Is The Wow Bot Affected by PHP2SHELL? An Urgent Answer for WordPress Sites

No. The Wow Bot isn't affected by PHP2SHELL. Our service runs on Node.js, not PHP, so our servers aren't exposed. The only PHP in The Wow Bot is the WordPress plugin, which runs on your own website hosting. Your hosting company or server administrator needs to update PHP on that server.

Security news lands with a jolt, especially for small teams. Here's what PHP2SHELL means for you, and who needs to act.

What PHP2SHELL Is

PHP2SHELL, made public on October 21, is a group of serious security flaws in PHP itself, the language that runs WordPress, Drupal, Joomla and most of the web. The researchers rate the worst of them 9.2 out of 10. They show that attackers may be able to run code on a server, or read its memory, without logging in.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and they affect PHP versions going back many years. The fixed releases are:

• PHP 8.2.35
• PHP 8.3.36
• PHP 8.4.27
• PHP 8.5.12

Fixes are only released for PHP 8.2 and newer, so sites on older versions, like 7.4 or 8.1, need to move to a supported version. Full technical details are on the researchers' PHP2SHELL site.

How The Wow Bot Is Built

Everything we run is a Node.js application on our own servers. That includes the chat service, the admin panel, the user app where you manage your bot, and this website. None of it uses PHP.

Your conversations and settings are stored in Canada, and conversations and visitor names and emails are encrypted. PHP2SHELL can't reach any of it.

What About the WordPress Plugin?

The Wow Bot plugin is written in PHP because every WordPress plugin is. It runs on your website's server, alongside WordPress itself, your theme and your other plugins.

PHP2SHELL is a flaw in PHP, not in our plugin's code, so there's no plugin update to install for it. Updating any plugin or WordPress itself doesn't update PHP. The fix is a PHP upgrade on the server, and it applies to every PHP website, whether or not The Wow Bot is installed. Removing our plugin wouldn't protect your site.

Who Needs to Update PHP

It depends on who runs your server:

• Managed WordPress hosting. Your host handles PHP updates. Check their status page or support notices to confirm they've upgraded.
• Shared hosting. Contact your host and ask whether PHP on your account has been upgraded for PHP2SHELL. In some control panels you choose the PHP version yourself, so pick a supported one.
• Your own server or VPS. Your team or IT provider installs the patched PHP release, then restarts Apache, PHP-FPM and any long-running PHP workers so the fix takes effect.
• Sites without WordPress. If you added The Wow Bot with one line of code, the bot runs on our servers. Your website may still run PHP, so check with whoever hosts it.

Firewall rules from your host can help in the meantime, but the researchers are clear that upgrading PHP is the only complete fix.

What We Did

On October 21 we reviewed every part of The Wow Bot and confirmed our servers don't run PHP. No change to our service was needed, and the bot kept answering visitors normally the whole time.

If your web team asks, you can tell them The Wow Bot's servers aren't affected and the plugin doesn't need an update for this issue. The server running your WordPress site still needs the PHP upgrade.

Worried About Your Site? Get Help Now

If you're not sure your website is patched, or your host isn't answering, don't wait. Wow Digital's team builds and supports websites for non-profits and associations, and we can check your PHP version, work with your host and get the upgrade done.

Contact Wow Digital for support today.

Questions? We're Here

Start with your hosting company to confirm your site is patched. Wow Digital's 12-point website security checklist covers other good habits. For anything about The Wow Bot, use "Talk to a person" in the chat on this site, or read our FAQ and our guide to chatbot privacy in Canada.