PHP2Shell is a bug in PHP itself (CVE-2026-109618 and CVE-2026-109619). It can run before WordPress. The official fix is PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. PHP 7.4, 8.0, and 8.1 have no official PHP-project fix. Your host may have already patched an older version number. Distros sometimes add the fix without changing the version you see. Only a patched PHP plus a worker restart fully fixes it. Bedrock detects, alerts, and can mitigate at the edge. It does not patch PHP itself.

Ask your host to update PHP. On shared hosting, pick a newer PHP in the control panel or open a ticket. On a VPS, install the patched packages and reload PHP-FPM or Apache. Docker: rebuild on a pinned patched image. Apache mod_php is the highest risk. ini_set and .user.ini cannot fix this. The host must set php_admin_value before the request is parsed: session.upload_progress.enabled=0, a low post_max_size, and upload_max_filesize below that.

Bedrock can block later attack steps (scanner user-agents, a known upload name, php://filter, a known multipart boundary). It cannot stop the first PHP bug. If this site is already on Cloudflare, Hub Cloud can push the same header and query patterns to the edge. That layer sits in front of PHP. Attacker IPs from public reports expire in a few days. We do not long-block them.

The plugin still runs on PHP 7.4. The warning stays until the host updates PHP. You never change DNS. Open Sites or Is Bedrock enough alone?