the fixes.
What happened?
PHP is software that creates pages on a server. “PHP2Shell” refers to two vulnerabilities, or security weaknesses, in PHP itself: CVE-2026-109618 and CVE-2026-109619.
The IPA security alert (Japanese) says that attackers could exploit these weaknesses to run programs remotely. Editing WordPress posts or changing appearance settings will not fix them.
As of October 2026, the PHP project has released the following fixed versions, according to its official announcement.
PHP branch in use | Fixed version for these vulnerabilities |
|---|---|
PHP 8.2 | 8.2.35 |
PHP 8.3 | 8.3.36 |
PHP 8.4 | 8.4.27 |
PHP 8.5 | 8.5.12 |
However, hosting providers sometimes apply fixes without changing the displayed version number. An older number alone does not prove that a server is unpatched. PHP 8.1 and earlier have reached the end of regular support from the PHP project, so ask about your provider’s own fixes and its plans for future upgrades.
How to find out whether your site needs attention
Your situation | Who to contact and what to check |
|---|---|
You use WordPress | Ask your host or maintenance provider whether PHP has been patched |
A web agency manages your site | Ask whether your contract also covers server maintenance |
You have a shared hosting account | Identify the exact hosting service and read its official notice |
You do not know how your site was built | Check the original contract or invoices to find who manages it |
You have been told the site is static | Ask whether forms or administration tools still use PHP |
You may be able to find the PHP version by selecting your domain in your hosting control panel and looking for PHP settings or information. Labels vary by provider. If you cannot find it, leave the settings as they are and contact support.
If you have several sites, check each domain: settings can differ even within one hosting account. Record the displayed version, domain, and date to make your inquiry easier to answer.
Have hosting providers applied the fixes?
The table below summarizes official notices checked on October 24, 2026. Confirm that each completion notice actually covers the service you use. These are Japanese hosting providers; readers elsewhere should check their own host’s notice.
Service | What its official notice confirms |
|---|---|
Xserver (Japanese) | Fixes applied to all offered PHP versions from 5.6 through 8.5. For PHP 5.5 and earlier, fixes applied to more than half of the affected servers |
Sakura Rental Server and Managed Server (Japanese) | All PHP versions selectable in the control panel patched. The provider says no emergency action is required from users |
Lolipop! Rental Server (Japanese) | Sites brought back online after patches were applied. Users asked to check functionality following changes to PHP behavior |
ConoHa WING (Japanese) | All offered PHP versions patched without changing their version numbers. The provider says users do not need to change settings to address these vulnerabilities |
Do not assume that a shared hosting notice also applies to the same company’s VPS service. Some VPS contracts make the customer responsible for software updates.
Lolipop says it observed requests believed to target these vulnerabilities, but had not confirmed resulting unauthorized access or data leakage at the time of its notice. An attempted attack and confirmed damage are different things.
What to do today
Identify your site and providers. Note the domain, hosting company, and web agency or maintenance contact.
Read your host’s official notice. Match the service, PHP version in use, and scope of completed work to your account.
Ask about anything unclear. Confirm whether and when fixes were applied, and whether you need to take any action.
Check the site after the update. Test the homepage, contact form submissions, bookings, purchases, and other functions you normally use.
Keep a record. Save the reply, the date you checked, and who is responsible for any remaining work.
Moving to a different PHP branch may require checking compatibility with older themes or programs. You do not need to switch settings based on a version number before reading the official notice. When arranging an update, also discuss backups, functionality checks, and how problems will be handled.
IPA (Japanese) advises assessing whether access restrictions or a temporary shutdown are necessary, taking business impact into account, when updating is difficult and no effective temporary measures are available. If you are unsure whether your site needs to be taken offline, discuss it with the person responsible for maintenance.
An email to your web agency or hosting provider
You can copy and adapt this inquiry:
Hello,
I am writing to ask about the PHP vulnerabilities disclosed in October 2026 (CVE-2026-109618 and CVE-2026-109619) and the website you manage for us: [website URL].
Could you please confirm whether the PHP version in use has received the PHP project’s fixed release or your provider’s patches? If so, please let us know when the fixes were applied. If the patches were applied without changing the version number, please confirm that as well.
Please also let us know whether we need to change any settings, check any site functions, or arrange further investigation.
Thank you for your help.
You do not need to add passwords or control panel credentials to this message. The website URL lets the recipient identify the relevant account or contract.
How to prepare for future maintenance incidents
For sites focused on company information or articles, one option is to combine static output—serving pages generated in advance—with a headless CMS that manages content separately. This can avoid running PHP or a database for every public page request. You still need to maintain the publishing process, previews, forms, and other functions. Your current setup also has advantages if it supports the WordPress dashboard and plugins you already use. After applying the current fixes, use our guides to how headless CMS architecture differs from WordPress and what to check when migrating as background for your next maintenance review.
For your technical contact, see PHP2Shell patch verification and site architecture.
FAQ
Is my WordPress site safe from the PHP vulnerabilities?
Using WordPress alone does not tell you whether your site is safe or has been compromised. Ask your hosting provider or maintenance contact whether the server’s PHP has received these fixes.
Do I need to update PHP on shared hosting?
If your hosting service applies patches for you, you may not need to change anything yourself. Read the official notice for your exact service and carry out any required actions and functionality checks.
My PHP version number is still old. Does that mean it is unpatched?
Some providers apply fixes without changing the version number, so the number alone is insufficient. Check the official completion notice and confirm that it covers your server.
Will updating WordPress or plugins fix this?
The fixes you need to confirm are for PHP itself. Check the server-side response separately from WordPress and plugin updates.