Flywheel and PHP2Shell

Flywheel reports that it has patched its hosting platform. As of October 23, 2026, its official “PHP Security Update” incident is marked Resolved. The completion update, posted October 21, 2026, at 2:00 p.m., states: > “WP Engine has finished the deployment of security patches for two critical PHP vulnerabilities on the Flywheel platform.” Flywheel says the patch was applied

Yes — Flywheel is affected by PHP2Shell, but it has been fully patched. Here is a detailed breakdown: What is PHP2Shell? PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of Remote Code Execution vulnerabilities in PHP that let an attacker run their own code on a web server without logging in. The PHP security team rates both CVSSv4.0 9.2 and

Yes—Flywheel is potentially affected if its hosting stack was running an unpatched PHP version. PHP2Shell affects PHP itself, so applications and hosting platforms using PHP are in scope regardless of the CMS or framework. However, no source found here confirms that Flywheel specifically was affected, or that Flywheel had completed its patching. The available advisories only establish that affected

Yes, sites running on Flywheel (owned by WP Engine) were affected by the core PHP PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619 ), and the parent platform has deployed fixes and edge-layer protections. Key Details Vulnerability Impact: Because PHP powers the underlying runtime for WordPress sites, unpatched PHP installations on the server level were exposed to unauthenticated remote code execution (RCE)

Yes, Flywheel (as a managed WordPress hosting platform running PHP environments) is inherently exposed to core PHP vulnerabilities like PHP2Shell (CVE-2026-109618 and CVE-2026-109619) because these critical remote code execution flaws exist within the PHP interpreter engine itself. Are you affected / Has it patched? Flywheel implemented initial protective measures at the CDN and infrastructure edge/firewall level immediately following the