PHP2Shell: upgrade PHP without breaking your WordPress site
On 21 October 2026, PHP released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which allow remote code execution without logging in. The PHP project fixed PHP 8.2 to 8.5 only. If your site runs an older version, the lasting fix is moving to a newer one, and that move is where plugins break.
Is your PHP version fixed?
| Your PHP version | Fix |
|---|---|
| 8.2, 8.3, 8.4, 8.5 | Fixed in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Ask your host whether your server runs that release. |
| 7.4, 8.0, 8.1 | No release from the PHP project. Fixed only if your host or Linux vendor added the fix itself. cPanel did for its PHP 7.4, 8.0 and 8.1 builds, and CloudLinux did for its PHP Selector versions. Ask your host. |
| 7.3 and older | No release from the PHP project or cPanel. CloudLinux published fixes for its PHP Selector versions. Everywhere else, upgrade. |
PHP 8.2 stops receiving security fixes on 31 December 2026. Moving to PHP 8.3 or newer is the fix that lasts.
Check your plugins before you switch
Going from PHP 7.4 to PHP 8 removes functions that older plugins and themes still call, and a call to a removed function stops the site with a fatal error. Going from 8.1 to 8.3 or 8.4 mostly adds deprecation notices, plus a few extensions that PHP 8.4 no longer ships.
Bumpcheck reads every plugin and theme on your server, including premium and custom ones, and lists what breaks on the PHP version you pick, with the file and the line. It is free, and nothing leaves your site. Test a busy site on a staging copy before you switch.
What Bumpcheck does not do
Bumpcheck does not detect or fix PHP2Shell. Only a PHP update fixes it. Bumpcheck tells you what that update will break.
Sources, checked on 24 October 2026: PHP security advisory, WordPress.org news, InMotion Hosting on the cPanel and CloudLinux fixes.