On this page (6 sections)
Wordfence has published an update on PHP2Shell. As of October 28, 2026, the company says it knows of no WordPress site compromised through it. Its practical advice is to update PHP to a fixed version and restart it, because updating WordPress does not update PHP.
If you run WordPress sites, manage hosting for clients, or administer your own server, this is worth your attention even though no compromises are confirmed. The step Wordfence points to sits at the PHP layer, which many site owners never touch. The public information we could verify is limited, so this article separates what is known from what is not.
What is known so far
The only source we could verify is the Wordfence update post. It makes two statements that matter. First, as of October 28, 2026, Wordfence knows of no WordPress site compromised through PHP2Shell. Second, it advises updating PHP to a fixed version and restarting it.
Only one independent publisher covers this story so far, and we have no second confirmation. The material we reviewed does not describe what PHP2Shell is or how it works. We also could not see a CVE identifier, a severity score, the list of affected PHP versions or the exact fixed versions. Treat any claim you see elsewhere about those details as unverified until it is backed by a primary advisory.
Why updating WordPress is not enough
WordPress is an application that runs on top of PHP. Updating WordPress core, themes and plugins changes application code. It does not change the PHP interpreter installed on the server. Wordfence makes this point explicitly: updating WordPress does not update PHP.
This catches people out in a few common setups:
- Managed hosting, where the provider controls the PHP build and you only pick a version in a control panel.
- VPS or dedicated servers, where PHP usually comes from the operating system package manager and only changes when someone updates packages.
- Containers, where PHP is typically baked into an image and changes only when the image is rebuilt and redeployed.
As general background (not something the Wordfence post states), a long-running PHP process such as PHP-FPM can keep running the old code in memory after the package on disk has been replaced. That is a common reason a restart is part of any PHP update. Wordfence's stated advice is simply to update PHP to a fixed version and restart it.
How to check your exposure
Start by finding out which PHP version each of your sites actually runs, and who controls it.
This read-only command prints the PHP version used by the command line on your server. Run it over SSH and note the version. The web server may use a different PHP build than the command line, so also confirm the version in your hosting panel or in WordPress under Tools, then Site Health, then Info, then Server.
php -vOn Debian or Ubuntu, this lists installed PHP packages and their versions, so you can see whether more than one PHP version is present.
dpkg -l | grep -i phpOn RHEL and compatible systems, the equivalent query is:
rpm -qa | grep -i phpWe could not confirm a specific fixed version in our research, so check the Wordfence post and your distribution or host's security notices for the exact release to target.
What to do now
0 of 7 done
On Debian or Ubuntu, this updates installed packages from your configured repositories. Run it as an administrator, and read the list of packages it will change before you confirm.
sudo apt update && sudo apt upgradeOn RHEL and compatible systems, the equivalent is:
sudo dnf upgradeAfter the update, restart PHP. The service name varies by version and distribution, so list your services first and use the exact name you see. The example below uses a placeholder version number that you must replace.
sudo systemctl restart php8.x-fpmDetection and monitoring afterwards
Since no compromises are confirmed, there is no verified indicator list to hunt for, and we will not invent one. General hygiene still applies. Watch for unexpected PHP files in upload and cache directories, new administrator accounts, and changes to core files. Our guide on how to check if a website is hacked walks through the basics, and website hacked: what to do covers response if you find something.
For ongoing visibility, an outside-in scan can show some things from the outside, but it cannot see everything happening on the server. See what outside-in malware detection can and cannot see, and the free website malware scanner for a quick check. A firewall can add a layer of filtering, but it is not a substitute for updating PHP.
Why we are staying cautious
Several details are missing from the public record we could verify: what PHP2Shell actually is, the CVE if any, the severity score and the exact fixed versions. We will update this article if a primary advisory or a second independent researcher publishes them. In the meantime, updating and restarting PHP is low-regret advice, and it is what Wordfence recommends. For a broader routine, see our WordPress security checklist.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.