WordPress on PHP 7.4, 8.0 or 8.1? The PHP2Shell fix skipped your version.
On October 21, 2026 the PHP project shipped fixes for PHP2Shell, but only for PHP 8.2 to 8.5. Older branches are end-of-life: no official release, now or for the next advisory. That still covers a large share of WordPress sites. Here is what your options really are, how to upgrade without breaking anything, and how to check whether someone got in first.
"Just update PHP" doesn't work when your version has no update
For sites on PHP 8.2 or newer, PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was a routine update. For sites on PHP 7.4, 8.0 or 8.1, the PHP project only published source-level backports. Whether you actually got a fix depends on your host or Linux vendor.
That is not a niche problem. An analysis of WordPress.org's public statistics on October 22, 2026 found that about 36% of WordPress sites reporting to WordPress.org were still on PHP 8.1 or older. The figure only counts sites that contact WordPress.org, so treat it as an estimate, not a census.
And PHP2Shell won't be the last advisory. Every future PHP security release will skip these branches too.
- In WordPress: Tools → Site Health → Info → Server shows the PHP version.
- In your hosting panel (cPanel, hPanel, Plesk): look for "PHP version" or "PHP configuration".
- Some hosts install patched builds without changing the version number. If you see 7.4, 8.0 or 8.1, ask your host whether your build includes the October 21 fixes.
Three ways out, and only one that lasts
Status of vendor fixes as reported on October 25, 2026. It changes fast, so confirm with your own host or vendor.
| Option | What it is | The catch |
|---|---|---|
| Host or distro backport | Your host or Linux vendor rebuilt the old PHP with the fix. Reported for some setups: cPanel EasyApache 4, CloudLinux alt-php, Red Hat, and Ubuntu 22.04's PHP 8.1. | Coverage is uneven by version and vendor. It's a stopgap: you're still on a branch PHP no longer supports. |
| Paid extended support | Commercial long-term patching for old PHP, such as Ubuntu Pro, Freexian ELTS or TuxCare. | A yearly cost to stay on old code. Mostly useful when an upgrade is truly blocked for a while. |
| Upgrade to PHP 8.3 or 8.4 | Move the site to a supported branch that gets every future fix from PHP itself. | Old themes and plugins may need updates or replacements. That's the work, and it's why it should be done on a copy first. |
Skip PHP 8.2 as a target. It gets security fixes only until December 31, 2026, so you'd be doing this again in two months. WordPress 7.1 runs on every PHP version from 7.4 to 8.5 and recommends 8.3 or newer.
A related issue disclosed on October 23 (CVE-2026-115560) has no fix yet, and none is planned for end-of-life branches. PHP's interim advice applies to every server:
session.upload_progress.enabled = 0Set it in php.ini or the PHP-FPM pool and restart PHP. On shared hosting, ask your host.
How to move to PHP 8.3 or 8.4 without breaking the site
This is the same process we follow. You can do it yourself; the order is what keeps it safe.
- Take a full backup, and test the restoreFiles and database, stored off the server. A backup you've never restored is a hope, not a plan.
- Make a staging copyMost hosts offer one-click staging. Every change below happens there first, never on the live site.
- Update WordPress, theme and plugins on stagingOld versions are the usual reason a PHP upgrade breaks. WordPress 7.1 needs at least PHP 7.4, so core itself is rarely the problem.
- Find the abandoned piecesPlugins or themes with no updates in years, or removed from the directory, are the real risk. Plan a replacement before you switch PHP.
- Switch staging to PHP 8.3 or 8.4 and turn on loggingEnable the WordPress debug log (not on screen) and watch for fatal errors and deprecation warnings.
- Test what makes you moneyContact forms, checkout and payments, logins, search, any booking or member area, and email delivery. Click through them like a customer.
- Switch production in a quiet hourRepeat the change on the live site with a fresh backup and a clear rollback step, then re-test the same paths.
- Watch it for 48 hoursKeep an eye on the error log and on forms or orders arriving normally. Then schedule the next review instead of waiting for the next advisory.
Patching closes the door. It doesn't check the room.
Amazon reported exploitation attempts starting October 17, four days before the fix was public. Security firms have logged attempts in the millions, and as of October 23 no successful break-in had been publicly confirmed. If a site ran an unpatched PHP after October 17, a short review is cheap insurance:
- New administrator accountsCheck Users → Administrators for anyone you don't recognize.
- PHP files where they don't belongAny .php file inside wp-content/uploads is a red flag. Also look for recently changed files you didn't touch.
- Scheduled tasks you didn't createUnknown cron jobs in the hosting panel or unfamiliar WordPress scheduled events.
- Odd errors in the logsBursts of "Allowed memory size" errors or PHP workers crashing and restarting without a clear reason.
A clean result doesn't prove a server is clean. If you do find something, take the site offline without wiping it, keep the logs, change every password and key the site uses (database, WordPress salts, API keys), and restore from a backup made before October 17. If personal data may have been exposed, check your breach-notification duties.
The whole plan on two pages
A printable PDF with every check from this guide: which PHP you're on, the three options, the upgrade steps and the compromise review. Tick the boxes as you go, or hand it to whoever runs your site.
Here's your checklist.
Want a second pair of eyes? Request a free exposure check and we'll tell you which PHP your site runs and what it would take to upgrade.
We couldn't send that.
Please check your email address and try again, or write to hello@wordprex.com.
Rather not do it yourself?
We upgrade WordPress sites off end-of-life PHP using exactly the plan above: backup first, everything tested on a staging copy, a rollback ready, and a written report of what changed.
Every site is different, so we don't guess. The free exposure check comes first, then you get a fixed quote before any work starts. After that, Managed Protection keeps PHP, WordPress and plugins current so the next advisory is a non-event.
- A backup before every change
- Work on staging, not on your live site
- A fixed quote before we start
- A plain-English report when we finish
- You keep every login and file. No lock-in
Quick answers
Do I need to update WordPress to fix PHP2Shell?
No. PHP2Shell is a flaw in PHP itself, not in WordPress. The fix is a patched PHP build. Keeping WordPress, themes and plugins current still matters, because it's what lets you move to a supported PHP version.
My host says it patched PHP2Shell. Is my site on PHP 7.4 safe now?
Safe from PHP2Shell, very likely, if your host shipped a patched build. But PHP 7.4, 8.0 and 8.1 no longer get official fixes, so the next PHP advisory starts the same scramble again. A host patch buys time; it doesn't replace an upgrade.
Which PHP version should I upgrade to?
PHP 8.3 or 8.4 for most WordPress sites. WordPress recommends PHP 8.3 or newer, and PHP 8.2 stops getting security fixes on December 31, 2026.
Is my site on WordPress.com or a managed host affected?
Automattic said sites on WordPress.com, WordPress VIP, WP Cloud and Pressable were already protected, and several large managed hosts rolled out mitigations within a day. If you're on another host, don't assume. Ask, or request a free check.