You keep WooCommerce, your theme and your plugins up to date. When a security warning comes out, you click Update and move on. That habit won’t protect you this time.
On October 21, 2026, the PHP project fixed two critical flaws in PHP itself, nicknamed PHP2Shell. PHP is the language WordPress and WooCommerce run on. It lives on your hosting server, not in your plugins list.
WooCommerce’s own advisory is clear: no WooCommerce or WordPress update is needed or planned. The fix is a newer PHP version. Both flaws score 9.2 out of 10 on the CVSS severity scale.
This post covers four steps: check your PHP version, ask your host, handle an old version, and test after the upgrade.
Updating WooCommerce won’t fix PHP2Shell
The two flaws are CVE-2026-109618 and CVE-2026-109619. According to the PHP security release, both can let an attacker run their own code on your server without logging in. PHP says the highest risk is on servers using mod_php, a common Apache setup.
Because the bug is in PHP, any site on a vulnerable server is exposed. WordPress.org and WooCommerce say the same thing: update PHP.
This isn’t a lab-only threat. Amazon’s threat team logged an exploit attempt on October 17, four days before the fix went public, as Help Net Security reports. On October 26, the US cyber security agency CISA added both flaws to its list of vulnerabilities attackers are already using.
PHP also says there is no complete workaround. Updating PHP is the only full fix.
Check your PHP version in two minutes
In your WordPress admin, go to Tools > Site Health > Info and open the Server section. Look for the PHP version line. You can also see it under WooCommerce > Status or in your hosting control panel.
Compare it with the fixed releases:
- PHP 8.5.12 or newer
- PHP 8.4.27 or newer
- PHP 8.3.36 or newer
- PHP 8.2.35 or newer
Is your number lower than the fixed release for your branch? Your server needs an update. Do you see 8.1, 8.0 or 7.4? Jump to the section on old versions below.
On managed hosting, ask your host to confirm the patch
Most store owners don’t control PHP. Your host does. WordPress.org and WooCommerce both say hosts may already be patching and adding firewall rules, but you should still check.
There’s a second reason to ask. Some Linux distributions and long-term support vendors add fixes to older PHP builds. So the version number alone may not tell you whether you’re safe.
Some sites are already covered. WooCommerce says sites on WordPress.com, WordPress VIP, Pressable and WP Cloud were protected. Cloudflare says its firewall rules for the known attack paths are live for all customers, including free plans. A firewall rule helps, but it isn’t a patch.
Copy this message and send it to your host:
Hi, my site is [your domain]. Can you confirm the server is patched for PHP2Shell (CVE-2026-109618 and CVE-2026-109619)? Which PHP version is my site running, and does it include the October 21, 2026 fixes? If not, when will it be updated, or can you move my site to PHP 8.3 or newer?If your host can’t give you a clear answer, treat that as a no.
PHP 8.1 or older gets no official fix, so upgrade now
The PHP project no longer updates PHP 8.1 or older. It did publish small source code fixes for 7.4, 8.0 and 8.1. Those are for people who build PHP themselves, not for normal hosting plans.
Run your own server and can’t update right away? WordPress.org points to the UK National Cyber Security Centre’s advice: consider taking the server offline until it’s fixed.
WooCommerce is moving the same way. WooCommerce 11.6, planned for February 2027, will need PHP 8.1 or newer. WooCommerce 11.5 is the last planned release for PHP 7.4 and 8.0. About 7% of tracked stores still run PHP 7.4, and about 2% run PHP 8.0.
Here’s the catch. PHP 8.1 meets WooCommerce’s new minimum, but it gets no PHP security fixes. PHP 8.2 got this patch, but it reaches end of life on December 31, 2026. WooCommerce recommends PHP 8.3 or newer. Go straight there and you upgrade once instead of twice.
I wouldn’t wait for your host to email you. Ask today, in writing, and if the answer is vague, push for PHP 8.3 or newer instead of a patched old version. You’ll need to upgrade before WooCommerce 11.6 anyway, so do it now, before the holiday rush, while mistakes are cheap to fix.
Test checkout, payments and your key plugins before the holiday rush
A PHP upgrade can break old plugins or custom code. WooCommerce suggests testing on a staging site first. That’s a private copy of your store where mistakes don’t cost sales. Check these:
- Checkout with each payment method, using a test order
- Shipping rates and tax
- Order emails and status changes
- Scheduled jobs, like subscription renewals or stock syncs
- Your theme, extensions and any custom code snippets
Then check again on your live store after the switch. Does your store have custom code nobody has touched in years? Test that part first.
For a general update routine, our WooCommerce 11.2 update checklist walks through what to check before and after any update.
How WCBoost can help
- Staging tests: Add Variation Swatches, Wishlist and Products Compare to your staging test list, like any other plugin. Open a product page, pick a variation, save an item and compare two products.
- Settings help: Our docs show where each setting lives, so you can confirm nothing changed after the upgrade.
- Support: If a WCBoost plugin acts up on a newer PHP version, open a ticket with your PHP and WooCommerce versions.
Check your PHP version in Site Health today, and if a WCBoost plugin gives you trouble after the upgrade, tell us here.