Your Pressable Sites Are Already Protected From the Recent Critical PHP Security Update

The PHP project recently released a critical security update for two vulnerabilities in PHP, nicknamed “PHP2Shell.” If you host with Pressable, you’re covered.

Your sites are already protected against the recently disclosed PHP security issues.

Automattic worked closely with the PHP Security team to ensure that all sites hosted on our platform were protected as soon as possible. That covers every site on Pressable and every PHP version we offer, including Production, Staging, and Sandbox sites.

There’s nothing you need to do. Really. You don’t need to update PHP or change any settings, and your sites are protected whatever PHP version number shows in MyPressable or in WordPress Site Health.

What happened

PHP is the programming language WordPress runs on. These two flaws are in PHP itself, so a site on a vulnerable version can be affected even when WordPress and its plugins are fully up to date. An attacker doesn’t need to log in to use them, and a successful attack could let them run their own code on the server.

Not hosting with Pressable?

If you manage your own PHP, here’s what to do, as noted in Automattic’s announcement.

Update PHP. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. This is a runtime fix, so updating WordPress, your theme, or your plugins will not protect you on its own. If your host manages PHP for you, ask them to confirm they have applied the update.

If you are on PHP 8.1 or older, plan to move now. The PHP project no longer ships fixes for those versions. Some Linux distributions and long-term support vendors backport security fixes, so check with yours, but the durable answer is a supported release. PHP 8.2 itself reaches end of life on December 31, 2026, so 8.3 or newer is the better target.

If you cannot patch today, reduce your exposure until you can:

• Put the site behind a web application firewall. Several providers, including Cloudflare, have shipped rules for these vulnerabilities.
• If your site does not accept file uploads, block multipart form submissions at the web server, and turn off PHP’s file_uploads and session.upload_progress.enabled settings.
• Watch your logs for unusual multipart requests followed by PHP memory-limit errors or bursts of HTTP 500 responses. Wiz Research lists these as signs of attempted exploitation.

These steps buy time. They are not a substitute for the update.

If you have questions about a specific site, our support team is happy to help. Reach us through MyPressable.

Suzanne Kolpakov

Suzanne leads Product Marketing at Pressable, where she focuses on translating complex hosting technology into clear, empowering solutions for creators and businesses. Driven by a passion for the WordPress community, she strives to show how the right platform can be a catalyst for growth and innovation. Suzanne believes that great marketing starts with authentic storytelling and making high-performance tech feel accessible to everyone. She lives in the Metro Atlanta area with her two children and two cats. When she’s not scaling the Pressable brand, you’ll find her navigating the local trails or enjoying the vibrant energy of the South.