On October 21, 2026, two critical PHP vulnerabilities, collectively known as PHP2Shell, were publicly disclosed. These vulnerabilities could allow attackers to execute malicious code on affected servers without authentication. The PHP development team released emergency security updates the same day to address them.
If your WordPress site is hosted on Kinsta, it’s protected against PHP2Shell. Our engineering and security teams deployed the necessary PHP security updates across our hosting platform, including live and staging environments. We found no evidence of breaches related to these vulnerabilities.
Info
We officially marked the incident resolved on October 22, 2026, and customers don’t
