The recent PHP security issue has raised questions for WordPress website owners. If you have seen warnings from your hosting provider or read about PHP2Shell, you may wonder whether your website is affected and what you should do next.
The first step is to check with your hosting provider. This issue involves PHP, the software your server uses to run WordPress. Keeping your plugins updated remains essential, but your host needs to apply the PHP security fix to address these vulnerabilities.
Below, we explain what happened, how it affects WordPress websites, and the steps you can take. We also cover what this means for Gutenverse users, so you can make an informed decision about your website.
What Is the PHP2Shell Security Issue?
On October 21, 2026, the PHP team released security updates for two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. These vulnerabilities have become commonly known as PHP2Shell.
The flaws can allow an attacker to execute code on an affected server without signing in. The official PHP security announcement urges users to install the available updates immediately.
For website owners, the immediate priority is to confirm whether their hosting provider has applied the patches. Your host may already have completed the update, so the announcement does not automatically mean your website remains exposed.
How Does PHP2Shell Affect WordPress Websites?
WordPress relies on PHP to process requests and generate website content. When a visitor opens a page, your server runs PHP code as part of the process that delivers that page to their browser.
Your WordPress installation, theme, and plugins all operate within this environment. If the server runs an affected PHP version, the website can face risk even when its owner keeps WordPress updated.
As Carnegie Mellon University’s security advisory explains, these vulnerabilities affect PHP itself and can put applications running on vulnerable versions at risk, including WordPress.
This distinction determines what you need to update. Installing the latest WordPress release or updating your page builder does not patch the PHP installation on your server. Your hosting provider or server administrator must handle that update.
How to Check Whether Your Website Has Received the Fix
If a hosting provider manages your server, check its security announcements and contact its support team. Ask for confirmation that it has patched the PHP environment serving your website.
You can send this message: Has the PHP installation serving my website received the security fixes for CVE-2026-109618 and CVE-2026-109619? If the update is still pending, when will you apply it, and do I need to take any action?
A specific question helps the support team check the relevant fixes and give you a useful answer.
PHP released patches in these versions: PHP 8.2.35, PHP 8.3.36, PHP 8.4.27, PHP 8.5.12.
Some hosting providers and operating system vendors may apply the fixes to existing packages while retaining an older version number. Follow the PHP team’s update guidance and ask your provider to confirm the patch status instead of relying only on the version number displayed in your dashboard.
If you manage your own server, follow the official advisory and your operating system vendor’s instructions. Make sure you update the PHP environment that handles your website’s traffic.
Does Updating WordPress Fix PHP2Shell?
Updating WordPress alone will not resolve these PHP vulnerabilities.
WordPress updates maintain the application, while PHP updates maintain part of the software that runs it. Most website owners install WordPress updates through the dashboard and depend on their hosting provider to manage PHP.
You should continue updating WordPress, your theme, and your plugins. Those updates address their own bugs, compatibility issues, and security vulnerabilities. For PHP2Shell, however, you also need confirmation that your server has received the PHP patch.
Changing themes or switching page builders will not replace that server update.
What Should You Do After Your Host Applies the Update?
Once your hosting provider confirms the fix, check the parts of your website that matter most to your visitors and your business.
Open your main pages, sign in to your dashboard, and test important features. Depending on your website, these may include contact forms, search, customer accounts, booking tools, or checkout.
Keep a recent backup of your website’s files and database. If your hosting service provides backups, check how you can restore them and whether they cover everything you need.
You should also watch for unexpected changes. Unfamiliar administrator accounts, unusual redirects, or files you did not add deserve investigation. Ask your host to review anything suspicious. Applying the patch addresses the vulnerabilities, but it does not establish whether someone accessed the server before the update.
Keep Website Security Part of Your Routine
After you address the PHP update, review how you maintain the rest of your website.
Start with practical habits: install software updates, use strong and unique passwords, limit administrator access, and maintain backups. Remove plugins and themes you no longer need so you have fewer tools to manage.
Our guide on how to keep your WordPress site secure explains these steps in more detail, including account protection, user permissions, and safer software choices.
Pay attention to where you download themes and plugins, too. Unofficial copies of premium products may contain modified code and leave you without a reliable way to receive updates. Our article on the risks of nulled WordPress plugins and themes explains how those downloads can put your website at risk.
These maintenance habits support your website’s security alongside the urgent PHP fix.
So, Can You Continue Using Gutenverse?
Yes, you can continue using Gutenverse. The PHP2Shell advisories describe vulnerabilities in PHP itself. Removing Gutenverse or rebuilding your pages with another page builder will not resolve them.
Gutenverse gives you tools to build pages and site layouts through the native WordPress Block Editor and Site Editor. Like the rest of your WordPress website, it depends on the server environment your hosting provider maintains.
Keep Gutenverse updated and download the free plugin through the official WordPress plugin directory. For premium plans, you can visit our page here for additional features and updates included with your subscription.
You can keep your existing Gutenverse pages and editing workflow. Confirm the PHP fix with your hosting provider, check your website after the update, and continue maintaining your WordPress installation. Once your host has applied the patches, you have addressed this specific PHP issue and can return to building with Gutenverse.
