PHP2Shell is a pair of remote code execution flaws in the PHP interpreter, so on shared hosting a WordPress or Joomla update leaves you exactly as exposed as before. If attackers reached your server before your host patched, the passwords and keys that server could read are the loss that matters.
Attackers have achieved confirmed remote code execution through PHP2Shell, two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. PHP shipped fixes on October 21. The catch for PHP2Shell shared hosting customers: the bug sits beneath WordPress and Joomla, so only your host can install the fix.