Is WordPress safe? Yes, if its server runs a patched version of PHP. Hypertext Preprocessor (PHP) is the language WordPress is written in. A flaw in it called PHP2Shell was patched on October 21, 2026. The same day, Amazon's security team wrote that PHP2Shell is "now being broadly exploited in the wild", meaning attackers are already using it against real sites. So the real question for an owner is who updates the server, and whether that update has happened yet.
| Key fact | Detail |
|---|---|
| What | Two flaws in PHP (CVE-2026-109618 and CVE-2026-109619) that let an attacker run their own code on a server without logging in (CISA) |
| When | Patched 2026-10-21; Amazon saw an attempt on 2026-10-17 |
| Fixed versions | PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
| Covered on day one | WordPress.com, WordPress VIP, WP Cloud, Pressable, Tumblr (Automattic) |
| Higher risk | Small sites run by individuals or small groups, often on shared hosting (The Globe and Mail / Reuters) |
| The fix | A PHP update on the server. A WordPress, theme or plugin update does not fix it. |
Is WordPress safe after PHP2Shell?
Yes, once the server runs a fixed version of the language. Before that, your site is exposed no matter how current its plugins are.
The scale is why this matters. One firm that scans the internet, Censys, counted about 1.5 million of 2.6 million tracked hosts still on a version with no fix. The figure comes from a Reuters report. The same report says the language runs about three in four websites where the server language is known.
The attacks started before the fix was public, and Amazon spotted one on October 17. CJ Moses, who wrote Amazon's post, put the lesson in one line on the company's security blog.
> "For critical vulnerabilities in internet-facing systems, measure patch and mitigation timelines in hours."
Patch windows are now hours, not weeks. If your host can't tell you today whether they updated the server, treat your site as exposed until they can.
Was PHP2Shell a WordPress bug?
No. It is a bug in the runtime, meaning the program on the server that reads and runs your site's code. Your site's software is one of many apps that sit on top of it.
Wiz Research, the team that found it, showed it working against the latest WordPress container image. It also reaches Drupal and Joomla, two other site platforms. The researchers say nearly every version back to 5.4 is affected. In their words, "applying the PHP security update remains the only complete remediation" for it.
Because the flaw lives below the site, clicking "update all" in your dashboard doesn't help. Automattic, the company behind WordPress.com, puts it plainly. "This is a runtime fix, so updating WordPress, your theme, or your plugins will not protect you on its own," it says. Cloudflare, a web security company, agrees.
Patchstack, a security firm, also warns owners away from unofficial "fix" plugins and code snippets. Only the real update is a full fix.
How risky is my setup?
Your risk depends on who controls the server. Here is how the common setups compare, using only what vendors and agencies have said in public.
| Setup | Who patches PHP | How fast you'd know | What PHP2Shell meant for it |
|---|---|---|---|
| Self-run WordPress on shared hosting | Your host, or you if you manage the server | Only if you check or your host emails you | Higher risk, per Automattic via Reuters; ask your host to confirm the update |
| Managed WordPress host | The host | Depends on host | Depends on host; Automattic's own managed platforms (WordPress VIP, WP Cloud, Pressable) were protected |
| WordPress.com-style hosted | The platform | The platform posts it | "There is nothing you need to do," per Automattic |
| Hosted builder (Wix, Squarespace and similar) | The vendor | Depends on vendor | Depends on vendor; we found no public PHP2Shell statement from these vendors |
| Site with no PHP on the server | No PHP to patch | Not applicable | PHP2Shell does not reach it; the host still has its own patch duty |
If you run your own site on shared hosting, check your version today. Our guide on how to check your PHP version takes a few minutes. For the full story of the bug, read what PHP2Shell is.
Two cautions from the sources. Some servers get the fix under an older version number, one security news report notes. So ask your host rather than guess from the number. And if you're on 8.1 or older, no fix exists for your version, so Automattic says to plan the move now.
Should I move off WordPress?
Patch first, decide later. A move takes weeks, and the risk window is measured in hours.
Once the server is patched, moving makes sense in three cases.
- Nobody owns patching. The site was built years ago, the person who set it up has left, and no one can tell you the version.
- The site is a brochure. Five to fifteen pages that change a few times a year don't need a server running code on every visit.
- You were already planning a rebuild. If a redesign is on the calendar, pick a setup with less to patch.
Staying makes sense in two cases.
- You depend on plugins or a store. An online shop, a members area or a booking plugin is real work to replace.
- You have a capable managed host. If your host patched on day one and told you so, the setup is doing its job.
We cover that trade-off in our post on platform bloat. The platform itself is not the villain here. Plenty of sites were patched within hours because someone was watching.
What does a site with no PHP on the server remove, and what does it not?
A site with no PHP on the server removes the exposure PHP2Shell hit, because there is nothing there for this attack to break. The sites we build do not run PHP on the server, so PHP2Shell does not reach them.
A site like that still has other jobs.
- It needs a host that patches its own systems. Every setup has its own update duty.
- It needs locked-down domain accounts, with two-step login at the company you bought the domain from.
- It needs safe forms, because whatever receives your contact form is software too.
- It needs vendor checks. The UK's cyber agency tells organisations to look for the language inside products that bundle it, including installs they didn't set up.
No setup is hack-proof. A site with no server code has fewer moving parts to patch, and that is the honest claim.
What does moving cost and how long does it take?
Our builds start at $2,500 in US dollars, and most owner-run sites fit one of four tiers.
| Tier | Price (US dollars) | Fits |
|---|---|---|
| Site | $2,500 | A credible, fast site with the copy written for you |
| Story | $5,000 | A custom design, plus your videos and podcasts turned into pages |
| Engine | $9,000 | Many services or locations, each with its own page |
| Studio | $15,000+ | Booking, ecommerce, a portal or other software on top |
Our monthly care plans run from $300 to $2,000 or more a month, and they include hosting. Our website cost guide compares those prices with agencies and freelancers.
On timing, our migration guide puts a marketing site of 20 to 100 pages at five to six weeks. A small brochure site usually takes less.
One example is Zebra Home Cinema, a home cinema installer with offices in the UK and Ontario. They came to us with six pages on WordPress, no homepage headline tag, no page descriptions and no sitemap. The site now has more than 190 pages, including 22 city pages and 96 blog posts.
We migrate sites off WordPress. If you're not sure where to start, our free site check will tell you whether your site runs PHP and which version.