Is your WordPress host patched for PHP2Shell? What to ask (with an email template)

Who patches PHP on your hosting?

PHP2Shell lives in PHP, the program your server uses to run WordPress. Updating WordPress or plugins can’t touch it. Whoever controls the server’s software has to update PHP and restart it. Which means the first question is: who is that?

On a VPS, skip to the server instructions in the PHP2Shell patch guide. Everyone else: read on.

The four questions to ask your host

Vague questions get vague answers (“Our platform is secure!”). These four are specific enough that a support agent has to check.

1. 1

   Step 1: Is the PHP that serves my site updated?

   To 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later — or to a vendor build with both fixes backported. If it’s a backport, ask which advisory or build.
2. 2

   Step 2: Were PHP workers restarted after the update?

   PHP-FPM, LiteSpeed and Apache keep the old code in memory until they restart. An installed-but-not-restarted patch protects nobody.
3. 3

   Step 3: If not yet, what protects me now — and until when?

   Firewall rules or disabled PHP features are reasonable stopgaps. What you want is a date for the real patch.
4. 4

   Step 4: Was my site targeted or compromised?

   Hosts see logs you can’t. Attack attempts were recorded from 17 October, before the fix existed.

Copy-paste email and chat message

Fill in the bracketed parts and send it through your host’s ticket system or support email. Asking in writing gives you a record of the answer.

Hello,

I'd like to confirm the status of the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) for my site:

  Site / account: [your domain or account ID]
  PHP version shown in WordPress Site Health: [e.g. 8.3.14]

Could you please answer these four questions?

1. Is the PHP that serves my site updated to a fixed release (8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later), or to a vendor build with both fixes backported? If it's a backport, which advisory or build is it?

2. Were the PHP workers for my site (PHP-FPM / LiteSpeed / Apache) restarted after the update, and when?

3. If PHP isn't patched yet: what protection is in place right now (for example a firewall rule or disabled PHP features), and when will the patched PHP be live?

4. Did you see any signs that my site or server was targeted or compromised between 17 October and the time it was patched?

Thanks — a short written answer is perfect.

[Your name]

Prefer live chat? This shorter version fits in one message:

How to read the reply

Whatever they say, check for yourself afterwards: Tools › Site Health › Info › Server shows the PHP version your site is actually running. Our PHP version guide shows where to look on every kind of host.

Reported host status

For a sense of how the industry responded, here is what one public tracker reported. This is third-party reporting, not a guarantee: statuses change hourly, and only your host can confirm your server.

Fix released

21 Oct 2026, 14:00 UTC

First attack attempt seen

17 Oct 2026

Fixed versions

8.5.12 · 8.4.27 · 8.3.36 · 8.2.35

Two takeaways. Big managed hosts mostly moved within a day or two, which is what you pay them for. And a host being “patched” didn’t always cover every PHP version: some patched current versions first while older ones waited on vendor fixes. If your site is on PHP 8.1 or older, ask specifically about that version.

If your host can’t or won’t patch

If you get no clear answer within a couple of days, or the answer is “we don’t support that PHP version anymore”, protect the site and move on:

• Switch your site to a supported PHP version in the control panel if the host offers a patched one (8.3 or 8.4), after a backup.
• Put a CDN/WAF in front (several, including Cloudflare, deployed PHP2Shell rules) and make sure the origin server isn’t reachable directly.
• Take a full backup now and keep it off the server, then run the hacked-site checklist if the site was exposed.
• Move hosts. A host that can’t tell you whether its PHP is patched during a critical, widely-reported vulnerability will do the same next time. Use our WordPress security checklist to judge the next one.