Blog · 14 posts
Security
Two critical bugs in PHP itself put almost every WordPress site on an affected runtime until the host patches it. Here’s what happened in plain English, a checker that tells you whether you’re affected, and step-by-step fixes for every kind of hosting.
16 min read →
Security
Short, plain answers to the questions people ask about PHP2Shell: what it is, the two CVEs, who’s affected, whether updating WordPress helps, and exploitation status.
12 min read →
Security
CVE-2026-109618 and CVE-2026-109619 are the two critical PHP flaws known as PHP2Shell. Here's what each one is, why they rate 9.2, which setups are worst, the version table, and what to do — in plain English.
11 min read →
Security
WP2Shell and PHP2Shell have similar names and get confused constantly, but they are different vulnerabilities fixed in different ways. Here's a plain-English comparison, who is responsible for each, and a checker for the PHP side.
10 min read →
Security
You patched PHP for PHP2Shell — but if your site was exposed first, patching doesn’t evict anyone already inside. Here’s a calm, defensive checklist of what to look for in your logs, files and WordPress admin.
13 min read →
Security
Updating PHP is the only complete fix for PHP2Shell. If your host hasn't patched yet, these documented stopgaps buy time: session.upload_progress off, a memory_limit tweak, FPM limits and WAF rules — with their caveats.
12 min read →
Security
You updated PHP but Site Health still shows the old, PHP2Shell-vulnerable version. Six common reasons — unrestarted workers, CLI vs web SAPI, Docker containers, the backport number trap and multiple PHP versions — and how to fix each.
12 min read →
Security
Your PHP version decides whether your WordPress site still gets security fixes. Here’s how to find it in under a minute, what’s still supported, and a safe way to upgrade without breaking anything.
11 min read →
Security
Change your WordPress PHP version in cPanel’s Select PHP Version or MultiPHP Manager, pick a patched 8.3 or 8.4 build, test safely — and confirm the host patched the server’s ea-php packages.
10 min read →
Security
On an unmanaged VPS, patching PHP is your job. Find the PHP-FPM version actually serving WordPress, apt upgrade it, handle the backport version-number trap, and restart php-fpm.
11 min read →
Security
PHP 8.1, 8.0 and 7.4 are end of life — and the critical PHP2Shell flaw got no official fix for them. Here are the support windows and how to upgrade safely.
12 min read →
Security
PHP2Shell can disclose PHP worker memory — which may hold passwords, tokens and API keys. If your site was exposed and unpatched, rotate your WordPress salts and every other secret. A step-by-step checklist.
12 min read →
Security
Redirects to spam sites, admin users you never created, a warning from Google or a suspension notice from your host. Here’s the order to do things in, so you clean the site once and it stays clean.
14 min read →
Security
Thirty minutes, twenty-seven checks, one score. Items are weighted by how much risk they actually remove, so you fix the things that matter first — starting with the one most checklists forget: the PHP runtime underneath WordPress.
12 min read →
Presscomet runs your WordPress admin and site without a PHP runtime. See what that removes in the security guide.