- What happened: on 21 October 2026 at 14:00 UTC, PHP released PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, fixing two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, informally “php2shell”), both rated CVSS v4.0 9.2.
- Are you affected: PHP confirmed that all versions before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are affected. InstaWP has already applied the recommended interim mitigation on all InstaWP-managed servers and will install the patched PHP versions as soon as they are available.
- What to do: if your site runs PHP 8.2 or newer, nothing. If it runs PHP 8.1 or older, move it to PHP 8.3 or newer, testing on a staging copy first.
What is php2shell?
php2shell is the informal name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. On 20 October 2026 the PHP security team gave advance notice of a security release scheduled for Wednesday 21 October 2026 at 14:00 UTC, fixing two vulnerabilities that are both rated CVSS v4.0 9.2 (critical).
The vulnerabilities are reported to allow remote code execution without a login, through the way PHP handles file uploads (specifically, the session upload-progress feature). In plain terms: an attacker who can reach a vulnerable site may be able to run their own code on the server. PHP published the fixed versions with its release on 21 October 2026 at 14:00 UTC.
PHP confirmed that all versions before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are affected. PHP 8.1 and older are past end of life and will not receive an official fix. Security vendors report early exploitation attempts.
What has InstaWP done?
On the morning of 21 October 2026, InstaWP applied the recommended interim mitigation (disabling PHP’s session upload-progress feature) across all InstaWP-managed servers ahead of the release. We tested it on staging first and confirmed it caused no disruption to uploads or sites.
We are installing the patched PHP versions on all InstaWP-managed servers as soon as they are available. This page will be updated as that happens.
What do InstaWP customers need to do?
What you need to do depends only on the PHP version your site runs.
| Your site runs | What you need to do | Why |
|---|---|---|
| PHP 8.2, 8.3, 8.4 or 8.5 | Nothing. | InstaWP patches the servers. The interim mitigation is already in place. |
| PHP 8.1 or older | Move the site to PHP 8.3 or newer, testing on a staging copy first. | PHP itself no longer supports 8.1 and older. Our PHP package provider has published patched builds for PHP 7.4, 8.0 and 8.1, and we’ll install those as well. These versions are still end of life and won’t get future fixes, so we recommend moving to PHP 8.3 or newer. |
Sites on PHP 8.2 or newer
You do not need to do anything. InstaWP has applied the interim mitigation on all InstaWP-managed servers and is installing the patched PHP versions as soon as they are available.
Sites on PHP 8.1 or older
Move the site to PHP 8.3 or newer. PHP itself no longer supports 8.1 and older. Our PHP package provider has published patched builds for PHP 7.4, 8.0 and 8.1, and we’ll install those as well. These versions are still end of life and won’t get future fixes, so we recommend moving to PHP 8.3 or newer. Test the change on a WordPress staging copy first, then make the same change on the live site:
- Go to the Sites page in your InstaWP dashboard.
- Click the ⋯ (horizontal ellipsis) button next to the site and select PHP Config.
- Change the PHP version to 8.3 or newer and save.
- Check the site’s key pages, forms and admin area before you repeat the change on production.
The full walkthrough is in the InstaWP guide to configuring PHP.
Timeline (UTC)
Newest first. New entries are added here as the situation develops.
Frequently asked questions
Do I need to do anything?
Only if your site runs PHP 8.1 or older. In that case, move it to PHP 8.3 or newer, testing on a staging copy first. Sites on PHP 8.2 or newer need no action: InstaWP has applied the interim mitigation on all InstaWP-managed servers and will install the patched PHP versions as soon as they are available.
My site is on WP Cloud (previously InstaWP Live). Does this apply to me?
Sites on WP Cloud (previously InstaWP Live) run on our hosting partner’s platform. Our partner has confirmed that those sites are already patched, so there’s nothing you need to do.
How do I check my PHP version?
In your InstaWP dashboard, go to the Sites page, click the horizontal ellipsis button next to the site and select PHP Config. The PHP version field shows the version the site currently runs.
Will switching PHP versions break my site?
It can, if an older or unmaintained plugin or theme does not support the newer PHP version. That is why you should make the change on a staging copy first and check your key pages, forms and admin area before changing the live site. If something breaks, update or replace the plugin that caused it rather than staying on PHP 8.1. PHP itself no longer supports 8.1 and older. Our PHP package provider has published patched builds for PHP 7.4, 8.0 and 8.1, and we’ll install those as well. These versions are still end of life and won’t get future fixes, so we recommend moving to PHP 8.3 or newer.
What about my staging sites?
Staging sites follow the same rule as any other site. If a staging site runs PHP 8.2 or newer, there is nothing to do. If it runs PHP 8.1 or older, change its PHP version in the same PHP Config dialog. You can open a staging site directly to reach its PHP settings.
Why do you recommend PHP 8.3 instead of 8.2?
PHP 8.2 is fixed in 8.2.35, but its security support ends on 31 December 2026. Moving to 8.3 or newer now means you will not need to upgrade again before the end of the year.
Did the interim mitigation affect file uploads on my site?
InstaWP tested the mitigation on staging before rolling it out and confirmed it caused no disruption to uploads or sites. It disables only the session upload-progress feature, not file uploads themselves.
Has the vulnerability been exploited?
Security vendors report early exploitation attempts. Updating PHP is the only complete fix, which is why we’re installing the patched versions on all InstaWP-managed servers.
References
- PHP.net: Upcoming Critical PHP Security Release (20 October 2026)
- PHP.net: Supported versions and end-of-life dates
- InstaWP docs: Configure PHP for your site
- PHP security advisory for CVE-2026-109618
- PHP security advisory for CVE-2026-109619
- NVD: CVE-2026-109618
- NVD: CVE-2026-109619
Questions about your site? Contact InstaWP support and we will help.
