On 21 October 2026, the PHP team released emergency fixes for two critical flaws in the PHP engine itself. They became known as PHP2Shell, carry the identifiers CVE-2026-109618 and CVE-2026-109619 and have a severity score of 9.2 out of 10. If your site runs on PHP, and most do, this article is for you.
What PHP2Shell is, in plain language
PHP is the language behind a huge part of the internet: WordPress, WooCommerce, PrestaShop, Joomla, Drupal and thousands of custom-built sites. The two flaws are not in a plugin or a theme. They are in PHP itself, in the way it manages memory when a request ends abnormally.
In practice, an attacker with no password and no account can send a specially crafted request and make the server run their code. In the most exposed setup (Apache with mod_php), the PHP team showed that a single request is enough, and that the attack happens before the site's code even starts running. In other words: it does not matter whether your WordPress is up to date. If the server's PHP is not, the site is exposed.
Who is affected
Every PHP installation that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
PHP 8.1 and earlier no longer receive official fixes. Some Linux distributions have published their own patches, but anyone still on PHP 7 should migrate.
Already being exploited
This is not a theoretical risk. Amazon's honeypot recorded an exploitation attempt on 17 October, four days before the fixes existed. Cloudflare confirmed attacks on both flaws right after disclosure. The UK's National Cyber Security Centre (NCSC) and CERT-EU recommended taking offline any systems that cannot be patched immediately.
What to do, in order
Find out which PHP version your site uses. In WordPress it is under Tools > Site Health > Info > Server. In the hosting panel (cPanel, Plesk) it usually appears on the home page.
Update to a fixed version. On shared hosting, the provider does the update. Ask them in writing whether they have already applied the PHP2Shell fixes (CVE-2026-109618 and CVE-2026-109619).
If you cannot update right away, there are temporary measures that reduce the risk, such as turning off
session.upload_progress. The PHP team itself warns that none of them fully protects you: the only definitive fix is the update.If the site is behind Cloudflare, there are firewall rules against the known attacks, including on the free plan. They help, but they are temporary and do not replace the update.
After updating, check for signs of intrusion: strange PHP files in upload folders, administrators nobody created, recent changes nobody made.
What we did on JoaoDG sites
On the servers we manage, every site's PHP was already on a fixed version by 23 October, two days after disclosure. We also reviewed the settings the PHP team recommends, updated WordPress, plugins and themes, and looked for signs of intrusion. We found none.
The lesson is the usual one: a website is not a painting you hang on the wall. Flaws appear every week, and what protects a business is not having the prettiest site, it is having someone who handles the updates before the attackers arrive.
Not sure which version your site is on, or who updates it? Talk to us and we will check it with you.
Sources: BleepingComputer, Help Net Security. Image: Wikimedia Commons, public domain (CC0).