PHP2Shell: Wordfence Confirms No WordPress Breaches After One Week
Wordfence confirms as of 28 October: no WordPress sites compromised via PHP2Shell, but 77,600 suspicious requests in 5 days. PHP patches still pending.
UptimeMag editorial team · 28 October 2026 · 2 min read
Wordfence published an update on 28 October 2026 regarding PHP2Shell, the pair of critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) patched one week earlier. The key point for those managing WordPress hosting is straightforward: the vulnerability remains critical, but no one has successfully exploited it on a WordPress site yet, at least according to the company's findings.
What Wordfence Says
As of 28 October 2026, Wordfence is not aware of any WordPress site compromised via PHP2Shell (CVE-2026-109618 and CVE-2026-109619). The company continues to see requests linked to PHP2Shell across the over 5 million sites it protects, but these requests show ongoing scans and exploitation attempts rather than successful compromises. Wordfence's site cleanup and incident response teams have not handled any WordPress compromise attributed to these vulnerabilities.
The new data concerns attack volume: from 23 to 27 October, a dedicated monitoring rule logged approximately 77,600 requests from more than 2,000 IP addresses.
Patching Remains the Only Answer
No confirmed compromises do not make an unpatched server safe: the fix remains to update PHP on the server to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a vendor package confirmed to contain both patches) and restart PHP. Updating WordPress does not update PHP.
| PHP Branch | Patched Version |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
For those using PHP 8.1 or earlier versions there is no official release: check with your control panel or distribution for a package with a confirmed backport.
What Changes for Server Operators
The two CVEs were added by CISA to the KEV catalogue (Known Exploited Vulnerabilities) on 26 October 2026, with a remediation deadline set to 29 October for US federal agencies. For those managing hosting in Italy the deadline is not binding, but it signals that the level of attention remains high one week after the 21 October patch release.
Anyone who has not yet verified the PHP version in production should do so now: run php -v on the server, compare against the table above, and if necessary contact your provider for the correct package before restarting PHP-FPM or mod_php processes.
Written with the help of artificial intelligence and checked by the editors (EU AI Act, art. 50). Source: Wordfence – vulnerabilità WordPress.