On October 21, the PHP project released fixes for two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, now known together as PHP2Shell. Both are rated 9.2 out of 10 for severity, which is very high. The Elementor Hosting team took action immediately and deployed protection for sites before the official fix even became available. Every Elementor Hosting site is now running a patched and updated version of PHP. If your site is on Elementor Hosting, you don’t need to do anything.

If you run your Elementor site somewhere else, you do. The section below tells you what to check.

What PHP2Shell is

The PHP2Shell flaws are in the PHP runtime, not in WordPress, Elementor, your plugins or theme. They’re related to how PHP handles requests that get cut off partway through and what is kept in memory from that point. Because the problem is in the language your code runs on, no amount of careful coding in WordPress or Elementor closes it: only a PHP update can.

The vulnerable code has been in PHP since version 5.4 came out in 2012, so it applies to a large number of servers.

What happened on our side

We opened an emergency security response immediately upon learning of this issue and the upcoming patch. Our hosting and security teams had protections running at our network edge and on the servers themselves in a short period of time, detecting and blocking the request patterns the exploit depends on. That gave us breathing room to apply the permanent fix properly instead of rushing it.

Through the rest of the day, the hosting team prepared updated PHP builds for every version we support, along with the automation to push them out across our infrastructure. We emailed all Elementor Hosting customers that afternoon to tell them what was already in place and what was still coming, and by the end of the same day, patched PHP was live across all supported PHP versions on every Elementor Hosting site.

As a result of these actions taken by our team, Elementor Hosting customers are protected, and there’s nothing you need to do. We manage PHP on your behalf, the patched builds are already running, and no setting needs changing on your side.

We’re still watching closely for exploit attempts and for any follow-up advisories from the PHP project.

If your Elementor site is hosted somewhere else

You can check for yourself whether your hosting provider has updated your PHP version. In your WordPress admin, go to Tools > Site Health > Info and open the Server panel, which shows the full PHP version down to the patch number.

What you want to see there is 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or anything newer in those branches. Note that 8.3.36 is patched, and anything lower in the 8.3 line is not. If your number falls short, the update hasn’t reached your site yet. Many hosts have already patched and emailed their customers, so if yours has been quiet, open a support ticket and ask where things stand.

If you’re on PHP 8.1 or older, there is no patch coming. Those branches stopped receiving security support before these flaws were found, and the only real fix is moving to a version that’s still supported. PHP 8.2 is the oldest branch that got a fix this time, and its own security support runs out at the end of this year, on December 31, 2026. If you’re planning to upgrade, aim for 8.3 or newer.

Where an immediate PHP update isn’t possible, your host can narrow the exposure in the meantime with firewall rules that block the exploit patterns, tighter limits on file uploads, and turning off PHP’s upload progress tracking. These reduce the risk while you wait for the update, but they don’t remove it.

Whatever your version number says, this is a good time to learn how your host handles PHP updates generally. Some hosts manage the runtime for you and push security releases out without asking. Others leave the version selector in your dashboard and expect you to move it yourself, which means a patch may be available that is just sitting there until you click to update. Knowing how your host operates indicates how your updates get handled now and what to expect the next time something like this comes up.

PHP2Shell won’t be the last PHP security release, so when the next one lands, how exposed your site is comes down to whether someone is applying those updates for you. On Elementor Hosting, that’s us. Anywhere else, find out who it is so you’re prepared.