PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619, flaws in PHP’s handling of interrupted requests and associated in-memory data. Rated 9.2 out of 10, they affect the runtime beneath WordPress rather than WordPress core, Elementor, themes or plugins. Because the vulnerable code dates to PHP 5.4, application-level changes cannot resolve the issue; the PHP runtime must be patched.

For WordPress sites, protection therefore depends on the hosting provider’s PHP update process. Elementor Hosting deployed temporary protections at its network edge and on its servers before applying patched builds across supported PHP versions. Its hosted sites are updated without customer configuration changes; sites on other platforms require confirmation from their provider.

The patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or later releases in those branches. The full version appears in WordPress under Tools > Site Health > Info > Server. PHP 8.1 and earlier have no fix, so an upgrade is required; PHP 8.3 or newer is preferable because PHP 8.2 security support ends on December 31, 2026. Firewall rules, stricter upload limits and disabling PHP upload progress tracking may reduce interim exposure, but cannot replace an update.

Author of the original text: Miriam Schwab (Elementor)