{"id":1800,"date":"2026-10-21T22:19:42","date_gmt":"2026-10-21T20:19:42","guid":{"rendered":"https:\/\/onnetwork.agency\/?p=1800"},"modified":"2026-10-22T10:32:48","modified_gmt":"2026-10-22T08:32:48","slug":"php2shell-wordpress","status":"publish","type":"post","link":"https:\/\/onnetwork.agency\/en\/php2shell-wordpress\/","title":{"rendered":"PHP2Shell: What the PHP vulnerability means for your WordPress site"},"content":{"rendered":"<section id=\"hero-section-block_ba536f26f944e64a2ba84bb907eb7111\" class=\"hero-section alignfull position-relative\">\n    <div class=\"container hero-container flex-column\">\n        <div class=\"row align-items-center position-relative\">\n\n            <!-- Left Side \/ Text & Buttons -->\n            <div class=\"col col-md-9 col-lg-8 col-xl-7 hero-col-text\">\n\n                <div class=\"hero-content-wrapper\">\n                    \n                                            <div class=\"hero-text-area\">\n                            <h1>PHP2Shell:<br \/>\n<span style=\"color: #ee6352;\">What the PHP vulnerability means for your WordPress site<\/span><\/h1>\n                                                    <\/div>\n                    \n                                    <\/div>\n            <\/div>\n\n\n            <div class=\"hero-graphic-wrapper d-none d-lg-block\">\n                                    <figure class=\"hero-image-figure\">\n                        <img loading=\"lazy\" decoding=\"async\" width=\"1800\" height=\"1200\" src=\"https:\/\/onnetwork.agency\/wp-content\/uploads\/2026\/10\/php2shell-wordpress-zeichnung-transparent-1.png\" class=\"img-fluid hero-img\" alt=\"PHP2Shell: browser window with a crack in the PHP code, warning sign and open padlock\" srcset=\"https:\/\/onnetwork.agency\/wp-content\/uploads\/2026\/10\/php2shell-wordpress-zeichnung-transparent-1.png 1800w, https:\/\/onnetwork.agency\/wp-content\/uploads\/2026\/10\/php2shell-wordpress-zeichnung-transparent-1-300x200.png 300w, https:\/\/onnetwork.agency\/wp-content\/uploads\/2026\/10\/php2shell-wordpress-zeichnung-transparent-1-1024x683.png 1024w, https:\/\/onnetwork.agency\/wp-content\/uploads\/2026\/10\/php2shell-wordpress-zeichnung-transparent-1-768x512.png 768w, https:\/\/onnetwork.agency\/wp-content\/uploads\/2026\/10\/php2shell-wordpress-zeichnung-transparent-1-1536x1024.png 1536w\" sizes=\"auto, (max-width: 1800px) 100vw, 1800px\" \/>                    <\/figure>\n                            <\/div>\n\n        <\/div>\n    <\/div>\n<\/section>\n\n    <section id=\"authorpreview-section-block_d42511c498c3cd483cd92f96def126ff-1\" class=\"authorpreview-section alignfull layout-single-link\">\n        <div class=\"container\">\n                        <div class=\"ap-single\">\n                <div class=\"ap-single-avatar-col\">\n                    <a href=\"https:\/\/onnetwork.agency\/en\/author\/k-winter\/\"\n                        class=\"ap-single-avatar-link text-decoration-none text-reset\">\n                        <img alt='Kevin Winter' src='https:\/\/secure.gravatar.com\/avatar\/c3f3213307693b06c7b950b15084240549ac8d0f5a35214d1efecfa4630db959?s=87&#038;d=mm&#038;r=g' srcset='https:\/\/secure.gravatar.com\/avatar\/c3f3213307693b06c7b950b15084240549ac8d0f5a35214d1efecfa4630db959?s=174&#038;d=mm&#038;r=g 2x' class='avatar avatar-87 photo ap-single-avatar' height='87' width='87' \/>                        <div class=\"ap-single-head\">\n                            <h3 class=\"ap-single-name h5 mb-0\">Kevin Winter<\/h3>\n                                                            <p class=\"ap-single-rolle mb-0\">Managing Director<\/p>\n                                                    <\/div>\n                    <\/a>\n                <\/div>\n\n                <div class=\"ap-single-body\">\n                                            <p class=\"ap-single-bio mb-0\">Kevin Winter is Managing Director of on:NetworkAgency and helps businesses get found online. Writes about websites, SEO, visibility on Google and AI systems, and what actually works in practice. No agency fluff.  <\/p>\n                    \n                                            <a class=\"ap-single-link mt-3\" href=\"https:\/\/onnetwork.agency\/en\/author\/k-winter\/\">\n                            All 13 articles                            <span class=\"btn-arrow\">&rarr;<\/span>\n                        <\/a>\n                                    <\/div>\n            <\/div>\n        <\/div>\n    <\/section>\n    \n\n<section id=\"blogbeitrag-block_b8cfbca35e85403823239c3055eed9a1\" class=\"blogbeitrag-section alignfull\">\n            <div class=\"container\">\n            <div class=\"row gx-xl-5\">\n                <aside class=\"col-12 col-xl-3 blogbeitrag-toc-col\">\n                    <nav class=\"blogbeitrag-toc\" aria-label=\"Table of contents\">\n                        <p class=\"blogbeitrag-toc-label\">Contents<\/p>\n                        <ol class=\"blogbeitrag-toc-nav\">\n                                                            <li>\n                                    <a class=\"blogbeitrag-toc-link active\"\n                                       href=\"#blogbeitrag-block_b8cfbca35e85403823239c3055eed9a1-1-introduction\" aria-current=\"true\">\n                                        1. Introduction                                    <\/a>\n                                <\/li>\n                                                            <li>\n                                    <a class=\"blogbeitrag-toc-link\"\n                                       href=\"#blogbeitrag-block_b8cfbca35e85403823239c3055eed9a1-2-what-is-php2shell\">\n                                        2. What is PHP2Shell?                                    <\/a>\n                                <\/li>\n                                                            <li>\n                                    <a class=\"blogbeitrag-toc-link\"\n                                       href=\"#blogbeitrag-block_b8cfbca35e85403823239c3055eed9a1-3-why-plugins-wont-help\">\n                                        3. Why plugins won&#039;t help                                    <\/a>\n                                <\/li>\n                                                            <li>\n                                    <a class=\"blogbeitrag-toc-link\"\n                                       href=\"#blogbeitrag-block_b8cfbca35e85403823239c3055eed9a1-4-timeline-from-leak-to-patch\">\n                                        4. Timeline: from leak to patch                                    <\/a>\n                                <\/li>\n                                                            <li>\n                                    <a class=\"blogbeitrag-toc-link\"\n                                       href=\"#blogbeitrag-block_b8cfbca35e85403823239c3055eed9a1-5-am-i-affected\">\n                                        5. Am I affected?                                    <\/a>\n                                <\/li>\n                                                            <li>\n                                    <a class=\"blogbeitrag-toc-link\"\n                                       href=\"#blogbeitrag-block_b8cfbca35e85403823239c3055eed9a1-6-if-your-host-hasnt-patched-yet\">\n                                        6. If your host hasn&#039;t patched yet                                    <\/a>\n                                <\/li>\n                                                            <li>\n                                    <a class=\"blogbeitrag-toc-link\"\n                                       href=\"#blogbeitrag-block_b8cfbca35e85403823239c3055eed9a1-7-what-we-did-for-our-customers\">\n                                        7. What we did for our customers                                    <\/a>\n                                <\/li>\n                                                            <li>\n                                    <a class=\"blogbeitrag-toc-link\"\n                                       href=\"#blogbeitrag-block_b8cfbca35e85403823239c3055eed9a1-8-conclusion\">\n                                        8. Conclusion                                    <\/a>\n                                <\/li>\n                                                    <\/ol>\n                    <\/nav>\n                <\/aside>\n                <div class=\"col-12 col-xl-9 blogbeitrag-chapters\">\n                                            <article id=\"blogbeitrag-block_b8cfbca35e85403823239c3055eed9a1-1-introduction\" class=\"blogbeitrag-chapter\">\n                            <div class=\"row gx-xl-4\">\n                                <div class=\"col-12 col-xl-8 blogbeitrag-chapter-text\">\n                                    <p>On October 21, 2026, the PHP project closed two critical security vulnerabilities. Their name: PHP2Shell. Attackers can use them to inject malicious code onto a web server without needing to log in.<\/p>\n<p>Every website running on PHP is affected, whether it&#8217;s WordPress, a shop system, or a custom development. This hits practically all WordPress sites, because WordPress runs on PHP. Only a PHP update on the server can protect you. A WordPress update or a security plugin won&#8217;t help here.<\/p>\n<p><strong>The key facts at a glance<\/strong><\/p>\n<ul>\n<li>Every PHP version from 5.4 (released in 2012) onwards is affected, even with default settings.<\/li>\n<li>The vulnerability is in PHP itself. WordPress, themes, and plugins are not the cause. <\/li>\n<li>The PHP project classifies both vulnerabilities as critical: 9.2 out of 10 points.<\/li>\n<li>The update must be installed by whoever operates the server. For managed or shared hosting, that&#8217;s your provider; for your own server, it&#8217;s you. <\/li>\n<li>Initial attack attempts were already seen before the patch was released.<\/li>\n<\/ul>\n                                <\/div>\n                                                                    <div class=\"col-12 col-xl-4 d-xl-block d-none\">\n                                        <blockquote class=\"blogbeitrag-quote\">\n                                            <p>&bdquo;No WordPress update and no security plugin will help against PHP2Shell. Only a PHP update on the server can protect you.&ldquo;<\/p>\n                                        <\/blockquote>\n                                    <\/div>\n                                                            <\/div>\n                        <\/article>\n                                            <article id=\"blogbeitrag-block_b8cfbca35e85403823239c3055eed9a1-2-what-is-php2shell\" class=\"blogbeitrag-chapter\">\n                            <div class=\"row gx-xl-4\">\n                                <div class=\"col-12 col-xl-8 blogbeitrag-chapter-text\">\n                                    <h2>What is PHP2Shell?<\/h2>\n<p>PHP2Shell is the collective name for two bugs in the PHP core, officially CVE-2026-109618 and CVE-2026-109619.<\/p>\n<p>In the first bug, PHP runs out of memory during a request. During the subsequent cleanup, PHP continues working with half-created data. In the second bug, data from a request remains in memory even though it should have been deleted long ago. If the next request hits the same PHP process, it accesses these remnants.<\/p>\n<p>For you, the result is what matters: with crafted requests, an attacker can execute code on your server. They don&#8217;t need a password. According to the PHP project, every installation that serves web pages is affected, whether PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, or LiteSpeed. The risk is highest with mod_php.<\/p>\n<p>The discoverers at Calif demonstrated the attack on popular PHP applications, including WordPress 7.1.2, Drupal, Joomla, Magento, and Nextcloud, according to Sansec.<\/p>\n                                <\/div>\n                                                            <\/div>\n                        <\/article>\n                                            <article id=\"blogbeitrag-block_b8cfbca35e85403823239c3055eed9a1-3-why-plugins-wont-help\" class=\"blogbeitrag-chapter\">\n                            <div class=\"row gx-xl-4\">\n                                <div class=\"col-12 col-xl-8 blogbeitrag-chapter-text\">\n                                    <h2>Why WordPress updates and security plugins won&#8217;t help here<\/h2>\n<p>The attack happens in PHP before WordPress even starts. Therefore, a security plugin, a plugin-level firewall, or a maintenance mode never even gets a chance to act. There is also no update button for this problem in the WordPress backend.<\/p>\n<p>Only a new PHP version on the server can help. And that is in the hands of whoever operates the server.<\/p>\n                                <\/div>\n                                                            <\/div>\n                        <\/article>\n                                            <article id=\"blogbeitrag-block_b8cfbca35e85403823239c3055eed9a1-4-timeline-from-leak-to-patch\" class=\"blogbeitrag-chapter\">\n                            <div class=\"row gx-xl-4\">\n                                <div class=\"col-12 col-xl-8 blogbeitrag-chapter-text\">\n                                    <h2>Timeline: from leak to patch<\/h2>\n<p>All times in Central European Summer Time (CEST).<\/p>\n<ul>\n<li><strong>August 1, 2026:<\/strong> The security firm Calif finds the vulnerabilities and reports them confidentially to the PHP team. Shortly after, Wiz Research also reports the bugs. <\/li>\n<li><strong>October 20, 2026:<\/strong> Details leak onto the web prematurely. The PHP project moves the updates forward by one day; they were originally planned for October 22. <\/li>\n<li><strong>October 21, 5:02 AM:<\/strong> Cloudflare enables protection rules, including on the free plan.