FCA authorised · FRN 724952 0117 325 0027Quote & buy →
PHP2Shell: practical guide
Yes, a WordPress site is at risk until the server's PHP is updated, because PHP2Shell is a flaw in PHP itself, not in WordPress. It matters for insurance because a compromised site can expose customer data, trigger reporting duties and lead to a cyber claim.
Part of: PHP2Shell and cyber insurance
In short
PHP2Shell is two critical PHP vulnerabilities fixed on 21 October 2026. WordPress runs on PHP, so updating WordPress core, themes or plugins does not fix it: WordPress.org says no WordPress update is required or planned. The fix is a patched PHP version (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or a patched distribution package. On shared and managed hosting the host usually patches PHP; on an unmanaged VPS it is you or your IT provider. Online shops should also think about PCI DSS and UK GDPR. If you find signs of compromise, notify your insurer promptly, in line with your policy wording.
Last updated 22 October 2026. Probably, until your host or developer confirms PHP has been updated. PHP2Shell is the name researchers gave to CVE-2026-109618 and CVE-2026-109619, two critical flaws (CVSS v4.0 9.2) that allow unauthenticated remote code execution. The PHP project's advisory says all PHP installations serving web requests are at risk.
WordPress.org's security post of 21 October 2026 says the issues are not specific to WordPress and affect any server hosting a PHP application. As of 21 to 22 October 2026, several security firms reported exploitation attempts. To find out where your site stands, follow our guide on how to check your website's PHP version.
No. The vulnerable code is in PHP, the language and runtime that sits underneath WordPress on the server. WordPress.org states that no WordPress update is required or planned for these issues. Updating WordPress core, your theme or your plugins changes the application, not the PHP build that runs it.
Keep doing those updates anyway. Plugins and themes have their own vulnerabilities, and WordPress.org's guidance on updating PHP treats keeping PHP current as just as important as keeping WordPress, themes and plugins current. They are separate jobs, and PHP2Shell needs the PHP one.
If the fix means moving to a newer PHP branch, ask your developer to test the site for compatibility, but do not let testing delay the security fix for long.
WordPress.org's hardening guide notes that web hosts are often responsible for the infrastructure your site sits on, but not for the application you install. Who patches PHP depends on your hosting type and your contract.
| Hosting type | Who usually patches PHP | What you should do |
|---|---|---|
| Shared hosting | The host maintains the PHP builds; you often choose which version your site uses in the control panel | Check your site is set to a fixed or patched version, not an old one left selected. Ask the host to confirm in writing |
| Managed WordPress hosting | Usually the host, including PHP updates and sometimes firewall rules | Ask for written confirmation of the patch date and whether they have checked for compromise |
| VPS or dedicated server (unmanaged) | You, or whoever you pay to run the server | Update PHP now or confirm a patched distribution package. If you cannot, the NCSC says to consider taking the system offline |
| Server managed by an agency, developer or MSP | Whoever the contract says, which is often unclear | Ask them directly, and check your contract for who is responsible for security updates |
Even when someone else patches, the website, its data and its customers are still yours. See our page on whether you need cyber insurance if your website is hosted.
If you take card payments, the Payment Card Industry Data Security Standard applies. In PCI DSS v4.0, requirement 6.3.3 says critical or high-security patches must be installed within one month of release. The self-assessment questionnaire for e-commerce merchants that partially outsource payments (SAQ A-EP) notes that requirement 6 applies to web servers that host payment pages. So even a shop that sends customers to a payment provider may have obligations for its own website, depending on how checkout is set up. Check with your payment provider or acquirer, who runs your compliance programme, which questionnaire applies to you. Our page on cyber cover for retailers and PCI DSS explains how card-related costs commonly sit in a cyber policy.
A WooCommerce site usually holds names, addresses, emails and order histories. Under UK GDPR, unauthorised access to personal data is a personal data breach. The ICO's guide says a notifiable breach must be reported without undue delay and, where feasible, within 72 hours of becoming aware of it. You can provide information in phases, and you should record all breaches, even those you do not report. A breach is not notifiable if a risk to people's rights and freedoms is unlikely, but that is a judgement you need to make and document. See our ICO wiki entry for background.
Patching stops new attacks through these flaws, but it does not remove anything an attacker left behind. Apex does not inspect servers, so these are questions for your developer, host or IT provider. They are drawn from WordPress.org's hacked-site FAQ, the NSA and Australian Signals Directorate guide Detect and Prevent Web Shell Malware, and MITRE ATT&CK entries on web shells and cron.
No sign does not prove no compromise, and this list is not exhaustive. WordPress.org also advises changing passwords for all access points (hosting panel, FTP or SFTP, WordPress admin and database) after the site is confirmed clean.
If you have cyber insurance, contact your insurer or broker promptly if:
Cyber policies commonly require prompt notification and may ask you to use or consult the insurer's incident response providers before you rebuild or wipe anything. Our guide to the first 72 hours of a cyber incident and our wiki entry on cyber incident notification cover the order of steps.
Do I need to tell my insurer about PHP2Shell if nothing has happened? It depends on your policy wording. Some policies let or require you to notify circumstances that could give rise to a claim, and some have conditions about patching. If you are unsure, ask your broker. Our unpatched vulnerabilities guide and the main PHP2Shell and cyber insurance page go into more detail.
Apex is a broker, not an incident response firm. We can check your current cyber policy's conditions on patching, security and notification; help Apex clients notify their insurer quickly and correctly; and arrange cover through our cyber quote form if you have none. What a policy usually pays for is set out in our breach costs breakdown.
If you build or host WordPress sites for clients, PHP2Shell is a portfolio problem: every site you manage needs checking, and clients will ask who was responsible for patching. Our guide for web agencies and hosting providers covers liability and the role of technology PI and cyber cover. We can arrange insurance for web developers and agencies, and our contract clause check can help you see what your client contracts say about insurance.
No. PHP2Shell is a flaw in PHP, the runtime underneath WordPress, and WordPress.org says no WordPress update is required or planned for it. You need a fixed PHP release (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or a patched distribution package. Keep updating WordPress, themes and plugins too, as good security hygiene.
Usually the host, but check rather than assume. On shared hosting the host maintains PHP builds and you often choose the version in the control panel. On an unmanaged VPS it is you or your IT provider. Ask for written confirmation of when PHP was patched.
A cyber policy commonly responds to a hack exploiting a software flaw, including incident response, data restoration and breach costs, subject to the wording. Some policies have conditions or exclusions about unpatched vulnerabilities or unsupported software, so how a claim is treated depends on your policy and what was reasonable at the time.
If personal data may have been accessed and there is a likely risk to people's rights and freedoms, the ICO says you must report without undue delay and, where feasible, within 72 hours of becoming aware. You can report in phases. Record every breach, even those you decide not to report.
Common signs include admin users you did not create, unknown PHP files in upload folders, a changed .htaccess file, unexpected cron jobs, and unusual outbound connections or processes. Search engine warnings, malware flags or your host suspending the site are also indicators. Ask your developer or host to check.
Start a cyber quote online in a few minutes, or ask a broker to check your current policy's patching and notification conditions. Or call 0117 325 0027.
Start a cyber quote Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
