PHP2Shell: your questions, answered.

The PHP runtime beneath WordPress needs review. Updating WordPress core or a plugin does not update the server’s PHP installation. Ask your host which PHP package is serving your domain and whether it contains fixes for both CVEs.

Cloudflare has published WAF protections for attack patterns it has identified. Keep those protections enabled and review origin access. A WAF does not install the PHP patch, cover every possible vector, or establish that your server has not been compromised.

The first fixed upstream releases published on 21 October 2026 are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Distribution vendors may provide backported fixes under older upstream version numbers. Match the complete package revision to the vendor notice.

No. It interprets information you provide about your setup. It does not contact your server, scan your website, or detect compromise. Investigating a possible incident requires evidence from logs, files, processes and other sources.

Confirm every serving instance and worker is using the fixed build, including containers, background services and alternate pools. Test your application and review the period of exposure. Updating PHP does not remove persistence or undo credential theft.

No. PHP-FPM has different request lifecycle behavior from Apache mod_php, but the PHP advisories and Foundation analysis describe application-dependent exploitation paths. A runtime label alone cannot establish immunity.

Ask for the full package revision, the distribution release and repository, the security notice covering both CVEs, and confirmation that serving workers were restarted. Supported backports are legitimate; an unsupported assertion is not enough evidence.

Escalate to the provider or administrator. Consider restricting access to affected services while arranging the update. Temporary configuration changes and WAF rules have limits; there is no universal configuration change that replaces the complete PHP patches.