A critical misconception among website owners this week is that updating WordPress core or installing a WordPress security plugin will block PHP2Shell. As explained in an updated advisory by Codeable and GeekLord, the vulnerability executes inside the PHP interpreter before a single line of WordPress code ever loads.
Why Application-Level Firewalls Inside WordPress Are Bypassed
When an HTTP POST request arrives at a web server, the PHP runtime parses the form fields to populate the global $_POST array prior to invoking index.php. Because CVE-2026-109618 corrupts memory during that initial hash-table insertion, PHP security plugins never get a chance to inspect the request.
Action Checklist for WordPress and WooCommerce Site Owners
- Verify Managed Host Status: Automattic confirmed that WordPress.com, WordPress VIP, WP Cloud, and Pressable were patched at disclosure.
- Check cPanel MultiPHP Manager: Ensure your domain is assigned to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12—not an unpatched 8.0 or 8.1 build.
- Inspect via phpinfo() or Site Health: Check Tools → Site Health → Info → Server in the WordPress dashboard to see the exact active PHP version.
WordPress.org has confirmed that no WordPress core update is required or planned—patching the underlying PHP engine on the host is the only fix.
How Agency Developers Should Communicate With Clients
Agencies managing client retainers should audit each client's hosting tier, open support tickets with shared hosts that display outdated PHP build dates, and enable Cloudflare proxy protection.
Testing Plugin Compatibility on PHP 8.3 and 8.4
If a legacy site is forced to jump from PHP 7.4 to PHP 8.3 today, clone the site to a staging environment first to catch deprecated function notices. Full primary documentation is available via Codeable WordPress Security Advisory.
Comments (0)
Leave a Comment