A week ago I wrote here about PHP2Shell.

A week ago I wrote here about PHP2Shell. Small follow-up, because patched once doesn't mean done.

Wordify kept a live log the whole week, worth a scroll: https://wordify.com/blog/php-security-vulnerability-wordpress-october-2026/

Two things stuck with me.

Attack requests on the WordPress sites they host started at 08:44 UTC on 21 Oct. The fixed PHP releases came out at 13:45. Five hours. That's the patch window now.

And their sites on 7.4, 8.0 and 8.1 run on source patches the host applied itself, because PHP doesn't ship those versions anymore. Good for them. Your cheap hosting might not bother.

So check one more time: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If the panel still says 7.4, the CVE is not your biggest problem.