Security
php2shell and WordPress: Where the PHP Patch Stands and What to Check
PHP fixed two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, on October 21, 2026. A WordPress site is exposed when the PHP under it is unpatched, even if WordPress, its plugins and themes are current. The fix is a PHP update from your host: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.