PHP2Shell exploitation attempts have begun: WordPress breach odds in numbers

On 21 October 2026 the PHP project fixed two critical flaws, known as PHP2Shell. The NSA and FBI told organisations to patch at once or take affected systems offline. Every WordPress site runs on PHP, and WordPress sites usually add many more moving parts on top. This post explains why, and what the odds look like.

What happened this week

PHP2Shell is two memory-handling flaws in the PHP interpreter (public flaw IDs, known as CVEs: CVE-2026-109618 and CVE-2026-109619). Both allow an anonymous visitor to run code on the server with the web server's permissions. On some common server set-ups (Apache with mod_php), one of them triggers before any application code runs, so the website itself cannot defend against it. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are also affected.

Two points matter for site owners. First, PHP updates are not installed automatically, so each host or server owner has to act. Second, PHP 8.1 and older get no official packaged release. The PHP project published only source-code backports for 7.4, 8.0 and 8.1, so most hosts will not apply them. An estimated 48% of PHP websites run on branches that no longer receive routine security updates, and those sites stay exposed until they move to a supported version. Patching also does not remove an attacker who got in before the fix.

How PHP2Shell is being exploited

These attacks are not theoretical. This is what security teams have reported so far.

• Attempts began before the fix. Amazon Threat Intelligence reported an exploitation attempt on 17 October, four days before PHP released fixes.
• No login is needed. On Apache with mod_php, one flaw can be triggered by an anonymous request before WordPress or any plugin code runs, so the site cannot block it itself.
• Attackers are adapting. Cloudflare has seen attack traffic, including payloads changed to try to get past its protections.
• Security vendors moved fast. Sophos released intrusion prevention signatures on 22 October, the day after the fixes. These signatures detect exploitation attempts while owners update PHP.
• Patching does not clean up. The NSA and FBI advise watching servers for unexpected commands or file downloads, to catch any attacker who got in before the fix.

At disclosure, the PHP Foundation said its own team had not confirmed a working exploit from the public proof-of-concept code. Even so, attempts are already under way, so treat this as urgent.

Why WordPress has many more things that can go wrong

PHP runs about 69% of websites whose server language can be identified, so PHP2Shell affects far more than WordPress. WordPress is different because of how many separate layers sit on top of PHP, each owned by someone else and each patched on its own timetable.

WordPress core is well run. Only six core flaws were reported in 2025, and core fixes reach most sites within hours through automatic updates. Even so, July's wp2shell chain showed that core is not immune. The larger risk sits in the plugin layer, where 91% of 2025's 11,334 new WordPress vulnerabilities were found.

The average site runs between 12 and 21 plugins, depending on the survey. Each one is written by a different developer or team. Some are well-funded companies with security staff. Many are one person working evenings, a small agency, or a freelancer who has since moved on. They work in different countries, to different standards, with different testing habits. All of their code runs inside the same PHP process, with the same access to your database as WordPress itself.

Why this is fragile from a quality point of view

• No common quality bar. WordPress.org reviews a plugin when it is first submitted. After that, developers publish updates without an independent security review.
• Fixes depend on someone else's diary. More than half of plugin developers did not patch a reported flaw before it was made public. In 2025, 46% of disclosed flaws had no fix on the day they went public.
• Ownership changes hands. Popular plugins are bought and sold. A new owner inherits your trust and your automatic updates.
• Abandonment is silent. A plugin can stop receiving updates for years while still working, so nothing tells you its code has become a liability.
• Dependencies stack up. Plugins bundle their own PHP and JavaScript libraries, so one plugin can carry the weaknesses of several other projects.
• Many flaws need no login. In 2024, around 43% could be exploited by an anonymous visitor.

How attackers pick WordPress targets

The WordPress.org plugin directory is public, and so is each plugin's install count and code history. That gives attackers the same view a market analyst would want: where the biggest return for the least effort is. The work follows a predictable sequence.

