Skip to content
SecurityPHP2Shell affects most WordPress sites. Am I affected? →
presscomet

Blog · guides for WordPress site owners

Keep your WordPress site safe, fast and yours.

Plain-English guides on WordPress security, speed, hosting and migration. Every fact is sourced, and every guide tells you what to do next — whether or not you ever use our product.

FeaturedSecurity· October 23, 2026

PHP2Shell and WordPress: are you affected, and how do you fix it?

Two critical bugs in PHP itself put almost every WordPress site on an affected runtime until the host patches it. Here’s what happened in plain English, a checker that tells you whether you’re affected, and step-by-step fixes for every kind of hosting.

16 min read · Read the guide →

Security

Vulnerabilities, patching, hacked-site recovery and hardening for WordPress sites.

All security posts

  • Security

    PHP2Shell FAQ: your questions answered (2026)

    Short, plain answers to the questions people ask about PHP2Shell: what it is, the two CVEs, who’s affected, whether updating WordPress helps, and exploitation status.

    12 min read →

  • Security

    CVE-2026-109618 & CVE-2026-109619 (PHP2Shell) Explained

    CVE-2026-109618 and CVE-2026-109619 are the two critical PHP flaws known as PHP2Shell. Here's what each one is, why they rate 9.2, which setups are worst, the version table, and what to do — in plain English.

    11 min read →

  • Security

    WP2Shell vs PHP2Shell: Two Bugs, Two Fixes

    WP2Shell and PHP2Shell have similar names and get confused constantly, but they are different vulnerabilities fixed in different ways. Here's a plain-English comparison, who is responsible for each, and a checker for the PHP side.

    10 min read →

  • Security

    Was my WordPress site hacked by PHP2Shell?

    You patched PHP for PHP2Shell — but if your site was exposed first, patching doesn’t evict anyone already inside. Here’s a calm, defensive checklist of what to look for in your logs, files and WordPress admin.

    13 min read →

  • Security

    How to block PHP2Shell before your host patches PHP

    Updating PHP is the only complete fix for PHP2Shell. If your host hasn't patched yet, these documented stopgaps buy time: session.upload_progress off, a memory_limit tweak, FPM limits and WAF rules — with their caveats.

    12 min read →

  • Security

    PHP still shows as vulnerable after you updated it

    You updated PHP but Site Health still shows the old, PHP2Shell-vulnerable version. Six common reasons — unrestarted workers, CLI vs web SAPI, Docker containers, the backport number trap and multiple PHP versions — and how to fix each.

    12 min read →

  • Security

    How to check and update your PHP version in WordPress (2026)

    Your PHP version decides whether your WordPress site still gets security fixes. Here’s how to find it in under a minute, what’s still supported, and a safe way to upgrade without breaking anything.

    11 min read →

  • Security

    How to update your PHP version in cPanel (2026)

    Change your WordPress PHP version in cPanel’s Select PHP Version or MultiPHP Manager, pick a patched 8.3 or 8.4 build, test safely — and confirm the host patched the server’s ea-php packages.

    10 min read →

  • Security

    Update PHP on an Ubuntu or Debian server (2026)

    On an unmanaged VPS, patching PHP is your job. Find the PHP-FPM version actually serving WordPress, apt upgrade it, handle the backport version-number trap, and restart php-fpm.

    11 min read →

  • Security

    Rotate WordPress security keys after PHP2Shell

    PHP2Shell can disclose PHP worker memory — which may hold passwords, tokens and API keys. If your site was exposed and unpatched, rotate your WordPress salts and every other secret. A step-by-step checklist.

    12 min read →

  • Security

    WordPress hacked? A step-by-step recovery checklist

    Redirects to spam sites, admin users you never created, a warning from Google or a suspension notice from your host. Here’s the order to do things in, so you clean the site once and it stays clean.

    14 min read →

  • Security

    WordPress security checklist 2026 (interactive, scored)

    Thirty minutes, twenty-seven checks, one score. Items are weighted by how much risk they actually remove, so you fix the things that matter first — starting with the one most checklists forget: the PHP runtime underneath WordPress.

    12 min read →

Migration

Moving off classic WordPress hosting without losing URLs, rankings or your admin.

All migration posts

  • Migration

    Can you run WordPress without PHP?

    WordPress itself is PHP, so the honest answer is “not WordPress core”. But you can run a WordPress site without PHP serving your visitors. There are four real ways to do it, each with a different trade-off. Here they are side by side, with a quick quiz to find yours.

    11 min read →

  • Migration

    How one-click migration works

    What happens between pasting your WordPress URL and switching DNS: four importers, plugin mapping, and theme capture.

    5 min read →

  • Migration

    Your WordPress site as plain files

    Static export renders every public URL — archives, feeds, sitemaps and the 404 page — so you can host on Netlify, Vercel, GitHub Pages or S3.

    3 min read →

Hosting

What to expect from a WordPress host, and what to ask before you trust one.

All hosting posts

Product

News and deep dives from the people building Presscomet.

All product posts

  • Product

    Introducing Presscomet

    A WordPress-compatible CMS on Next.js and SQLite, built so you can move a site without anyone retraining or rebuilding anything.

    4 min read →