A Critical PHP Flaw Had WordPress Hosts Patching This Week. Did Yours Tell You?

Nobody who runs a business should have to read PHP release notes. That’s the whole point of paying a host.

But this week, PHP itself shipped emergency security fixes, and it turned into the cleanest test of a hosting company I’ve seen in a while. Not the sales page. Not the uptime badge. Did they patch, and did they tell you?

If you read Managed WordPress Hosting Is a Lie, consider this the sequel.

What actually happened

It’s called PHP2Shell. Two flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, that together let an attacker run their own code on a server without logging in. Automattic’s advisory rates both 9.2 out of 10. That’s the “critical” band.

Researchers at Wiz published an exploit chain against stock WordPress, Drupal and Joomla images. The fixes landed October 21 in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

And the timing was ugly. Amazon’s threat team says it saw an exploitation attempt on October 17 against one of its honeypots, four days before public disclosure. Attempts picked up again the morning of the release.

Your plugins can’t fix this one

Here’s the part owners miss. PHP is the engine your site runs on, and it lives on the server. WordPress updates don’t touch it. Theme updates don’t touch it. Plugin updates don’t touch it.

Your site could be perfectly updated and still sit on a vulnerable engine. The only person who can fix it is whoever runs the server. That’s your host.

So the real question isn’t “is my site updated?” It’s “did the people I pay to run the engine do their job, and would I even know?”

My own experience was boring (good)

For the record, my host and platform, GridPane, made this week fairly painless for me. I’m not going to oversell that or tell you what happens inside anyone’s stack. I’m just telling you what I want from a host: a boring week.

That’s my experience with one company, and yours may differ. Which is exactly why you should ask.

The one email to send your host

Copy, paste, send. It takes two minutes and you don’t need to understand a word of the technical stuff.

Hi, I’m hearing about a critical PHP security issue called PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Can you tell me three things?

1. Which PHP version is my site running right now?
2. Has the PHP2Shell patch been applied to my server, and if so, when?
3. How do you notify customers about server-level security fixes like this one? Did I get a notice I missed?

Thanks, I’d like to have this on file.

What a good answer looks like

Short, specific and fast. Something like: you’re on PHP 8.3, it was patched on this date, and here’s where we posted about it.

They give you a version number and a date. They tell you whether they emailed customers or posted a status update. If they hadn’t told you before you asked, a good host says so and explains what they’ll do differently.

Notice what’s missing: jargon, a sales pitch, or a link to a generic security page.

What silence means

Nothing for days? A canned reply that says “we take security seriously” and answers none of the three questions? That’s not proof they ignored it. I can’t see inside their servers, and neither can you.

But it does tell you something. If a host can’t tell you which PHP version you’re on or when a critical fix went in, then you can’t verify the thing you’re paying them for. In my opinion, that’s a reason to start shopping, not a reason to wait and see.

If your site is on old PHP

One short note. PHP 7.4 through 8.1 are end-of-life, which means the PHP project isn’t shipping fixes for them. There’s no normal upstream patch coming.

That leaves two options: your host provides its own backported fix for the old version, or you upgrade to a supported one. Ask which one they’re doing. Upgrading old PHP can break old plugins, so don’t flip the switch blind. Test on a copy first.

I wrote about the same dynamic after a recent WordPress core release in three questions for whoever runs your site, and about how fast attackers now move in this piece on the AI patch window. Same theme: the people running the machinery owe you answers.

Picture this: a business owner finds out three weeks later that the server under her site sat unpatched while the news was everywhere. Nobody lied to her. Nobody told her anything, either. That gap is the whole problem, and a two-minute email closes it.

Hosting is also one line in the bigger bill. If you’re curious what the rest should look like, I laid it out in what WordPress maintenance should actually cost.

Where we fit

If sending that email sounds like one more thing you don’t have time for, that’s part of what our WordPress maintenance work covers: we ask the hosting questions so you don’t have to. If an old site is already in rough shape, Site Rescue is where we start.

Curious what answer you get. Did your host tell you before you asked?