• Rank by reach. A flaw in a plugin with 10 million installs is worth far more than one in a plugin with 500. If only 20% of those sites are still unpatched a week later, that is about 2 million exposed sites from one bug.
• Read the fix. Plugin code history on WordPress.org is public. When a fix ships, comparing the old and new code shows exactly what was broken. AI tools can shorten the time to build a working exploit.
• Find the old versions. Most plugins publish a readme file that states their version. Scanners request that file across millions of sites and list the ones still running the vulnerable release.
• Prefer no-login flaws. A flaw that works for an anonymous visitor can be fully automated, so these are exploited first.
• Work the long tail too. Small and abandoned plugins get less attention from researchers, and buying an unmaintained plugin gives an attacker a ready-made update channel to every site that runs it.

The result is speed. For the most-targeted flaws, mass exploitation starts a median of about 5 hours after disclosure. Around 45% are attacked within 24 hours and 70% within a week.

Monte Carlo simulation: what are the odds?

A Monte Carlo simulation runs the same scenario many times with random variation, then counts how often an outcome happens. We modelled 100,000 sites for each combination of plugin count (5, 10, 15, 20) and protection level, over one to six years. Each plugin receives an average of 0.3 disclosed flaws a year. About a quarter can be exploited at scale. 46% have no fix at disclosure, and owners otherwise take around 14 days to update. Each exposed day carries about a 1% chance of an automated hit. A generic web application firewall (WAF) blocks 12% of attempts. A WordPress-aware WAF applies a virtual patch, a rule for that one flaw, to 90% of flaws within about 4 hours.

With no WAF, a site running 10 plugins has roughly a 1 in 7 chance of a breach in its first year and close to even odds over six years. At 20 plugins the six-year figure passes 60%. Each plugin added is another independent developer whose mistakes become your problem.

No WAFGeneric WAFWordPress-aware WAF with virtual patching

These figures come from a model, not a forecast for any single site. The model covers plugin flaws only. Runtime flaws such as PHP2Shell add risk on top. Use the figures to compare choices, not as exact predictions.

Other PHP platforms with the same risk

PHP2Shell affects every PHP application served from an unpatched runtime. Content management systems built on PHP plus third-party extensions also share the plugin problem.

What to do now

1. Check your PHP version today. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later. If your site runs PHP 8.1 or older, plan the upgrade now, because no packaged fix is coming.
2. Ask your host for proof. Shared and managed hosts patch on their own schedule. Get the version in writing.
3. Look for signs of entry. Check for new admin accounts, unknown plugins and unexpected files, because patching does not remove an attacker already inside.
4. Count your plugins. Remove anything unused, duplicated or abandoned (no update in 12 months).
5. Put a WordPress-aware WAF with virtual patching in front of the site. It closes the gap between disclosure and the real fix.
6. Ask whether the site needs to run PHP at all. Many marketing sites can be rebuilt as static pages, which removes the PHP runtime and the plugin layer completely. See the section below.

Moving from WordPress to Astro

Patching, firewalls and fewer plugins reduce the risk. They do not remove it, because the PHP runtime and the plugin layer are still there. For most marketing and lead-generation sites, those layers do no work a visitor can see.

Our WordPress to Astro replatform service rebuilds the site with Astro, a framework that produces ready-made static pages, served from Cloudflare's edge network. Design and content carry over. Editors can keep a content management system (Sanity) or work fully static. The live site then has no PHP, no plugins and no database for an attacker to reach, so flaws like PHP2Shell and wp2shell do not apply to it.

• Security: no PHP runtime, plugin layer or public admin login on the live site.
• Speed: pages are pre-built, so they usually load much faster than the WordPress version.
• Running cost: no plugin licences and far fewer patching hours.
• Search rankings protected: redirects and search engine optimisation (SEO) are handled as part of the move.

Every project starts with a written plan and your approval before any build begins. Get a free migration quote, or talk to us about a security review if you want to keep WordPress and harden it.

Sources