TL;DR: As of October 28, 2026, Wordfence is not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
We continue to see PHP2Shell-related requests across the more than 5 million sites we protect. Those requests show ongoing scanning and exploitation attempts; they do not show whether an attempt succeeded. Our site-cleaning and incident response teams have not handled a WordPress compromise attributed to these vulnerabilities.
That does not make an unpatched server safe. The fix is still to update PHP on your server to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a vendor package confirmed
