PHP2Shell and wp2shell

What are PHP2Shell and wp2shell?

Two separate, critical attacks hit WordPress sites in 2026. Both let a stranger run their own code on your server without logging in, and both end the same way — with a backdoor ("webshell") on your site. This plugin checks for both.

	🔴 PHP2Shell	🟠 wp2shell
What's broken	PHP itself — the language WordPress runs on	WordPress core
CVE numbers	CVE-2026-109618, CVE-2026-109619	CVE-2026-63030, CVE-2026-60137
Made public	October 21, 2026	July 17, 2026
Attacks seen since	October 17, 2026 — before it was announced	Within hours of July 17, 2026
Severity	CVSS 9.2 (critical)	Critical
Who is affected	Practically every PHP website — WordPress, Drupal, Magento, anything — on unpatched PHP	WordPress 6.8 – 7.0.1
Extra danger	Can also leak memory: passwords, keys and tokens that passed through PHP	Creates admin accounts and uploads plugins
Fixed by	Updating PHP — usually your host's job	Updating WordPress — usually automatic

How PHP2Shell works

sequenceDiagram
    autonumber
    actor A as Attacker
    participant P as PHP on your server
    participant W as WordPress
    A->>P: Huge multipart form request (any page)
    Note over P: PHP runs out of memory while still<br/>reading the request - before WordPress even starts
    P-->>A: Error (often HTTP 500), but leftover<br/>internal state is not cleaned up properly
    A->>P: Second request, handled by the same PHP worker
    Note over P: PHP reuses the stale, freed memory
    alt Memory leak
        P-->>A: Response contains other visitors' data<br/>passwords, cookies, API keys
    else Code execution
        A->>P: Attacker's code runs inside PHP
        P->>W: Webshell written, admin created, files changed
    end

Loading

CVE	What goes wrong inside PHP
CVE-2026-109618	Memory corruption when PHP runs out of memory part-way through reading a request
CVE-2026-109619	State left over from one request (including upload-progress tracking) is reused by the next

Either one can be chained into a memory leak or into running code — so don't read the diagram as "leak = one CVE, code = the other".

Because the bug sits underneath WordPress, no WordPress setting, security plugin or maintenance mode can stop it. Only a patched PHP (or temporary php.ini settings your host can apply) does.

How wp2shell works

sequenceDiagram
    autonumber
    actor A as Attacker
    participant W as WordPress
    participant D as Database
    A->>W: Crafted request to the batch API (/wp-json/batch/v1)
    Note over W: CVE-2026-63030 - nested requests skip login checks
    W->>D: Query built from attacker input
    Note over D: CVE-2026-60137 - SQL injection in WP_Query
    A->>W: Creates or hijacks an administrator
    A->>W: Uploads a "plugin" that is really a webshell

Loading

What attackers leave behind

Seen after these attacks	What it looks like on your site
A webshell disguised as a plugin	A plugin folder like wp2shell_6a5566a6, or plugins called CMSmap, WP Static Cache Helper, or starting with gg-
A webshell dropped straight onto disk	A small PHP file in wp-content/cache/, uploads/, wp-content/ itself or the site root
A hidden REST backdoor	A plugin that registers /wp-json/morning/v1/… and runs any command sent to it
New or promoted admin accounts	Administrators you don't recognise
Backdoors kept in the database	Code in a setting that a small loader runs, scripts or hidden links injected into posts, a scheduled task that reinstalls the webshell
A backdoor inside a real plugin	A plugin file that no longer matches the official copy on wordpress.org, or an extra PHP file in its folder
Stolen secrets (PHP2Shell)	Nothing visible — which is why you should change passwords and keys if you were exposed
Traces in server logs (PHP2Shell)	"Allowed memory size … exhausted … in Unknown on line 0", PHP worker crashes, bursts of failed POSTs, the public scanner tools (php2shell-scan, php2shell-verify, JACKALPOC) in the access log
A second-stage program (PHP2Shell)	The Potassium botnet (a Mirai variant) downloaded into /tmp as nfs, nfs-setup, mountpoint or cCmono
Webshells from PHP2Shell kits	PHP files named wp2s.php, php2shell.php, axiom_*.php or autologin_fd.php; code that prints P2S_OK or talks to the botnet's servers
Poisoned PHP sessions (PHP2Shell)	Session files with the kits' fixed IDs (sess_p2sopchain…) or markers (NxSP…), planted to be included later

Is my site affected?

