PHP2Shell: what WordPress site owners should do this week

On October 21, 2026, Wiz Research published PHP2Shell, a set of flaws in the core PHP engine. PHP is the language WordPress, Drupal and Joomla run on, and Wiz says it powers about 70% of websites. PHP released a patch the same day. If your site runs on PHP, this is the week to apply it.

This article explains what happened in plain words, lists what to do in the next few days, and then looks at a longer question for small teams. The technical details come from the Wiz Research post.

What happened, in plain words

Most WordPress security news is about a plugin or a theme. PHP2Shell is different. The flaws sit in PHP itself, below WordPress and below every plugin you installed. A clean, up to date WordPress site can still be exposed if the PHP version under it is affected.

Here is what Wiz reports:

• The flaws are grouped under two identifiers, CVE-2026-109618 and CVE-2026-109619, with severity up to 9.2 on the CVSS scale.
• Every PHP version released in the last decade is affected by at least one of them, going back to PHP 5.4.
• Wiz showed that an attacker with no login could run code on the server, using the latest WordPress, Drupal and Joomla container images.
• Wiz also showed that an attacker could read parts of the PHP process memory, which can contain passwords, tokens, API keys and certificates.

Remote code execution means an attacker can run their own commands on your server, as if they held the keys to it.

What to do this week

You do not need to be a developer to move these steps forward. You need to know who manages your server and ask them the right questions.

1. Find out which PHP version you run. Ask your host or your IT team. If an agency maintains your site, ask them. Write down the answer and the date.
2. Apply the PHP security update. Wiz says applying the PHP security update is the only complete remediation. Updating WordPress core or your plugins does not fix PHP2Shell, because the flaws are in PHP. Ask your host to confirm by email when the patched version is in place.
3. Turn on your CDN or firewall mitigation if you cannot patch today. Wiz says Cloudflare, Akamai, AWS, Fastly, Imperva, Microsoft, Vercel and others prepared mitigations for teams that cannot patch right away. If your site sits behind one of these services, check its dashboard or support pages for PHP2Shell guidance. A mitigation buys time. It does not replace the patch.
4. Look for the warning signs. Ask whoever reads your server logs to check for the signals listed below.
5. Rotate secrets if you see them. If any signal shows up, assume memory could have leaked. Change database passwords, API keys and access tokens, and renew the certificates the site uses. Then review who has admin access.

Signals Wiz says to watch for

Wiz notes that these attacks happen below the application, so WordPress logs may show little. Server and PHP logs are the place to look. Watch for:

• Unusual multipart requests followed by memory limit errors or repeated HTTP 500 responses
• PHPSESSID cookies that are unexpectedly large or malformed
• PHP worker churn with no clear explanation, meaning workers that restart or cycle more than usual

None of these proves an attack on its own. They are reasons to look closer, and reasons to rotate secrets sooner rather than later.

Then, the bigger question

Once the patch is in, the urgent part is over. A harder question remains for small teams. Should you keep running a PHP server and a stack of plugins at all?

For many organizations the honest answer is yes. WordPress and Drupal are mature platforms with large communities. If your site works, your team knows it and someone owns updates, keeping it can be the right call. What matters is that the upkeep has an owner and a budget.

For others, PHP2Shell is the moment to admit the site costs more attention than it returns. A server to patch, plugins to update and security advisories to follow every month is a lot to carry for a marketing team of two or three people.

There are two reasonable paths:

• Keep WordPress or Drupal and harden it. Put PHP and plugin updates on a schedule, remove plugins you no longer use, place the site behind a CDN with a firewall, and decide who responds when the next advisory comes out.
• Move to a platform where you no longer run the server. Patching the underlying stack then becomes the provider's job. No platform is immune to attacks, and this one is no exception. What changes is who applies the patches and how much of that work lands on your team.

Sengo helps with either path. We start with your needs, your budget and your team. If your current CMS is still viable, we will tell you so and help you keep it in good shape. Our WordPress page explains how we work with the platform.

How Sengo moved its own 600 page site in one night

We made this choice for our own site. sengo.com used to run on WordPress. Two years in, plugins and security upkeep cost more attention than the site was worth. Today, sengo.com no longer runs on WordPress or PHP.

Our founder and CEO, Jean-Nicolas Gauthier, moved the site to Ploy, and Sengo is now an official Ploy partner. He set one condition. The move could not hurt Sengo's visibility in search or in AI answers.

• Before changing anything, Ploy's agent read every sitemap and all of the metadata. In about an hour, it found about 50 issues already on the live site.
• About 600 WordPress pages were migrated in one night.
• The new site went live after a few evening sessions over about a week.

"We basically migrated with Ploy in a night. So I was like, oh my God, this is nice."

Jean-Nicolas Gauthier, Founder and CEO, Sengo

The full story is in Ploy's case study on Sengo. Our site is one example, not a promise. Your content, integrations and team will shape what a move looks like for you.

Frequently asked questions

Does updating WordPress fix PHP2Shell?

No. The flaws are in PHP, the language WordPress runs on. Keep WordPress and your plugins up to date anyway, but according to Wiz, only the PHP security update fully fixes PHP2Shell.

Which PHP versions are affected?

Wiz says every PHP version released in the last decade is affected by at least one of the flaws, going back to PHP 5.4. Ask your host which version you run and when the patched release will be in place.

Is a CDN or firewall mitigation enough?

It helps while you wait for the patch. Wiz says applying the PHP security update is the only complete remediation, so treat a mitigation as temporary.

Get a clear answer for your site

If you are not sure where your site stands, start with our free WordPress audit. We review your site and give you a plain recommendation, whether that means hardening what you have or planning a move.

Request your free WordPress audit or talk to our team.

Sources

1. PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
   wiz.io
2. Sengo migrates its 600-page WordPress site to Ploy in one night
   ploy.ai