<\/li>\n<li><strong>October 21, 9:43 AM:<\/strong> Cloudflare reports the first attack attempts. No patch exists at this point. <\/li>\n<li><strong>October 21, 4:00 PM:<\/strong> The PHP project releases the secured versions.<\/li>\n<li><strong>October 21, 4:10 PM:<\/strong> All PHP versions on our hosting server are updated.<\/li>\n<li><strong>October 21, 5:15 PM:<\/strong> Our customers receive an email with the status. They have nothing to do. <\/li>\n<li><strong>October 21, afternoon onwards:<\/strong> Linux distributions follow suit. AlmaLinux and Ubuntu report &#8220;patches in progress&#8221; on October 21; the popular Remi repository has no updates on this day according to the PHP project. <\/li>\n<\/ul>\n<p>Why speed matters: The patch makes the changes public. This allows attacks to be developed, and a ready-made tool is already circulating. Experts expect automated mass attacks. Every hour without an update is an hour your site remains vulnerable.<\/p>\n                                <\/div>\n                                                            <\/div>\n                        <\/article>\n                                            <article id=\"blogbeitrag-block_b8cfbca35e85403823239c3055eed9a1-5-am-i-affected\" class=\"blogbeitrag-chapter\">\n                            <div class=\"row gx-xl-4\">\n                                <div class=\"col-12 col-xl-8 blogbeitrag-chapter-text\">\n                                    <h2>Am I affected? How to check your WordPress site&#8217;s PHP version <\/h2>\n<ol>\n<li><strong>Check the PHP version:<\/strong> In the WordPress backend under <em>Tools \u2192 Site Health \u2192 Info \u2192 Server<\/em>, you can see which PHP version your site is running.<\/li>\n<li><strong>Compare with the secure versions:<\/strong> PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, as well as all newer versions, are secured. But be careful: some Linux distributions apply the fix without changing the version number. So a lower number doesn&#8217;t automatically mean your site is open. When in doubt, ask. <\/li>\n<li><strong>PHP 8.1 or older?<\/strong> The PHP project no longer provides ready-made updates for these. Ask your provider if they have backported the fix, and plan the move to at least PHP 8.3. <\/li>\n<li><strong>Ask your host:<\/strong> A short email is enough: &#8220;Has the PHP update against PHP2Shell (CVE-2026-109618 and CVE-2026-109619) been applied to my website, and was PHP restarted afterward?&#8221; Pay attention to the answer. &#8220;We&#8217;ve enabled a firewall rule&#8221; is good, but it doesn&#8217;t mean &#8220;PHP has been updated.&#8221;<\/li>\n<li><strong>Look for signs of compromise:<\/strong> A backdoor installed before the update remains even after it. Check for unknown admin accounts or plugins, whether there are PHP files in the <code>wp-content\/uploads<\/code> folder, if Google Search Console reports security issues, and if a Google search for <code>site:ihredomain.de<\/code> shows foreign pages. <\/li>\n<\/ol>\n                                <\/div>\n                                                            <\/div>\n                        <\/article>\n                                            <article id=\"blogbeitrag-block_b8cfbca35e85403823239c3055eed9a1-6-if-your-host-hasnt-patched-yet\" class=\"blogbeitrag-chapter\">\n                            <div class=\"row gx-xl-4\">\n                                <div class=\"col-12 col-xl-8 blogbeitrag-chapter-text\">\n                                    <h2>What to do if your host hasn&#8217;t closed the vulnerability yet?<\/h2>\n<p>If you run the server yourself (VPS, cloud server, Docker), install the updated packages for your distribution and then restart PHP-FPM or Apache. The old code continues to run until the restart. For Docker, downloading the new image isn&#8217;t enough: the containers must be recreated.<\/p>\n<p>Until the update is available, there are workarounds. Cloudflare&#8217;s protection rules apply even on the free plan. The PHP project also lists settings that make individual attack vectors more difficult, such as <code>session.upload_progress.enabled=0<\/code> and smaller upload limits. However, the PHP team itself says this doesn&#8217;t make an installation secure. These measures only bridge the time until the update.<\/p>\n<p>And if your host can&#8217;t give a clear status when asked? Then follow up or get support.<\/p>\n                                <\/div>\n                                                            <\/div>\n                        <\/article>\n                                            <article id=\"blogbeitrag-block_b8cfbca35e85403823239c3055eed9a1-7-what-we-did-for-our-customers\" class=\"blogbeitrag-chapter\">\n                            <div class=\"row gx-xl-4\">\n                                <div class=\"col-12 col-xl-8 blogbeitrag-chapter-text\">\n                                    <h2>What we did for our customers<\/h2>\n<p>The PHP update was performed on our end on October 21 at 4:10 PM, ten minutes after release. Since then, all PHP versions on our hosting server have been secured.<\/p>\n<p>The websites were briefly reloaded during the process. None went down. By 5:15 PM, all customers had an email with the status update in their inbox. They didn&#8217;t have to do a thing.<\/p>\n<p>To learn why this happens so quickly with a Managed Service, read our guide <a href=\"https:\/\/onnetwork.agency\/en\/managed-wordpress-hosting\/\">Managed WordPress Hosting<\/a>.<\/p>\n                                <\/div>\n                                                            <\/div>\n                        <\/article>\n                                            <article id=\"blogbeitrag-block_b8cfbca35e85403823239c3055eed9a1-8-conclusion\" class=\"blogbeitrag-chapter\">\n                            <div class=\"row gx-xl-4\">\n                                <div class=\"col-12 col-xl-8 blogbeitrag-chapter-text\">\n                                    <h2>Conclusion<\/h2>\n<p>Experts consider PHP2Shell to be one of the most serious PHP vulnerabilities in years. It works without a login and affects almost every PHP installation. For you as a WordPress operator, the situation is still manageable. <strong>If your server is running a secured PHP version and you find no signs of compromise, you are on the safe side.<\/strong><\/p>\n<p>Not sure? Then ask your host today. Or let us take a quick look: The hosting check is free, and you&#8217;ll know today where your site stands.