You need to check two things: your PHP version (for PHP2Shell) and your WordPress version (for wp2shell). The scanner checks both for you, and shows your PHP version on its page. You can also find it under Tools → Site Health → Info → Server.

PHP (PHP2Shell)

Your PHP version	Status	What to do
8.5.12+, 8.4.27+, 8.3.36+, 8.2.35+	🟢 Fixed	Nothing for PHP2Shell
8.5.0 – 8.5.11 · 8.4.0 – 8.4.26 · 8.3.0 – 8.3.35 · 8.2.0 – 8.2.34	🔴 Vulnerable — unless your host patched it without changing the number (see below)	Ask your host to update or confirm
7.4, 8.0, 8.1	🔴 No official fix — the PHP team only published source-code patches	Ask your host whether they applied them; plan a move to 8.2+
7.3 and older (5.4 – 7.3)	🚨 Will never be fixed	Move to PHP 8.2+ as soon as possible

Note

"My version number looks old, but my host says it's patched." That can be true. Linux distributions (Ubuntu, Debian, AlmaLinux, Rocky, CloudLinux, Red Hat…) often fix PHP without changing its version number. The scanner detects this situation and says "ask your host to confirm" instead of "vulnerable". If they confirm, click Ignore on that finding.

On Ubuntu and Debian the scanner can usually settle this itself: it reads the installed package version (for example 8.3.6-0ubuntu0.24.04.13) and knows which package builds carry the fix. On other systems it also looks at when PHP was built (the date on PHP’s own files) — a PHP built after October 21, 2026 is reported as probably patched.

Distribution	PHP	First fixed package
Ubuntu 26.10	8.5	8.5.9-0ubuntu2.1
Ubuntu 26.04 LTS	8.5	8.5.4-0ubuntu1.5
Ubuntu 24.04 LTS	8.3	8.3.6-0ubuntu0.24.04.13
Ubuntu 22.04 LTS	8.1	8.1.2-1ubuntu2.28
Ubuntu 20.04 (ESM)	7.4	7.4.3-4ubuntu2.29+esm5
Ubuntu 18.04 (ESM)	7.2	7.2.24-0ubuntu0.18.04.17+esm14
Ubuntu 16.04 (ESM)	7.0	7.0.33-0ubuntu0.16.04.16+esm22
Debian 13	8.4	8.4.27-1~deb13u1 (DSA-6574-1)
Debian 12	8.2	8.2.35-1~deb12u1 (DLA-4848-1)
RHEL 9 (php:8.2 module)	8.2	php-8.2.35-1.module+el9.8.0… (RHSA-2026:87072)

Debian and Red Hat moved to the fixed upstream version numbers, so the normal version check covers them. At the time of writing, Alpine, Homebrew, the Docker official php image and Remi had not shipped fixed builds yet.

WordPress (wp2shell)

Your WordPress version	Status	Fixed in
6.8 – 6.8.5	🟠 SQL injection only	6.8.6
6.9 – 6.9.4	🔴 Full takeover without login	6.9.5
7.0 – 7.0.1	🔴 Full takeover without login	7.0.2
Older than 6.8, or 6.8.6 / 6.9.5 / 7.0.2 and newer	🟢 Not affected	—

Important

Patching closes the door — it doesn't remove someone already inside. If your site ran a vulnerable PHP after October 17, 2026, or a vulnerable WordPress after July 17, 2026, run a scan to look for signs of a break-in.

flowchart TD
    A["Run the scanner"] --> B{"Is PHP patched<br/>for PHP2Shell?"}
    B -->|"No / not sure"| C["🔴 Send your host the<br/>ready-made message"]
    B -- Yes --> D{"Is WordPress patched<br/>for wp2shell?"}
    C --> D
    D -- No --> E["🟠 Update WordPress"]
    D -- Yes --> F{"Any signs of<br/>a break-in?"}
    E --> F
    F -- Yes --> G["🚨 Follow the clean-up steps"]
    F -- No --> H["🟢 Keep weekly scans on"]

Loading