Is your website at risk from the PHP emergency — how do you check your PHP version and patch it today?

PHP’s emergency PHP2Shell fixes (CVE-2026-109618 and CVE-2026-109619, each CVSS 9.2) close remote-code-execution holes in the software behind roughly 70% of websites. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and older get no fix. Here is how to check and patch today.

If your site runs on WordPress — or on most other popular website software — it runs on PHP, and PHP just had its biggest security scare in years. Short answer: On October 21, 2026, PHP shipped emergency fixes for two remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell and each rated CVSS 9.2. An attacker who can reach your site could run their own code on your server.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — check yours today. Why it is urgent: the flaw details leaked a day early, and security firms reported exploitation attempts before many sites had patched. PHP powers roughly 70% of websites, including most WordPress sites.

Two traps to know: PHP 8.1 and older are end-of-life and get NO official fix, and updating WordPress or plugins does NOT update PHP — they are separate layers.1. Find your version. WordPress users: open Tools > Site Health > Info and find the PHP version.2.

Compare it. Below your branch’s fixed version (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35) means exposed.3. Back up first.

Save a full backup of site files and database, and test that one restore actually works.4. Update PHP. Use your hosting control panel’s PHP tool, or ask your host in writing to move you to a fixed version.5.

On 8.1 or older? Upgrade to a supported branch — or, per UK NCSC advice, take the site offline until you can. No patch is coming.6.

Restart and re-check. Restart the PHP workers or web server, then confirm the new version is live.Common mistake: Patching without restarting. Long-running server processes keep the old, vulnerable code loaded until they restart — a patched server that was never restarted is still an open door.Ad’s take: If you only do one tech chore this week, make it this one — ten minutes in Site Health tells you whether your site is on the safe list.