<\/p>\n                                <\/div>\n                                                            <\/div>\n                        <\/article>\n                                    <\/div>\n            <\/div>\n        <\/div>\n    <\/section>\n\n\n<section id=\"leadmagnet-gate-block_5aaa3f3e0b0a1f65ae17a08d2b295c21\" class=\"leadmagnet-gate alignfull\">\n\n    <div class=\"container\">\n        <div class=\"row align-items-center gx-lg-5\">\n\n                            <div class=\"col-12 col-lg-5 leadmagnet-gate__media\"><figure class=\"lm-aeo\" role=\"img\" aria-label=\"Illustration zum Thema \u201eWordPress Emergency Plan for Security Vulnerabilities\u201c\"><div class=\"lm-aeo__stage\"><?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<svg viewBox=\"-30 -60 970 660\" width=\"970\" height=\"660\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\"><circle cx=\"120\" cy=\"90\" r=\"150\" fill=\"#CDD5F1\"\/><circle cx=\"830\" cy=\"90\" r=\"110\" fill=\"#CDD5F1\"\/><path d=\"M380 170 C418 190, 455 196, 490 196 L490 290 C490 350, 448 394, 380 420 C312 394, 270 350, 270 290 L270 196 C305 196, 342 190, 380 170 Z\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><path d=\"M380 192 C411 208, 441 213, 468 214 L468 290 C468 338, 434 374, 380 396 C326 374, 292 338, 292 290 L292 214 C319 213, 349 208, 380 192 Z\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><path data-aeo=\"draw\" d=\"M336 298 L368.0 330.0 L428.0 262.0\" fill=\"none\" stroke=\"#EE6352\" stroke-width=\"14\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><circle cx=\"620\" cy=\"330\" r=\"78\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"14\"\/><path data-aeo=\"sweep\" d=\"M620 252 A78 78 0 1 1 552.4500185048138 291.0\" fill=\"none\" stroke=\"#EE6352\" stroke-width=\"14\" stroke-linecap=\"round\"\/><line x1=\"620.0\" y1=\"238.0\" x2=\"620.0\" y2=\"230.0\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><line x1=\"666.0\" y1=\"250.32566285183165\" x2=\"670.0\" y2=\"243.39745962155615\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><line x1=\"699.6743371481683\" y1=\"284.0\" x2=\"706.6025403784439\" y2=\"280.0\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><line x1=\"712.0\" y1=\"330.0\" x2=\"720.0\" y2=\"330.0\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><line x1=\"699.6743371481683\" y1=\"376.0\" x2=\"706.6025403784439\" y2=\"380.0\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><line x1=\"666.0\" y1=\"409.6743371481683\" x2=\"670.0\" y2=\"416.60254037844385\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><line x1=\"620.0\" y1=\"422.0\" x2=\"620.0\" y2=\"430.0\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><line x1=\"574.0\" y1=\"409.6743371481684\" x2=\"570.0\" y2=\"416.6025403784439\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><line x1=\"540.3256628518317\" y1=\"376.0\" x2=\"533.3974596215561\" y2=\"380.0\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><line x1=\"528.0\" y1=\"330.0\" x2=\"520.0\" y2=\"330.0\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><line x1=\"540.3256628518317\" y1=\"284.0\" x2=\"533.3974596215561\" y2=\"280.0\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><line x1=\"574.0\" y1=\"250.32566285183168\" x2=\"570.0\" y2=\"243.39745962155615\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><line x1=\"620\" y1=\"228\" x2=\"620\" y2=\"218\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><rect x=\"606\" y=\"204\" width=\"28\" height=\"14\" rx=\"6\" fill=\"#EE6352\" stroke=\"#F2EFE8\" stroke-width=\"2.4\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><text data-aeo=\"count\" data-to=\"60\" x=\"620\" y=\"342\" font-family=\"Manrope, sans-serif\" font-weight=\"800\" font-size=\"34\" fill=\"#F2EFE8\" text-anchor=\"middle\">60<\/text><rect x=\"164\" y=\"300\" width=\"80\" height=\"28\" rx=\"6\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><circle cx=\"180\" cy=\"314\" r=\"4.00\" fill=\"#EE6352\" stroke=\"#F2EFE8\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><line x1=\"196\" y1=\"314\" x2=\"230.0\" y2=\"314\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><rect x=\"164\" y=\"334\" width=\"80\" height=\"28\" rx=\"6\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><circle cx=\"180\" cy=\"348\" r=\"4.00\" fill=\"#EE6352\" stroke=\"#F2EFE8\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><line x1=\"196\" y1=\"348\" x2=\"230.0\" y2=\"348\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><rect x=\"164\" y=\"368\" width=\"80\" height=\"28\" rx=\"6\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><circle cx=\"180\" cy=\"382\" r=\"4.00\" fill=\"#EE6352\" stroke=\"#F2EFE8\" stroke-width=\"1.5\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><line x1=\"196\" y1=\"382\" x2=\"230.0\" y2=\"382\" fill=\"none\" stroke=\"#F2EFE8\" stroke-width=\"2\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/><path data-aeo=\"twinkle\" d=\"M516 155.0 C518.34 165.66, 518.34 165.66, 529.0 168 C518.34 170.34, 518.34 170.34, 516 181.0 C513.66 170.34, 513.66 170.34, 503.0 168 C513.66 165.66, 513.66 165.66, 516 155.0 Z\" fill=\"#EE6352\" stroke=\"#F2EFE8\" stroke-width=\"1.6\" stroke-linejoin=\"round\"\/><path data-aeo=\"twinkle\" d=\"M244 226.0 C245.8 234.2, 245.8 234.2, 254.0 236 C245.8 237.8, 245.8 237.8, 244 246.0 C242.2 237.8, 242.2 237.8, 234.0 236 C242.2 234.2, 242.2 234.2, 244 226.0 Z\" fill=\"#EE6352\" stroke=\"#F2EFE8\" stroke-width=\"1.6\" stroke-linejoin=\"round\"\/><path data-aeo=\"twinkle\" d=\"M734 443.0 C735.62 450.38, 735.62 450.38, 743.0 452 C735.62 453.62, 735.62 453.62, 734 461.0 C732.38 453.62, 732.38 453.62, 725.0 452 C732.38 450.38, 732.38 450.38, 734 443.0 Z\" fill=\"#EE6352\" stroke=\"#F2EFE8\" stroke-width=\"1.6\" stroke-linejoin=\"round\"\/><\/svg><\/div><\/figure><\/div>\n            \n            <div class=\"col-12 col-lg-7 leadmagnet-gate__body\">\n                <h2 class=\"leadmagnet-gate__headline\">WordPress Emergency Plan for Security Vulnerabilities<\/h2>\n\n                                    <p class=\"leadmagnet-gate__text\">When the next vulnerability like PHP2Shell hits, every hour counts. Secure the emergency plan with immediate steps, an intrusion check, and the hosting traffic light. <\/p>\n                \n                <div class=\"leadmagnet-gate__form\">\n                    <div class='fluentform ff-default fluentform_wrapper_6 ffs_default_wrap'><form data-form_id=\"6\" id=\"fluentform_6\" class=\"frm-fluent-form fluent_form_6 ff-el-form-top ff_form_instance_6_1 ff-form-loading ffs_default\" data-form_instance=\"ff_form_instance_6_1\" method=\"POST\" ><fieldset  style=\"border: none!important;margin: 0!important;padding: 0!important;background-color: transparent!important;box-shadow: none!important;outline: none!important; min-inline-size: 100%;\">\n                    <legend class=\"ff_screen_reader_title\" style=\"display: block; margin: 0!important;padding: 0!important;height: 0!important;text-indent: -999999px;width: 0!important;overflow:hidden;\">lead-magnet-gate-plus<\/legend>        <div\n                style=\"display: none!important; position: absolute!important; transform: translateX(1000%)!important;\"\n                