PHP2Shell Critical RCE: Protect WordPress Before and After the Patch

Warning Two critical remote code execution flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619, often nicknamed “PHP2Shell”) are under active exploitation. They are not WordPress bugs — every WordPress site still runs on PHP, so your site is exposed until the interpreter is patched.

This guide is a practical response plan for WordPress operators: confirm your PHP version, apply the temporary session upload-progress mitigation, harden the edge while you wait, then install the official PHP security release as soon as your host ships it. Treat configuration changes as a stopgap only. PHP core maintainers have been clear: the real fix is upgrading PHP.

What happened (and why WordPress is in the blast radius)

On 20 October 2026 the PHP security team announced an emergency release for 21 October 2026 at 14:00 UTC. The two flaws are rated Critical (CVSS v4.0 9.2). Details leaked ahead of coordinated disclosure; security researchers and Cloudflare reported early attacks in the wild. Patchstack, CERT-EU, and national CERTs urged operators to prepare for immediate updates.

WordPress, WooCommerce, custom plugins, and mu-plugins all execute inside the same PHP-FPM (or Apache module) process. Updating a plugin or “hardening wp-config” does not replace a patched PHP binary. Shared hosts, VPS boxes, Docker images, staging sites, and forgotten subdomains all need the same attention.

Official reference PHP news — Upcoming Critical PHP Security Release and CERT-EU advisory 2026-018.

Prerequisites

• A full backup (files + database) before you change PHP settings or versions
• Access to your host’s PHP selector, cPanel/Plesk MultiPHP INI, or SSH/root for php.ini / FPM drop-ins
• Ability to restart PHP-FPM (or ask support to reload it) after INI changes
• A note of every environment that serves WordPress: production, staging, local Docker, cron workers

Tip Inventory first. A patched production site next to an unpatched staging clone that is still public is still a problem.

Step 1 Record your current PHP version

You need a baseline so you can confirm the security release actually landed. Do not trust a marketing “PHP 8” badge alone — you need the patch level (for example 8.2.35, not just 8.2).

Create a one-off health file in your WordPress root (delete it after you read the result):

<?php
/**
 * Temporary PHP version check — delete after reading.
 * Upload as php-version-check.php next to wp-config.php, open once, then remove.
 */
header( 'Content-Type: text/plain; charset=UTF-8' );
header( 'X-Robots-Tag: noindex' );

echo 'PHP version: ' . PHP_VERSION . PHP_EOL;
echo 'SAPI: ' . PHP_SAPI . PHP_EOL;
echo 'upload_progress.enabled: ' . ini_get( 'session.upload_progress.enabled' ) . PHP_EOL;
echo 'use_strict_mode: ' . ini_get( 'session.use_strict_mode' ) . PHP_EOL;

Or from SSH / WP-CLI on the same host that serves the site:

php -v
php -i | grep -E 'session\.upload_progress\.enabled|session\.use_strict_mode'
# If you use WP-CLI with the site's PHP binary:
wp eval 'echo PHP_VERSION;'

Expected fixed branches once the emergency release is published (confirm against php.net downloads — numbers can shift with the official advisory): PHP 8.5.x → 8.5.12+, 8.4.x → 8.4.27+, 8.3.x → 8.3.36+, 8.2.x → 8.2.35+. End-of-life branches (PHP 8.1 and older) are not expected to receive an official fix; plan a supported upgrade path with your host immediately.

Note Distribution packages (Ubuntu, AlmaLinux, etc.) may ship a backport with a different package version string. Ask your host which advisory they applied if php -v does not match the upstream patch numbers.

Step 2 Temporary mitigation — disable session upload progress

Early public analysis links part of the attack surface to PHP’s session upload-progress feature and to multipart upload requests. Turning the feature off is widely recommended as a partial mitigation until you can patch. It does not replace the security release. Upload progress bars in some admin UIs may stop updating; normal media uploads usually still work.

Also enable strict session mode while you are there — it is general hardening PHP already recommends.

Managed hosting / cPanel MultiPHP INI Editor

In your host panel, open the PHP INI editor for the domain that runs WordPress and set:

; Temporary stopgap for PHP2Shell exposure — still upgrade PHP ASAP
session.upload_progress.enabled = Off
session.use_strict_mode = 1

Save, then purge any opcode cache if the panel offers it. Re-open the version-check script from Step 1 and confirm upload_progress.enabled prints 0 or empty/off (hosts differ on how they display Off).

Debian / Ubuntu with PHP-FPM (VPS)

Write a drop-in so package upgrades do not wipe a hand-edited main php.ini. Replace 8.2 with your installed minor version:

PHP_MINOR=8.2

sudo tee /etc/php/${PHP_MINOR}/fpm/conf.d/99-security-upload-progress.ini >/dev/null <<'EOF'
; Temporary mitigation — remove after confirmed PHP security upgrade
session.upload_progress.enabled = Off
session.use_strict_mode = 1
EOF

sudo tee /etc/php/${PHP_MINOR}/cli/conf.d/99-security-upload-progress.ini >/dev/null <<'EOF'
session.upload_progress.enabled = Off
session.use_strict_mode = 1
EOF

sudo systemctl restart php${PHP_MINOR}-fpm

php${PHP_MINOR} -i | grep 'session.upload_progress.enabled'
# Expect: session.upload_progress.enabled => Off => Off

WordPress requests are served by FPM, not CLI — always restart FPM and verify via the web-facing script, not only php -i on the CLI.

