PHP2Shell and WordPress: What Site Owners Need to Do

By Umair Ali Sadaqat · Updated October 22, 2026 · Editorial policy

Updating WordPress, themes or plugins does not fix Black October; the bug is in PHP underneath. How to find who controls PHP for your WordPress site, update it safely and check nothing broke.

The most common question from WordPress owners this week is "which plugin do I update?" For PHP2Shell the honest answer is none of them. The flaws announced on 21 October sit in PHP itself, the language WordPress is written in, so a fully updated WordPress install on an unpatched PHP is still exposed. (Background is on the Black October overview.)

Keep your core, themes and plugins current anyway, but the job here is different: get the PHP version under your site to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later.

Step 1: read your PHP version inside WordPress

Log in as an administrator and go to Tools → Site Health → Info → Server. Note the "PHP version" line exactly, including the last number. Site Health reads it from the running site, which makes it more reliable than anything your host's marketing page says.

If Site Health is disabled by a plugin, use one of the other methods in our PHP version guide.

Step 2: work out who controls PHP

This decides what you do next.

Managed WordPress hosting (the host runs the server, you only log into WordPress): the host updates PHP, not you. Check their status page or support channel for a PHP2Shell notice, and ask for the patch date if they have not published one.
Shared hosting with cPanel or Plesk: the host patches the PHP builds; you may choose which branch your account uses. Follow the shared hosting guide.
Your own VPS or cloud server: you update PHP through the operating system's package manager, then restart PHP-FPM or Apache.
WordPress.com: PHP is run by the platform for you.

Step 3: before you change branches, take a backup

Patch releases within the same branch (say 8.3.30 to 8.3.36) are meant to be drop-in. Moving between branches, for example from 8.1 to 8.3, is where WordPress sites break, usually because an old plugin or theme uses something newer PHP removed.

Take a full backup first: files plus database. Most hosts offer a one-click snapshot; a backup plugin works too, as long as the copy is stored off the server.

Step 4: update and restart

On a server you run:

```bash

Debian / Ubuntu

sudo apt update && sudo apt upgrade sudo systemctl restart php8.3-fpm # use your version number

Red Hat / Alma / Rocky

sudo dnf upgrade sudo systemctl restart php-fpm ```

If Apache runs PHP as mod_php, restart Apache as well. The advisory rates mod_php as the most exposed setup, so do not leave that restart for later.

Step 5: check the site still works

Reload Site Health and confirm the new version.
Load the home page, a post, the contact form and, if you sell, the checkout.
Look at Tools → Site Health → Status for new warnings.
If something broke after a branch change, turn on WP_DEBUG_LOG in wp-config.php briefly, read wp-content/debug.log, and update or replace the offending plugin. Turn logging off again afterwards.

If you cannot update this week

Some hosts move slowly. Ask them whether they can apply the temporary settings in our stopgap guide, mainly turning off session.upload_progress. Note that WordPress-level tricks will not help here: the setting has to be applied before PHP parses the request, so ini_set() in a plugin or a line in .user.ini is not enough.

WordPress-specific places to look for intruders

Because attacks started before the patch, check for an earlier break-in. On WordPress, start with:

Users → All Users: any administrator you do not recognise.
wp-content/uploads: any .php file. Uploads should be images and documents.
wp-content/mu-plugins: "must-use" plugins load silently and do not appear in the normal plugin list.
Recently modified files in wp-includes and wp-admin, which should only change during core updates.

The full process, including what to do if you find something, is in was my site hacked.

Move your site to WeInc

If your WordPress site is a brochure site you mostly leave alone, you may not want to own a PHP server at all. Move your site to WeInc: first month free with code BLACKOCTOBER, until November 21, 2026. New customers only. Claim the offer

Alternatives mentioned in this article

WordPress alternatives

Related guides and tools

Start building

How we research, test and update this page: our editorial policy. We.Inc is our own product.