How to Secure Your WordPress Site from PHP2Shell Vulnerabilities

Two critical security vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) were disclosed recently. These vulnerabilities allow unauthenticated attackers to execute malicious code on vulnerable servers, putting websites and their data at risk.

Which PHP Versions Have Been Patched?

On October 21, 2026, the PHP development team released patched versions for four supported PHP branches.

Here are the patched versions:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

If your website runs an earlier release, update to the corresponding patched version or a newer supported release.

Important: PHP 8.1 and older versions have reached end of life and won’t get any official security update. Please upgrade to PHP 8.2.35+ or later and keep your site offline until these issues are fully mitigated.

How to Check Your WordPress Website’s PHP Version

You can check your website’s current PHP version directly from your WordPress dashboard by following these steps:

1. Log in to your WordPress admin dashboard
2. Go to Tools > Site Health
3. Open the Info tab
4. Expand the Server section
5. Find the PHP version listed there

How to Update PHP on Your WordPress Website

PHP updates happen at the server level, not through the regular WordPress or plugin update process. Before changing PHP versions, take these precautions:

• Back up your website: Keep a recent backup of your website files and database.
• Check compatibility: Confirm that your WordPress version, theme, and plugins support the target PHP version.
• Test when possible: Use a staging website to check for errors before updating your live website.
• Verify the update: Recheck the PHP version and confirm with your hosting provider that the security patches are in place.

If You Can’t Update Right Away

If you can’t update your PHP version right away, reach out to your hosting provider and ask them to apply the fix for you. 

A Note for Tutor LMS Users

Tutor LMS doesn’t require a specific update to address these PHP vulnerabilities, as the fix must be applied at the server level. However, keep WordPress, Tutor LMS, your themes, and other plugins up to date, and confirm with your hosting provider that your PHP version has been patched.

Stay safe and keep your website protected!