If you run a website, there is a good chance it runs on PHP, the language behind WordPress, most online stores and a huge share of the web. On October 21, 2026, PHP’s maintainers shipped emergency fixes for two critical flaws that let an attacker take over a server with one request, before any of your own code even runs.
The bugs have a name already, which is never a good sign: PHP2Shell. Security researchers are comparing the response to Log4Shell, the 2021 flaw that had companies patching through the holidays.
If you are not technical, the good news is that the fix is usually your hosting company’s job. The bad news is that you should not assume they have done it. Here is what happened, and exactly what to check.
The short version
- Two flaws: CVE-2026-109618 and CVE-2026-109619, both rated critical (9.2 on the CVSS v4 scale in public advisories)
- What they allow: remote code execution without logging in. A single crafted request can trigger it
- Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
- Who is exposed: any PHP setup that serves web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed
- Highest risk: servers using Apache with mod_php
- What to do: update PHP, or confirm your host has. If you cannot, the UK’s National Cyber Security Centre says take the system offline until you can
Short on time? See the key points in our web story.
What the two flaws actually do
You do not need to read assembly to understand the shape of these bugs. Both come down to PHP getting confused about memory between web requests.
CVE-2026-109618 is about running out of memory at the wrong moment. If PHP hits an out-of-memory condition while it is still setting up internal data for a request, the clean-up code can later treat that half-built data as if it were valid. An attacker who can steer that process can turn it into code execution.
CVE-2026-109619 is about leftovers. Some internal state that belongs to one request can survive after its memory has been freed. A later request handled by the same PHP worker may then pick up that stale state before normal start-up resets it.
Researchers at the cloud security firm Wiz published the detailed technical write-up. One line from it should worry every site owner: a single unauthenticated request can trigger the attack before any application code runs. Your WordPress security plugin, your login page and your firewall rules inside the app never get a chance to see it.
Wiz also noted that frontier AI models substantially lowered the effort needed to turn the bug into a working exploit. That is a new and uncomfortable pattern: the gap between “patch released” and “attacks start” keeps shrinking.
Why this one is urgent
Three things push PHP2Shell up the priority list.
It leaked early. Details of the flaws circulated before the scheduled patch date, which is why several security outlets warned of possible mass exploitation. Linux distributions and long-term support vendors received fixes ahead of the public release, but plenty of servers are not on those channels.
No login needed. Most serious WordPress bugs need an account, or a specific vulnerable plugin. This one sits underneath all of that.
PHP is everywhere. Shared hosting, small business sites, school and church sites, forums, booking systems. Many of them are run by people who never think about the PHP version at all.
Reports on whether attacks have already started conflict, and it is too early to say how widespread they are. The safe assumption is that attackers are scanning.
Fixed and affected versions
| PHP branch | Fixed release | Status |
|---|---|---|
| 8.5 | 8.5.12 | Supported, update now |
| 8.4 | 8.4.27 | Supported, update now |
| 8.3 | 8.3.36 | Supported, update now |
| 8.2 | 8.2.35 | Security fixes only, update now |
| 8.1 and older | No official release | End of life: upgrade, or use a vendor or source backport |
PHP says every release before those numbers in each branch is affected. The project no longer supports PHP 8.1 and earlier, though minimal source backports exist for 7.4, 8.0 and 8.1 for people who build PHP themselves or have no long-term support vendor.
One specific warning from the advisories: if your server pulls PHP from the volunteer-run Remi repository, updates were not available there at the time of publication. Switch to your distribution’s own packages or build from source.
A checklist for WordPress and small business sites
You can do most of this in fifteen minutes, without touching a command line.
- Find your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section. Write down the exact version, for example 8.3.36.
- Compare it with the table above. If your number is lower than the fixed release for your branch, you are exposed.
- Check your hosting dashboard. Most hosts have a PHP settings page where you can switch versions. Pick the newest supported version your site works with.
- Message your host’s support. Ask one question: “Have you deployed the PHP2Shell fixes (CVE-2026-109618 and CVE-2026-109619) on my server?” Ask for a yes or no, not a general reassurance.
- Take a backup first if you are switching PHP versions yourself, in case an old plugin breaks.
- Turn on your CDN firewall if you use one. Cloudflare says it deployed initial rules for known exploit paths on all plans, including free.
- Look for signs of trouble once patched: new admin users you did not create, unfamiliar files in your uploads folder, or sudden spam pages in Google results.
If you cannot patch today
- PHP says setting session.upload_progress.enabled=0 and restarting every PHP worker blocks the confirmed attack path for CVE-2026-109619
- It does not block every variant, so it is a stopgap, not a fix
- The UK National Cyber Security Centre’s advice is blunt: if a system cannot be fixed right away, take it offline
Treat the workaround as buying hours, not weeks.
For developers and sysadmins
If you manage your own servers, the order of work is straightforward:
- Update through your distribution or long-term support vendor first; many had patched packages before the public release
- Restart every PHP worker after updating. PHP-FPM pools and long-running app servers keep the old code in memory until they restart
- Rebuild container images rather than patching running containers, and redeploy
- Prioritize anything on Apache mod_php and anything directly reachable from the internet
- Check images and appliances you do not normally think of as “PHP”: admin panels, monitoring dashboards, vendor web interfaces
What this means for everyone else
Most people will never read a CVE number, and they should not have to. But if you have a personal blog, run the website for a local club, or pay someone to host your shop, this is the week to ask the question. Hosting companies are good at this, but they are not perfect, and the cheapest plans are often the slowest to move.
If you use a site that has been hacked, you may see odd redirects, fake login pages or warnings in your browser. Do not enter passwords or card numbers on a site that suddenly looks different. Our guides to spotting scam texts and links and to disputing a credit card charge cover what to do if you get caught.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can let an unauthenticated attacker run code on a web server that uses PHP, and a demonstrated exploit needs only a single request.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older releases in those branches are affected. PHP 8.1 and earlier are no longer supported, though minimal source backports exist for 7.4, 8.0 and 8.1.
Is my WordPress site affected by PHP2Shell?
WordPress runs on PHP, so if your host has not updated PHP your site can be exposed even if WordPress itself is fully up to date. Check your PHP version under Tools, Site Health, Info, Server in the WordPress dashboard, then confirm with your host that it is a patched build.
Is there a workaround if I cannot update PHP right away?
PHP says setting session.upload_progress.enabled=0 and restarting every PHP worker blocks the confirmed attack path for CVE-2026-109619, but not other variants. The UK National Cyber Security Centre advises taking systems offline if they cannot be fixed quickly.
Is PHP2Shell being exploited?
Reports conflict. A working exploit has been demonstrated and the flaws leaked before the scheduled patch, so security firms expect mass scanning. Assume attackers are already looking and patch now.
Does Cloudflare protect against PHP2Shell?
Cloudflare says it has deployed initial firewall rules for known exploit paths, available on all plans including free. That is a useful extra layer but not a replacement for updating PHP.
More tech and safety guides
- How to spot and report scam texts
- What to do if your identity is stolen
- How to freeze your credit for free
- How to dispute a credit card charge
Sources: PHP security advisories; technical analysis by Wiz; reporting by Help Net Security, SecurityWeek and Infosecurity Magazine; UK NCSC and Cloudflare guidance, all as of October 21, 2026.
