How to update PHP on WordPress after PHP2Shell

WindowsMacUpdated

You don't update PHP from inside WordPress. PHP runs on your host's server, so you change it in your hosting panel or ask your host to do it. After the PHP security advisory of 21 October 2026, the versions to be on are 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and the PHP project says updating is the only complete fix.

Quick answer

Back up your site, then update WordPress, themes and plugins from Dashboard > Updates. Change the PHP version in your hosting panel; in cPanel that's MultiPHP Manager. Then check the site works and confirm the new version under Tools > Site Health > Info > Server. If you can't change it yourself, ask your host.

Why does PHP need updating now?

On 21 October 2026 the PHP project published fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619. CISA, the US cyber security agency, says they are known as "php2shell". The PHP advisory says they can allow unauthenticated remote code execution and affect all PHP installations serving web requests. WordPress runs on PHP, so a WordPress site is in scope whatever version of WordPress it uses.

The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Our PHP2Shell explainer covers the flaws themselves, and if you don't yet know your version, start with how to check your website's PHP version.

How do I back up WordPress before changing PHP?

Back up both parts of the site. WordPress's backup guide explains that the database holds your posts and comments, and the files hold everything else: WordPress itself, themes, plugins, uploads and wp-config.php. Backing up the files does not back up the database, so you need both.

  1. Check whether your host offers a backup tool.
  2. If not, use a backup plugin, or export the database with phpMyAdmin and copy the files over FTP.
  3. Keep copies in more than one place. WordPress suggests keeping at least 3 to 5 recent backups, stored in different locations, such as your server, cloud storage and your own computer.

WordPress's "Update PHP" page gives the reason plainly: a backup lets you go back if anything goes wrong.

How do I update WordPress, themes and plugins first?

WordPress's "Update PHP" page says to update everything before changing PHP, then confirm the site still works.

  1. In your WordPress dashboard, go to Dashboard > Updates.
  2. If a new WordPress version is listed, click Update Now. WordPress says you shouldn't need to do anything else.
  3. Update any plugins and themes that have updates waiting.
  4. Visit your site and click around the pages that matter most, such as the shop or the contact form.

To check whether your themes and plugins are ready for a newer PHP, WordPress suggests the PHP Compatibility Checker plugin. It also says the plugin "isn't perfect" and can give false positives. If something is flagged, WordPress's advice is to contact the theme or plugin developer, or switch to a similar alternative from WordPress.org.

How do I change the PHP version in cPanel?

cPanel's own documentation describes MultiPHP Manager, which lets you set the PHP version for each domain on your account. cPanel files it under Software.

  1. Log in to cPanel and open MultiPHP Manager.
  2. Select the checkbox next to the domain you want to change.
  3. Choose a version from the PHP Version menu.
  4. Click Apply.

cPanel says the menu only lists versions that are installed on the server and available to your account, and that the server administrator installs them. So the exact release you get within a branch, such as 8.3.36, depends on what your host has installed. That's why checking afterwards matters.

Some hosts use a different panel, or a differently named PHP tool. WordPress's "Update PHP" page links to instructions from a list of hosts, and suggests emailing your host if yours isn't there.

How do I check the site after updating PHP?

Confirm the version first, then check the site itself.

  1. In WordPress, go to Tools > Site Health, click the Info tab and expand Server.
  2. Scroll to PHP version and check it matches a fixed release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
  3. Visit your site's main pages, and log in and out of the dashboard.
  4. Go back to Tools > Site Health and look at the Status tab for any new critical issues.

If something breaks, WordPress's "Update PHP" page says you can switch the PHP version back yourself, or contact your host or a web developer. If you need to restore a backup, it says to ask your host to restore the previous PHP version first, then restore the backup.

When should I ask my host instead?

Ask your host if any of these apply:

  1. The domain shows "Inherited" in MultiPHP Manager. cPanel says that means it uses the system default, which only the server administrator can set.
  2. The version you need isn't in the menu. cPanel says versions appear only when the administrator has installed them.
  3. You can't find a PHP setting anywhere, or your hosting plan is managed for you.
  4. Your site is on PHP 8.1 or older. The PHP project says these "no longer receive updates from the PHP project", and some vendors provide backported fixes. Ask your host whether they have applied one, or move to a supported version.

The NCSC's advice for anyone who can't update is to apply PHP's temporary mitigations, and consider taking the system offline if that can't happen quickly. The PHP advisory says those mitigations "do not make an installation safe". On shared hosting, the update itself is what to ask for.

More questions

Can I update PHP from the WordPress dashboard?

No. WordPress's "Update PHP" page says updating happens through your host's settings, or by asking your host to do it. The dashboard shows your version under Tools > Site Health > Info > Server, and Site Health may flag an outdated version as a security issue, but the change itself is made on the server.

Which PHP version should WordPress use?

WordPress's "Update PHP" page recommends PHP 8.3 or higher. For PHP2Shell, the PHP advisory's fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP's supported versions page shows 8.2 gets security fixes only until 31 December 2026.

Will updating PHP break my WordPress site?

It can, if a theme or plugin isn't ready for the newer version. That's why WordPress says to back up and update everything first, and suggests the PHP Compatibility Checker plugin. If something does break, you can switch back or ask your host while you sort it out.

Is updating WordPress enough to fix PHP2Shell?

No. The flaws are in PHP, not WordPress. Keeping WordPress, themes and plugins updated is still part of WordPress's advice before a PHP change, but the PHP advisory says only a PHP update is a complete fix.

What if my site might already have been tampered with?

The NCSC advises checking systems that couldn't be updated straight away for signs of compromise and backdoors. Our guide on what to do if your website is hacked covers the first steps for a personal site.

Sources