PHP2Shell Explained: What the October 2026 PHP Vulnerabilities Mean for WordPress Websites

Potentially, if it runs on a vulnerable PHP installation. CERT-EU’s advisory identifies web-serving configurations including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The most direct demonstrated risk is associated with mod_php, but businesses should assess every PHP environment that serves web requests. The exact attack path depends on the PHP version, server configuration and application.

Which PHP versions contain the fixes?

The PHP project’s October 21 release notice lists these as the first fixed releases within the supported branches:

Your provider should confirm the appropriate fixed release or vendor-patched package, including any later security updates. Some operating-system vendors backport fixes into packages whose displayed version number looks older. Ask for the package advisory and explicit confirmation that both CVEs are addressed; a version string alone may be misleading.

PHP 8.1 and earlier are outside ordinary upstream support. Emergency source backports are available for some older branches, but keeping an unsupported installation running should not become the long-term plan. Have the provider explain both its immediate remediation and its supported upgrade path.

Also check forgotten installations. The UK National Cyber Security Centre recommends identifying PHP across the estate, including third-party products that bundle it. A patched main website does not establish that a staging site, subdomain or separate application is also patched.

What should you ask your hosting provider now?

Ask for a written response tied to the actual website and environment. These six questions make a useful starting point:

1. Which PHP version and vendor package are serving our live website, and what server configuration is in use?
2. Have both CVE-2026-109618 and CVE-2026-109619 been remediated? Please provide the relevant release or vendor advisory.
3. When was the fix deployed, and how did you verify that the running web-serving processes are using it?
4. Which related environments have you checked, including staging, subdomains and other applications in our account?
5. What evidence of attempted exploitation or compromise have you reviewed, and what further investigation is needed?
6. If remediation is incomplete, what temporary protection is in place, who owns the next action, and when will it be completed?

If a fix cannot be applied promptly, involve the hosting provider or incident-response team. CERT-EU advises considering isolation of internet-facing applications until remediation is applied and verified. The choice depends on the environment and business impact. Temporary controls should not be treated as a complete replacement for the update.

Patching also does not establish that an earlier compromise has been removed. The NCSC’s response guidance includes investigation for signs of compromise and backdoors where prompt mitigation was not possible. If an investigation is needed, preserve relevant evidence and follow the response team’s recovery advice.

For a business owner, the useful deliverable is a named person, a documented fix and confirmation of what was checked. A general reassurance that the site is “secure” gives you much less information.

What has Webflow said about PHP2Shell?

As checked on October 22, 2026, the Webflow Trust Center states that Webflow’s core services are not built on PHP and are unaffected by PHP2Shell. It also says its security team is assessing PHP-dependent non-production systems and that customers do not need to take action in response to this incident.

This is a specific statement about Webflow’s services and this vulnerability. A company using Webflow may still operate a separate PHP application, custom backend or connected service. Those systems need their own assessment.

For websites hosted on Webflow, its managed hosting model places infrastructure maintenance with the platform provider. Website teams still need to manage account access, integrations, embedded scripts, forms and content. Webflow’s account-security guidance remains relevant regardless of which runtime a platform uses.

That division of responsibility is part of Webflow’s appeal: a marketing team can spend less effort coordinating a separate CMS hosting stack. It still needs a clear operating plan. Our guide to Webflow security, backups and maintenance explains what that ongoing work includes.

‍