class=\"ff-el-group ff-hpsf-container\"\n        >\n            <div class=\"ff-el-input--label asterisk-right\">\n                <label for=\"ff_6_item_sf\" aria-label=\"Newsletter\">\n                    Newsletter                <\/label>\n            <\/div>\n            <div class=\"ff-el-input--content\">\n                <input type=\"text\"\n                       name=\"item_6__fluent_sf\"\n                       class=\"ff-el-form-control\"\n                       id=\"ff_6_item_sf\"\n                \/>\n            <\/div>\n        <\/div>\n                <input type=\"hidden\" id=\"__fluent_protection_token_6\" class=\"fluent-form-token-field\" name=\"__fluent_protection_token_6\">\n        <input type='hidden' name='__fluent_form_embded_post_id' value='1800' \/><input type=\"hidden\" id=\"_fluentform_6_fluentformnonce\" name=\"_fluentform_6_fluentformnonce\" value=\"bccbdaa2ce\" \/><input type=\"hidden\" name=\"_wp_http_referer\" value=\"\/en\/wp-json\/wp\/v2\/posts\/1800\" \/><div class='ff-el-group ff-el-form-hide_label'><div class=\"ff-el-input--label ff-el-is-required asterisk-right\"><label for='ff_6_email' id='label_ff_6_email'>Email address<\/label><\/div><div class='ff-el-input--content'><input type=\"email\" name=\"email\" id=\"ff_6_email\" class=\"ff-el-form-control\" placeholder=\"Email address *\" data-name=\"email\"  aria-invalid=\"false\" aria-required=true><\/div><\/div><div class='ff-el-group ff-el-form-hide_label has-conditions'><div class=\"ff-el-input--label ff-el-is-required asterisk-right\"><label for='ff_6_names' id='label_ff_6_names'>First name<\/label><\/div><div class='ff-el-input--content'><input type=\"text\" name=\"names\" id=\"ff_6_names\" class=\"ff-el-form-control\" placeholder=\"First name *\" data-name=\"names\"  aria-invalid=\"false\" aria-required=true><\/div><\/div><div class='ff-el-group ff-el-form-hide_label has-conditions'><div class=\"ff-el-input--label asterisk-right\"><label for='ff_6_phone' id='label_ff_6_phone'>Phone<\/label><\/div><div class='ff-el-input--content'><input type=\"tel\" name=\"phone\" id=\"ff_6_phone\" class=\"ff-el-form-control ff-el-phone\" placeholder=\"Phone (optional, for a quick call)\" data-name=\"phone\" inputmode=\"tel\"  aria-invalid='false' aria-required=false><\/div><\/div><div class='ff-el-group   has-conditions  ff-el-input--content'><div class='ff-el-form-check ff-el-tc'><label aria-label='Terms and Conditions: I agree that on:NetworkAgency may store my information and contact me by email or phone to send me the download and inform me about similar content. I can revoke this consent at any time. \u2192 Privacy   Contains 1 link. Use tab navigation to review.' class='ff-el-form-check-label ff_tc_label' for='terms_98556f220865749b69fdbce398e1da8a'><span class='ff_tc_checkbox'><input type=\"checkbox\" name=\"terms\" id=\"terms_98556f220865749b69fdbce398e1da8a\" class=\"ff-el-form-check-input\" data-name=\"terms\"  value='on' aria-invalid='false' aria-required=true><\/span> <div class='ff_t_c'>I agree that on:NetworkAgency may store my information and contact me by email or phone to send me the download and inform me about similar content. I can revoke this consent at any time. \u2192 <a href=\"https:\/\/onnetwork.agency\/en\/privacy-policy\/\" target=\"_blank\" rel=\"noopener\">Privacy<\/a>  <\/div><\/label><\/div><\/div><input type=\"hidden\" name=\"lm_id\" value=\"1795\" data-name=\"lm_id\" ><div class='ff-form-inline-style' hidden><style>form.fluent_form_6 .ff-btn-submit:not(.ff_btn_no_style) { background-color: ; color: ; }<\/style><\/div><div class='ff-el-group ff-text-left ff_submit_btn_wrapper'><button type=\"submit\" class=\"ff-btn ff-btn-submit ff-btn-md ff_btn_style\"  aria-label=\"Download \u2192\">Download \u2192<\/button><\/div><\/fieldset><\/form><div id='fluentform_6_errors' class='ff-errors-in-stack ff_form_instance_6_1 ff-form-loading_errors ff_form_instance_6_1_errors'><\/div><\/div>            <script type=\"text\/javascript\">\n                window.fluent_form_ff_form_instance_6_1 = {\"id\":\"6\",\"ajaxUrl\":\"https:\\\/\\\/onnetwork.agency\\\/wp-admin\\\/admin-ajax.php\",\"settings\":{\"layout\":{\"labelPlacement\":\"top\",\"helpMessagePlacement\":\"with_label\",\"errorMessagePlacement\":\"inline\",\"cssClassName\":\"\"},\"restrictions\":{\"denyEmptySubmission\":{\"enabled\":false}}},\"form_instance\":\"ff_form_instance_6_1\",\"form_id_selector\":\"fluentform_6\",\"rules\":{\"email\":{\"required\":{\"value\":true,\"message\":\"Please enter your email address.\"},\"email\":{\"value\":true,\"message\":\"Please enter a valid email address.\"}},\"names\":{\"required\":{\"value\":true,\"message\":\"Please enter your first name.\"}},\"phone\":{\"required\":{\"value\":false,\"message\":\"\"}},\"terms\":{\"required\":{\"value\":true,\"message\":\"Please agree to the privacy policy.\"}}},\"debounce_time\":300,\"conditionals\":{\"names\":{\"type\":\"any\",\"status\":true,\"conditions\":[{\"field\":\"email\",\"operator\":\"!=\",\"value\":\"\"}]},\"phone\":{\"type\":\"any\",\"status\":true,\"conditions\":[{\"field\":\"email\",\"operator\":\"!=\",\"value\":\"\"}]},\"terms\":{\"type\":\"any\",\"status\":true,\"conditions\":[{\"field\":\"email\",\"operator\":\"!=\",\"value\":\"\"}]}},\"file_upload_settings\":[]};\n                            <\/script>\n                            <\/div>\n\n                <p class=\"leadmagnet-gate__privacy\">No spam. Unsubscribe anytime.<\/p>\n            <\/div>\n\n        <\/div>\n    <\/div>\n\n<\/section>\n\n\n<section id=\"faq-section-block_2c56ecdc6bbd234fa66a514ee3920fda\" class=\"faq-section alignfull overflow-hidden\">\n    <div class=\"container pt-5 pb-5\">\n        <div class=\"row align-items-start\">\n\n            <div class=\"col-12 col-lg-6 col-md-4 mb-5 mb-lg-0 faq-header-col\">\n                                    <p class=\"thema thema-blue\">Frequently Asked Questions<\/p>\n                \n                                    <div class=\"faq-text-wysiwyg\">\n                        <h2>Frequently asked questions about PHP2Shell.<\/h2>\n                    <\/div>\n                            <\/div>\n\n            <div class=\"col-12 col-lg-5 col-md-8 offset-lg-1 faq-accordion-col\">\n                                    <div class=\"faq-accordion-wrap\">\n                        <div class=\"accordion\" id=\"accordion-block_2c56ecdc6bbd234fa66a514ee3920fda\">\n                                                            <div class=\"accordion-item\">\n                                    <h3 class=\"accordion-header\" id=\"heading-block_2c56ecdc6bbd234fa66a514ee3920fda-1\">\n                                        <button class=\"accordion-button collapsed\" type=\"button\" data-bs-toggle=\"collapse\"\n                                            data-bs-target=\"#collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-1\" aria-expanded=\"false\"\n                                            aria-controls=\"collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-1\">\n                                            Is my WordPress site affected by PHP2Shell?                                        <\/button>\n                                    <\/h3>\n                                    <div id=\"collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-1\" class=\"accordion-collapse collapse\"\n                                        aria-labelledby=\"heading-block_2c56ecdc6bbd234fa66a514ee3920fda-1\"\n                                        data-bs-parent=\"#accordion-block_2c56ecdc6bbd234fa66a514ee3920fda\">\n                                        <div class=\"accordion-body\">\n                                            <div class=\"faq-antwort-wysiwyg\">\n                                                <p>Probably yes, as long as your server isn&#8217;t running a secured PHP version (8.2.35, 8.3.36, 8.4.27, 8.5.12, or newer). Every PHP version from 5.4 onwards is affected with default settings. You can find your PHP version under Tools \u2192 Site Health \u2192 Info \u2192 Server.<\/p>\n                                            <\/div>\n                                        <\/div>\n                                    <\/div>\n                                <\/div>\n                                                                <div class=\"accordion-item\">\n                                    <h3 class=\"accordion-header\" id=\"heading-block_2c56ecdc6bbd234fa66a514ee3920fda-2\">\n                                        <button class=\"accordion-button collapsed\" type=\"button\" data-bs-toggle=\"collapse\"\n                                            data-bs-target=\"#collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-2\" aria-expanded=\"false\"\n                                            aria-controls=\"collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-2\">\n                                            Is a WordPress or plugin update enough?                                        <\/button>\n                                    <\/h3>\n                                    <div id=\"collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-2\" class=\"accordion-collapse collapse\"\n                                        aria-labelledby=\"heading-block_2c56ecdc6bbd234fa66a514ee3920fda-2\"\n                                        data-bs-parent=\"#accordion-block_2c56ecdc6bbd234fa66a514ee3920fda\">\n                                        <div class=\"accordion-body\">\n                                            <div class=\"faq-antwort-wysiwyg\">\n                                                <p>No. The vulnerability is in PHP, not in WordPress. The attack runs before WordPress and its plugins start. The only remedy is a PHP update on the server.<\/p>\n                                            <\/div>\n                                        <\/div>\n                                    <\/div>\n                                <\/div>\n                                                                <div class=\"accordion-item\">\n                                    <h3 class=\"accordion-header\" id=\"heading-block_2c56ecdc6bbd234fa66a514ee3920fda-3\">\n                                        <button class=\"accordion-button collapsed\" type=\"button\" data-bs-toggle=\"collapse\"\n                                            data-bs-target=\"#collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-3\" aria-expanded=\"false\"\n                                            aria-controls=\"collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-3\">\n                                            Which PHP versions are secure?                                        <\/button>\n                                    <\/h3>\n                                    <div id=\"collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-3\" class=\"accordion-collapse collapse\"\n                                        aria-labelledby=\"heading-block_2c56ecdc6bbd234fa66a514ee3920fda-3\"\n                                        data-bs-parent=\"#accordion-block_2c56ecdc6bbd234fa66a514ee3920fda\">\n                                        <div class=\"accordion-body\">\n                                            <div class=\"faq-antwort-wysiwyg\">\n                                                <p>PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, all released on October 21, 2026, as well as any newer versions. Some Linux distributions apply the fix without changing the version number. When in doubt, your host can confirm the status for you.<\/p>\n                                            <\/div>\n                                        <\/div>\n                                    <\/div>\n                                <\/div>\n                                                                <div class=\"accordion-item\">\n                                    <h3 class=\"accordion-header\" id=\"heading-block_2c56ecdc6bbd234fa66a514ee3920fda-4\">\n                                        <button class=\"accordion-button collapsed\" type=\"button\" data-bs-toggle=\"collapse\"\n                                            data-bs-target=\"#collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-4\" aria-expanded=\"false\"\n                                            aria-controls=\"collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-4\">\n                                            What about PHP 7.4, 8.0, and 8.1?                                        <\/button>\n                                    <\/h3>\n                                    <div id=\"collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-4\" class=\"accordion-collapse collapse\"\n                                        aria-labelledby=\"heading-block_2c56ecdc6bbd234fa66a514ee3920fda-4\"\n                                        data-bs-parent=\"#accordion-block_2c56ecdc6bbd234fa66a514ee3920fda\">\n                                        <div class=\"accordion-body\">\n                                            <div class=\"faq-antwort-wysiwyg\">\n                                                <p>The PHP project no longer provides ready-made updates for these versions, only source code fixes for those who build PHP themselves. Some providers backport the fix. It&#8217;s safer to switch to a supported version, ideally PHP 8.3 or newer. PHP 8.2 will only receive security updates until December 31, 2026.