SOLUTIONSQuick answer
PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated 9.2 on CVSS v4.0. They let an unauthenticated attacker run code on a web server through PHP itself, so WordPress, Drupal, Joomla and custom PHP sites are all exposed. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your host's patched build, now.
Key takeaways
- The flaws are in PHP itself, not in a plugin or theme, so every PHP site serving web requests is in scope.
- Fixed releases came out on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Details leaked before the planned disclosure, and watchTowr reports exploitation in the wild since 21 October.
- Hosts and Linux distributions often patch without changing the version number, so check your host's notice, not just
phpversion(). - Sites on PHP 8.1 or older need an upgrade plan; the PHP team only published minimal source backports for 7.4–8.1.
What is PHP2Shell?
PHP2Shell is a pair of memory-safety bugs in the PHP engine. CVE-2026-109618 is in PHP's out-of-memory handling: if PHP runs out of memory while setting up request data, it can later treat half-initialised data as valid during clean-up. CVE-2026-109619 is a use-after-free: PHP can keep request state after its memory has been freed, and a later request handled by the same worker may use that stale state.
The PHP security team rates both critical (CVSS v4.0 9.2). The attack needs no login and runs with the permissions of the web server's PHP worker. According to PHP's advisory, as summarised by Huntress, a complete remote code execution was demonstrated over plain HTTP against Apache with mod_php using default settings, before any application code runs.
Is my WordPress or PHP website affected?
Very likely, unless your host has already patched. PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Because the bug is in the runtime, it does not matter how up to date your WordPress core, theme or plugins are. Security researchers at Wiz reportedly demonstrated the attack against WordPress, Drupal and Joomla, plus a separate memory leak that could expose passwords, tokens and API keys.
| PHP branch | Fixed version | Status |
|---|---|---|
| 8.5 | 8.5.12 | Supported: upgrade |
| 8.4 | 8.4.27 | Supported: upgrade |
| 8.3 | 8.3.36 | Supported: upgrade |
| 8.2 | 8.2.35 | Supported: upgrade |
| 7.4–8.1 | No official release | End of life: minimal source backports only; plan an upgrade |
Why is PHP2Shell urgent?
- 20 October 2026: a post announcing the bugs appeared before the planned disclosure date and spread as screenshots. PHP moved its emergency release forward by a day.
- 21 October 2026: PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Technical write-ups from Calif and Wiz followed the same afternoon.
- From 21 October: watchTowr reports exploitation attempts in the wild through its honeypot network, and VulnCheck says it has a working exploit for CVE-2026-109618.
The gap between disclosure and attacks was hours, not weeks. If your site runs on PHP, treat this as a same-day task.
What should I do right now?
- Find every PHP install you own: websites, staging copies, old microsites, control panels such as cPanel or Plesk, and PHP bundled inside other software.
- Patch: upgrade to a fixed version, or apply your host's or distribution's patched package, then restart PHP-FPM or the web server so the new binary is actually running.
- Confirm with your host: on shared or managed WordPress hosting you usually cannot patch PHP yourself. Ask the host to confirm, in writing, that your server runs a fixed build.
- If you cannot patch today: PHP states that no configuration change fully fixes these flaws. As a stop-gap Huntress suggests setting
session.upload_progress.enabled = Offin php.ini, which blocks the known abuse cases, and putting old servers behind a WAF or VPN. Patch as soon as possible anyway. - Retire end-of-life PHP: sites on PHP 7.4–8.1 should move to 8.3 or newer. Test themes and plugins on a staging copy first.
How can I tell if my site was already attacked?
Successful attacks usually leave traces on the server. Look for, or ask your host to look for:
- PHP worker processes (
php-fpm,php-cgi,httpd,apache2) starting shells or tools such assh,bash,curl,wgetornc. - Commands like
whoami,idoruname -arun by the web server user. - New or recently modified
.phpfiles in upload folders and the web root (a classic sign of a web shell). - New cron jobs, scheduled tasks, admin users or unknown WordPress administrator accounts.
If you find any of these, take the site offline or isolate the server, keep a copy of the logs, and rotate every secret the server could read: database passwords, API keys, payment and email credentials. Then rebuild from a known-good backup on a patched server.
What does PHP2Shell teach website owners?
Keeping WordPress and plugins updated is not enough: the runtime underneath (PHP, Node.js, the operating system) needs an owner too. Know which PHP version each site runs, who is responsible for patching it, and how quickly they respond. If nobody can answer those questions for your business, that is the real risk to fix.
Naarvix can audit your sites, upgrade PHP and WordPress safely on staging, or move a site to a modern, low-maintenance stack. See our web development service or contact us.
Sources
Frequently asked questions
Does updating WordPress fix PHP2Shell?
No. The vulnerabilities are in PHP, the language runtime WordPress runs on. You need a fixed PHP build (8.5.12, 8.4.27, 8.3.36, 8.2.35 or your host's patched package), not a WordPress or plugin update.
How do I check which PHP version my site uses?
In WordPress, open Tools → Site Health → Info → Server. On a server, run `php -v` and check the PHP-FPM or Apache module version too. Because hosts often backport fixes, also confirm with your host that the build includes the October 2026 patches.
Is there a workaround if I cannot upgrade PHP?
PHP says no configuration change fully mitigates the flaws. Disabling session.upload_progress.enabled blocks the known abuse cases and a WAF or VPN can reduce exposure, but they are stop-gaps until you patch or upgrade.