Updated 22 October 2026

PHP2Shell: what it means for your WordPress site, and what to check before you upgrade PHP

On 21 October 2026 the PHP project published fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, that allow remote code execution with a single unauthenticated request. The fix is to run a patched PHP. For many WordPress sites that means a version jump, and a version jump is where plugins break.

What was fixed, and what was not

Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Every PHP setup that serves web requests is affected (PHP-FPM, Apache with mod_php, php-cgi, LiteSpeed, FrankenPHP).

PHP 8.1, 8.0 and 7.4 have no fixed release. Those branches are no longer supported by the PHP project. The security team published minimal source patches for people who build PHP themselves, and some hosts and Linux distributions backport fixes on their own, but there is no official 8.1.x or 7.4.x you can switch to. If your site runs on one of these, the realistic path is the one your host will push anyway: move to 8.2 or newer.

Find out which PHP you run

In WordPress: Tools, Site Health, Info tab, Server. The PHP version is listed there. Compare it with the fixed versions above. If you are on 8.2, 8.3 or 8.4 but below the fixed number, your host only has to apply the patch release; nothing changes for your plugins. If you are on 8.1 or older, read on.

Upgrading in a hurry is how sites go down

A PHP major or minor upgrade changes the language: functions removed, argument rules tightened, behaviours deprecated. A plugin written for 7.4 can throw a fatal error on 8.2 and take the whole site with it, admin included. The usual way people find this out is a white screen right after the host flips the switch.

The order that avoids that:

Back up files and database, or make sure your host's backup from last night is restorable.
Scan before you upgrade. Install Upgravo (free, runs on your own server, nothing leaves the site) and check against the version you are moving to. Pick the newest patched version your host offers; 8.3 or 8.4 is a sensible target today.
Fix what breaks: update the plugin if an update exists, replace it if the author is gone, remove it if you do not use it. Deprecation notices can wait; breaks cannot.
Upgrade PHP in the host panel, then open the site, the admin, and the pages that use your most important plugins (checkout, forms, membership).
Check the error log for a day. Deprecation notices there are the to-do list for next time.

What Upgravo does and does not do

Upgravo is a compatibility scanner. It reads every plugin and theme file and tells you what stops working on PHP 8.1, 8.2, 8.3 or 8.4, separated into breaks, deprecation notices and hidden findings, with file and line. It does not detect, block or fix PHP2Shell: patching PHP is the job of your host or your server admin. What it does is make the upgrade that patches you a planned change instead of a gamble.

If you look after several sites, the Pro version adds scheduled scans with email alerts, a PDF report for each client, and one license for all the sites you maintain.

How to install it from the zip

In your WordPress admin, go to Plugins, Add New, Upload Plugin.
Choose upgravo-0.1.5.zip and click Install Now.
Click Activate Plugin.
Open Upgravo in the left menu, pick the PHP version you are moving to and press Scan. One to two minutes later you have the verdict, plugin by plugin.

No account, no key, nothing to configure. You can delete the plugin after the scan; it removes its own settings. Until the WordPress.org listing is live, a newer version is installed the same way (WordPress offers to replace the current one); after that, updates arrive like any other plugin.