<\/p>\n                                            <\/div>\n                                        <\/div>\n                                    <\/div>\n                                <\/div>\n                                                                <div class=\"accordion-item\">\n                                    <h3 class=\"accordion-header\" id=\"heading-block_2c56ecdc6bbd234fa66a514ee3920fda-5\">\n                                        <button class=\"accordion-button collapsed\" type=\"button\" data-bs-toggle=\"collapse\"\n                                            data-bs-target=\"#collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-5\" aria-expanded=\"false\"\n                                            aria-controls=\"collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-5\">\n                                            Does Cloudflare protect me?                                        <\/button>\n                                    <\/h3>\n                                    <div id=\"collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-5\" class=\"accordion-collapse collapse\"\n                                        aria-labelledby=\"heading-block_2c56ecdc6bbd234fa66a514ee3920fda-5\"\n                                        data-bs-parent=\"#accordion-block_2c56ecdc6bbd234fa66a514ee3920fda\">\n                                        <div class=\"accordion-body\">\n                                            <div class=\"faq-antwort-wysiwyg\">\n                                                <p>Partially. Cloudflare has introduced protection rules against known attack vectors, even on the free plan. This is a temporary solution, as a firewall rule can miss new variants of an attack. The PHP update remains necessary.<\/p>\n                                            <\/div>\n                                        <\/div>\n                                    <\/div>\n                                <\/div>\n                                                                <div class=\"accordion-item\">\n                                    <h3 class=\"accordion-header\" id=\"heading-block_2c56ecdc6bbd234fa66a514ee3920fda-6\">\n                                        <button class=\"accordion-button collapsed\" type=\"button\" data-bs-toggle=\"collapse\"\n                                            data-bs-target=\"#collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-6\" aria-expanded=\"false\"\n                                            aria-controls=\"collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-6\">\n                                            Do I need to do anything else after the update?                                        <\/button>\n                                    <\/h3>\n                                    <div id=\"collapse-block_2c56ecdc6bbd234fa66a514ee3920fda-6\" class=\"accordion-collapse collapse\"\n                                        aria-labelledby=\"heading-block_2c56ecdc6bbd234fa66a514ee3920fda-6\"\n                                        data-bs-parent=\"#accordion-block_2c56ecdc6bbd234fa66a514ee3920fda\">\n                                        <div class=\"accordion-body\">\n                                            <div class=\"faq-antwort-wysiwyg\">\n                                                <p>Yes, take a moment to check whether anyone breached your site before the update. Unknown admin accounts, unfamiliar plugins, PHP files in the upload folder, or warnings in Google Search Console are red flags. A backdoor remains in place even after the patch.<\/p>\n                                            <\/div>\n                                        <\/div>\n                                    <\/div>\n                                <\/div>\n                                                        <\/div>\n                    <\/div>\n                            <\/div>\n\n        <\/div>\n    <\/div>\n<\/section>\n\n\n\n<section id=\"text-section-block_f8de7c97c19933499c55349370cf4909\" class=\"text-section alignfull layout-tb \">\n\n            <!-- Layout: Bild, Text \/ Text, Bild (Half bleed) -->\n        <div class=\"tb-image-half\">\n                            <img loading=\"lazy\" decoding=\"async\" width=\"972\" height=\"451\" src=\"https:\/\/onnetwork.agency\/wp-content\/uploads\/2026\/04\/text-3.png\" class=\"tb-image\" alt=\"\" srcset=\"https:\/\/onnetwork.agency\/wp-content\/uploads\/2026\/04\/text-3.png 972w, https:\/\/onnetwork.agency\/wp-content\/uploads\/2026\/04\/text-3-300x139.png 300w, https:\/\/onnetwork.agency\/wp-content\/uploads\/2026\/04\/text-3-768x356.png 768w\" sizes=\"auto, (max-width: 972px) 100vw, 972px\" \/>                    <\/div>\n\n        <div class=\"container position-relative z-1\">\n            <div class=\"row\">\n\n                <div class=\"col-12 col-lg-6 tb-content \">\n\n                                            <p class=\"thema thema-blue\">Hosting check<\/p>\n                    \n                                            <div class=\"tb-text-wysiwyg\">\n                            <h2>Is your website hosted with another provider?<\/h2>\n<p>We will check for free if your WordPress site is secured against PHP2Shell: PHP version, update status, and visible signs of compromise. You will get clear feedback on what needs to be done. If you wish, we can handle the rest.<\/p>\n                        <\/div>\n                    \n                        <div class=\"tb-button-group d-flex flex-wrap gap-3 mt-4\">\n                        <a class=\"btn btn-primary\" href=\"https:\/\/onnetwork.agency\/en\/contact\/\"\n                    target=\"_self\">\n                    Request a free hosting check                                            <span class=\"btn-arrow\">&rarr;<\/span>\n                                    <\/a>\n                <\/div>\n                    <\/div>\n            <\/div>\n        <\/div>\n\n    \n<\/section>\n\n    <section id=\"authorpreview-section-block_d42511c498c3cd483cd92f96def126ff-2\" class=\"authorpreview-section alignfull layout-single-link\">\n        <div class=\"container\">\n                        <div class=\"ap-single\">\n                <div class=\"ap-single-avatar-col\">\n                    <a href=\"https:\/\/onnetwork.agency\/en\/author\/k-winter\/\"\n                        class=\"ap-single-avatar-link text-decoration-none text-reset\">\n                        <img alt='Kevin Winter' src='https:\/\/secure.gravatar.com\/avatar\/c3f3213307693b06c7b950b15084240549ac8d0f5a35214d1efecfa4630db959?s=87&#038;d=mm&#038;r=g' srcset='https:\/\/secure.gravatar.com\/avatar\/c3f3213307693b06c7b950b15084240549ac8d0f5a35214d1efecfa4630db959?s=174&#038;d=mm&#038;r=g 2x' class='avatar avatar-87 photo ap-single-avatar' height='87' width='87' \/>                        <div class=\"ap-single-head\">\n                            <h3 class=\"ap-single-name h5 mb-0\">Kevin Winter<\/h3>\n                                                            <p class=\"ap-single-rolle mb-0\">Managing Director<\/p>\n                                                    <\/div>\n                    <\/a>\n                <\/div>\n\n                <div class=\"ap-single-body\">\n                                            <p class=\"ap-single-bio mb-0\">Kevin Winter is Managing Director of on:NetworkAgency and helps businesses get found online. Writes about websites, SEO, visibility on Google and AI systems, and what actually works in practice. No agency fluff.  <\/p>\n                    \n                                            <a class=\"ap-single-link mt-3\" href=\"https:\/\/onnetwork.agency\/en\/author\/k-winter\/\">\n                            All 13 articles                            <span class=\"btn-arrow\">&rarr;<\/span>\n                        <\/a>\n                                    <\/div>\n            <\/div>\n        <\/div>\n    <\/section>\n    \n\n    <section id=\"blogpreview-section-block_5fa7e130ee08c2cd2a79324660383f51\"\n        class=\"blogpreview-section alignfull layout-related mt-0\">\n        <div class=\"container\">\n\n            <p class=\"thema thema-blue mb-4\">Related articles<\/p>\n\n            <div class=\"row g-4 bp-related-row\">\n                                    <div class=\"col-12 col-md-4\">\n                        <a class=\"bp-related-card h-100\" href=\"https:\/\/onnetwork.agency\/en\/managed-wordpress-hosting\/\">\n                                                            <p class=\"thema thema-simple thema-blue mb-2\">\n                                    Guide                                <\/p>\n                                                        <h3 class=\"bp-related-title h5 mb-0 pb-3\">\n                                Managed WordPress hosting: What a managed service delivers in a worst-case scenario                            <\/h3>\n                        <\/a>\n                    <\/div>\n                                    <div class=\"col-12 col-md-4\">\n                        <a class=\"bp-related-card h-100\" href=\"https:\/\/onnetwork.agency\/en\/ai-literacy-obligation-what-your-team-needs-to-know-now\/\">\n                                                            <p class=\"thema thema-simple thema-blue mb-2\">\n                                    Guide                                <\/p>\n                                                        <h3 class=\"bp-related-title h5 mb-0 pb-3\">\n                                AI Literacy Obligation: What your team needs to know now                            <\/h3>\n                        <\/a>\n                    <\/div>\n                                    <div class=\"col-12 col-md-4\">\n                        <a class=\"bp-related-card h-100\" href=\"https:\/\/onnetwork.agency\/en\/geo-how-ai-systems-evaluate-your-website\/\">\n                                                            <p class=\"thema thema-simple thema-blue mb-2\">\n                                    Growth                                <\/p>\n                                                        <h3 class=\"bp-related-title h5 mb-0 pb-3\">\n                                GEO: How to Make Sure AI Doesn&#8217;t Overlook Your Website                            <\/h3>\n                        <\/a>\n                    <\/div>\n                            <\/div>\n\n        <\/div>\n    <\/section>\n    \n\n\n\n<section id=\"text-section-block_389db7c163709b1adc7906db8003e8cf\" class=\"text-section alignfull layout-tb \">\n\n            <!-- Layout: Bild, Text \/ Text, Bild (Half bleed) -->\n        <div class=\"tb-image-half\">\n                            <img loading=\"lazy\" decoding=\"async\" width=\"972\" height=\"625\" src=\"https:\/\/onnetwork.agency\/wp-content\/uploads\/2026\/04\/text-2-e1780398494731.png\" class=\"tb-image\" alt=\"\" srcset=\"https:\/\/onnetwork.agency\/wp-content\/uploads\/2026\/04\/text-2-e1780398494731.png 972w, https:\/\/onnetwork.agency\/wp-content\/uploads\/2026\/04\/text-2-e1780398494731-300x193.png 300w, https:\/\/onnetwork.agency\/wp-content\/uploads\/2026\/04\/text-2-e1780398494731-768x494.png 768w\" sizes=\"auto, (max-width: 972px) 100vw, 972px\" \/>                    <\/div>\n\n        <div class=\"container position-relative z-1\">\n            <div class=\"row\">\n\n                <div class=\"col-12 col-lg-6 tb-content \">\n\n                    \n                                            <div class=\"tb-text-wysiwyg\">\n                            <h3><span style=\"color: #6978b5;\">About this article<\/span><\/h3>\n<p>This article is part of our guide series on technology and security. Last updated: October 21, 2026. We&#8217;ll update it as soon as new information becomes available.<\/p>\n<p><strong>Sources<\/strong><\/p>\n<ul>\n<li>PHP project: <a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" rel=\"noopener nofollow\">Security advisory: Critical remote code execution vulnerabilities, update now<\/a> (10\/21\/2026)<\/li>\n<li>heise online: <a href=\"https:\/\/www.heise.de\/news\/php2shell-Kritische-Sicherheitsluecken-erlauben-Codeeinschleusung-in-PHP-11492938.html\" target=\"_blank\" rel=\"noopener nofollow\">php2shell: Critical security vulnerabilities allow code injection in PHP<\/a><\/li>\n<li>Sansec: <a href=\"https:\/\/sansec.io\/research\/php2shell\" target=\"_blank\" rel=\"noopener nofollow\">PHP2Shell: Critical PHP RCE<\/a><\/li>\n<li>Meow Apps: <a href=\"https:\/\/meowapps.com\/php2shell-wordpress\/\" target=\"_blank\" rel=\"noopener nofollow\">PHP2Shell and WordPress<\/a><\/li>\n<\/ul>\n                        <\/div>\n                    \n                                    <\/div>\n            <\/div>\n        <\/div>\n\n    \n<\/section>","protected":false},"excerpt":{"rendered":"","protected":false},"author":3,"featured_media":1883,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[122,126],"tags":[],"class_list":["post-1800","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guide-en","category-technology-en"],"acf":[],"_links":{"self":[{"href":"https:\/\/onnetwork.agency\/en\/wp-json\/wp\/v2\/posts\/1800","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/onnetwork.agency\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/onnetwork.agency\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/onnetwork.agency\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/onnetwork.agency\/en\/wp-json\/wp\/v2\/comments?post=1800"}],"version-history":[{"count":18,"href":"https:\/\/onnetwork.agency\/en\/wp-json\/wp\/v2\/posts\/1800\/revisions"}],"predecessor-version":[{"id":1904,"href":"https:\/\/onnetwork.agency\/en\/wp-json\/wp\/v2\/posts\/1800\/revisions\/1904"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/onnetwork.agency\/en\/wp-json\/wp\/v2\/media\/1883"}],"wp:attachment":[{"href":"https:\/\/onnetwork.agency\/en\/wp-json\/wp\/v2\/media?parent=1800"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/onnetwork.agency\/en\/wp-json\/wp\/v2\/categories?post=1800"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/onnetwork.agency\/en\/wp-json\/wp\/v2\/tags?post=1800"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}