WordPress in Docker

If PHP lives in a container image (common for self-hosted stacks), bake the same INI into the image or mount a conf.d drop-in, then recreate the PHP container so FPM reloads. Checking the host’s system PHP is useless if Nginx proxies to php-fpm inside Docker.

Warning Avoid random “PHP2Shell fix” plugins from unknown authors. Unverified plugins cannot patch the interpreter and can introduce a second incident while you are distracted.

Step 3 Reduce exposure at the edge (Cloudflare and friends)

If your DNS already points at Cloudflare (or another WAF that terminates TLS in front of origin), keep the proxy orange-clouded so traffic hits their rules. Cloudflare deployed early WAF rules for known exploit vectors for all plan tiers; they describe this as a stopgap that only helps when origin accepts traffic exclusively through Cloudflare.

Practical checklist:

• Confirm the hostname is proxied (not DNS-only) for public WordPress traffic
• Lock down origin: firewall so only Cloudflare IP ranges (or your reverse proxy) can reach ports 80/443
• Do not open admin-ajax, REST, or XML-RPC directly on the origin IP for the internet
• If you must accept multipart uploads (media library, forms with attachments), prefer origin-level PHP patching over blunt “block all multipart” rules that break legitimate features

If you cannot patch soon and the site is high-risk, UK NCSC-style guidance applies: consider maintenance mode or taking the site offline until PHP is updated. That is a business decision, not a WordPress setting.

Step 4 Install the official PHP security release

When your host or package mirror publishes the patched build:

1. Take a fresh backup again
2. Upgrade PHP for the site (selector, package update, or new Docker tag)
3. Restart PHP-FPM / recreate the app container
4. Re-run the version-check script and confirm you are on a fixed patch level
5. Smoke-test wp-admin login, media upload, checkout (if WooCommerce), and a front-end form
6. Only then remove temporary drop-ins if you prefer defaults — leaving session.use_strict_mode = 1 on is fine long term

Example package flow on Ubuntu (version numbers are illustrative — use what your distro ships after the advisory):

sudo apt-get update
apt-cache policy php8.2-fpm | head -20
sudo apt-get install --only-upgrade php8.2-fpm php8.2-cli php8.2-common
sudo systemctl restart php8.2-fpm
php8.2 -v

For managed WordPress hosting, open a ticket before the release window asking when they will roll the emergency PHP build, and whether EOL PHP customers will be force-migrated. Do not assume “automatic updates” already covered an emergency interpreter release.

Step 5 WordPress hygiene that still matters (but does not replace PHP)

While you wait on the host, tighten the usual WordPress surface so a compromised PHP process has less to steal and fewer privileged accounts to abuse:

• Keep WordPress core, themes, and plugins updated — especially anything that accepts uploads or runs remote dashboards
• Rotate Application Passwords and revoke unused ones (Tools → Site Health / Users → Profile)
• Review users with Administrator or Editor roles; remove stale accounts
• Ensure DISALLOW_FILE_EDIT is true in wp-config.php so a partial compromise cannot edit themes from wp-admin
• Confirm backups are recent and restorable offline (not only “on the same server”)

// wp-config.php — defence in depth, not a PHP2Shell fix
if ( ! defined( 'DISALLOW_FILE_EDIT' ) ) {
	define( 'DISALLOW_FILE_EDIT', true );
}

Tip After the PHP upgrade, scan for unexpected PHP files under wp-content/uploads/. Nginx/Apache should already deny script execution there; if uploads can run PHP, fix that web-server rule as a separate hardening task.

Common mistakes and troubleshooting

• Changed CLI only. Web traffic uses FPM/Apache module. Always verify with a browser request to your check script.
• Edited the wrong PHP version. MultiPHP hosts often keep several minors installed. The domain’s selected version must match the conf.d you edited.
• Opcode / page cache lied. After INI or PHP upgrades, flush Redis/Memcached/object cache and any full-page cache (W3 Total Cache, host cache, Cloudflare cache).
• Assumed Cloudflare alone is enough. WAF rules help only if origin is not reachable around the proxy. Patch origin PHP anyway.
• Stayed on PHP 7.4 / 8.0 / 8.1. Unsupported branches may never get this fix. Schedule a supported upgrade (WordPress currently expects modern PHP 8.x) with a staging test first.
• Installed a “magic fix” plugin. Uninstall it, restore from backup if needed, and apply the INI + PHP upgrade path above.

What to do next

Today: backup, disable session.upload_progress.enabled, verify via a web-facing check, and confirm Cloudflare (or equivalent) is actually in front of the site. As soon as the patched PHP build appears for your stack: upgrade, restart FPM, re-verify PHP_VERSION, smoke-test critical flows, then document the new baseline for every environment you own.

For deeper WordPress hardening after the emergency (escaping, nonces, REST permission_callback, Application Passwords for automation), keep working through security how-tos on this site — but do those only after the interpreter itself is on a fixed release.

Official reference Patchstack — PHP major vulnerability alert (Oct 2026). Cross-check fixed version numbers on php.net when the release notes go live.