On October 20, details of two serious flaws in PHP leaked online, a day before they were meant to be made public. PHP shipped fixes on October 21. Together they're being called PHP2Shell, and if your website runs on WordPress, it runs on PHP. What makes this different from the usual WordPress security news is simple: nothing in your WordPress dashboard fixes it.
What PHP2Shell is
PHP is the programming language WordPress is built on. It sits on your host's server underneath WordPress, your theme and every plugin, and it runs every time someone loads a page. PHP2Shell is two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 by PHP's security team. Either one can let an attacker with no login run their own code on the web server, with the same access your website has. That is the most serious kind of flaw there is.
Where things stand as of October 21: a working exploit has been demonstrated in which a single request, with no login, triggers the attack. By that afternoon, security firms were reporting attempts to exploit both flaws, and researchers expect them to be tried at scale. No one had reported a confirmed break-in. That's the window to act in. The technical detail is in The Hacker News, SecurityWeek, Help Net Security and Huntress.
Updating WordPress won't fix this
Most WordPress security advice comes down to one habit: keep WordPress, your theme and your plugins up to date. It's good advice, and it doesn't help here. The flaw isn't in WordPress. It's in the layer underneath, and that layer belongs to your host.
PHP fixed it in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and your host has to install one of them. Updating is the only complete fix. There are server settings that narrow some of the ways in, but no configuration change closes it fully.
So this week, a careful owner who installs every update the day it comes out is in the same position as one who never logs in. Both are waiting on the host.
You can do everything right and still be waiting on someone else's update.
Are you affected?
If your site runs WordPress, assume yes until your host says otherwise. You can see your PHP version in two minutes: in the WordPress dashboard, go to Tools, then Site Health, then the Info tab, and open the Server section.
If it shows 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a later release on the same line, you're on a fixed version. If it's lower than that on the same line, you aren't yet. One caveat: some hosts apply fixes to PHP themselves without changing the version number, so the number alone doesn't settle it. That's what the next step is for.
What to ask your host
Send your host two questions today. Which PHP version is our site on? And when will it be updated to a release that fixes PHP2Shell?
A good host should be able to answer both quickly, ideally with a date, and some will already have done the update. If you run your own server, the host is you, and the update is yours to make. If the answer is vague, that tells you something about who is watching the layer you can't see.
Why 8.1 or older is a bigger problem
If Site Health shows PHP 8.1, 8.0 or anything in the 7s, there is no official fixed release for you. PHP 8.1 lost security support on December 31, 2025, and the versions before it lost theirs earlier. The PHP team did publish bare source-code fixes for 7.4, 8.0 and 8.1, meant for people who build PHP themselves, and some hosts may apply their own. Ask yours directly whether they have.
The lasting fix is moving to a supported version, and that's where older sites get stuck. Sites usually stay on old PHP because an old theme or plugin breaks on a newer one, so moving up means testing, and sometimes replacing whatever breaks. If you're doing that work anyway, aim past 8.2: it reaches its own end of life on December 31, 2026.
Where we stand
Here's our point, plainly. THINQ Site, the platform we build and host our clients' websites on, doesn't run PHP at all. No PHP, no database, no plugins running on the server. PHP2Shell has nothing to hit on a THINQ Site, and there's no PHP update for anyone to wait on.
That isn't a promise that a THINQ Site is immune to every attack. No honest web firm makes that promise. It's a narrower claim we can stand behind: this whole category of problem doesn't apply to it. In September we wrote that the real cost of a traditional CMS is everything after the first edit: a database to secure and a stack of plugins to patch on somebody's schedule. This is the kind of week we had in mind. We built THINQ Site without those layers because we'd rather remove a risk than manage it.
If you're weighing a move off WordPress, start by deciding what not to bring with you. And if you'd like a straight answer on where your site stands or what a move would involve, send us the address.
