PHP2Shell Update: Still No Confirmed WordPress Compromises, and Answers to the Questions We’re Hearing Most
As of October 28, 2026, Wordfence knows of no WordPress site compromised through PHP2Shell. Update PHP to a fixed version and restart it, because updating WordPress does not update PHP.
TL;DR: As of October 28, 2026, Wordfence is not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
We continue to see PHP2Shell-related requests across the more than 5 million sites we protect. Those requests show ongoing scanning and exploitation attempts; they do not show whether an attempt succeeded. Our site-cleaning and incident response teams have not handled a WordPress compromise attributed to these vulnerabilities.
That does not make an unpatched server safe. The fix is still to update PHP on your server to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a vendor package confirmed to contain both fixes) and restart PHP. Updating WordPress does not update PHP.
It has been seven days since the PHP project released emergency fixes for PHP2Shell, two critical vulnerabilities in PHP, the programming language WordPress runs on. Since then, we have been analyzing security data from the more than 5 million WordPress sites Wordfence helps secure, testing the vulnerabilities in our lab and reviewing new reports from researchers and security vendors.
This post gives you the current status in plain terms, followed by short, direct answers to the questions we are hearing most.