A critical PHP vulnerability in 2026 is putting websites at risk. On October 21, 2026, the PHP project released emergency security updates for two flaws known as PHP2Shell. They are tracked as CVE-2026-109618 and CVE-2026-109619.
Both flaws can let an attacker run code on a web server without logging in. Both score 9.2 on the CVSS scale, which is rated Critical.
If your site runs on PHP, ask your host or developer one question today. Has PHP been updated to a patched version? Updating WordPress or its plugins will not fix this problem. The fix must happen on the server.
What Is the Critical PHP Vulnerability Discovered in October 2026?
PHP is the programming language behind a large share of the web, including WordPress. PHP2Shell is the nickname for two security flaws in PHP itself. They are not bugs in one plugin or theme.
The PHP security team describes the two issues this way:
- CVE-2026-109618 (remote code execution via out-of-memory corruption): PHP can run out of memory and stop mid-task. That can leave request data half built, and cleanup code may then trust it.
- CVE-2026-109619 (remote code execution via stale global state): Old data from an earlier request can be reused unsafely by a later one.
Details leaked before the planned release date. The PHP team moved the release forward by one day.
How Serious Are These PHP Security Vulnerabilities?
Both flaws are rated 9.2 on CVSS v4.0. Remote code execution (RCE) means an attacker can run their own commands on your server.
The PHP security team says unauthenticated RCE has been demonstrated over HTTP against Apache with mod_php. The attack runs before any application code executes. Source analysis also points to PHP-FPM, although a complete exploit for it had not been shown.
Reports on the official advisory add that an attacker does not need a vulnerable app or a public upload form. Here is what researchers have reported so far:
- Amazon Threat Intelligence recorded an exploitation attempt on October 17, four days before public disclosure.
- watchTowr reports exploitation in the wild.
- Cloudflare reported early attacks on October 21 and enabled emergency firewall rules.
- As of October 23, neither CVE is listed in CISA’s Known Exploited Vulnerabilities catalog.
Which PHP Versions Are Affected?
The PHP project fixed both flaws in four supported branches. Check your version against this table.
PHP branch | Affected versions | Patched version |
|---|---|---|
PHP 8.5 | 8.5.0 to 8.5.11 | 8.5.12 |
PHP 8.4 | 8.4.0 to 8.4.26 | 8.4.27 |
PHP 8.3 | 8.3.0 to 8.3.35 | 8.3.36 |
PHP 8.2 | 8.2.0 to 8.2.34 | 8.2.35 |
PHP 8.1 and older | Reported as affected | No official fix from PHP |
The PHP project no longer supports PHP 8.1 and earlier. CERT-EU says the affected range may reach back to PHP 5. Some hosting vendors offer backported fixes, so ask your provider or move to a supported release.
Also plan ahead for PHP 8.2. It receives security fixes only until December 31, 2026.
WordPress.org statistics reported by The Repository showed that 35.1% of WordPress sites ran a PHP version the PHP project no longer patches. That makes upgrades urgent for many owners.
Are WordPress and WooCommerce Websites at Risk?
Yes, if they run on an unpatched PHP version. WordPress and WooCommerce are written in PHP. They depend on the PHP engine installed on your server.
It helps to separate two layers:
- The PHP runtime: This is the engine. PHP2Shell lives here. Only a PHP update from your host or server administrator fixes it.
- WordPress core, plugins, and themes: This is the code on top. Keep it updated, but those updates cannot repair a flaw in the engine underneath.
WooCommerce stores need extra attention. They hold customer accounts and order data. A compromised server can put that information at risk.
How to Check Your Website’s PHP Version
In WordPress:
- Log in to your WordPress dashboard.
- Go to Tools, then Site Health.
- Open the Info tab.
- Expand the Server section and find the PHP version.
In a hosting control panel, look for a PHP settings or PHP version tool. Many panels, such as cPanel and Plesk, list the version for each domain. If you cannot find it, ask your host’s support team.
One caution applies. Some hosts patch PHP without changing the visible version number. Ask your host to confirm in writing that both CVE-2026-109618 and CVE-2026-109619 are fixed.
How to Protect Your Website from PHP2Shell
Follow these steps in order:
- Check your PHP version. Compare it with the table above.
- Take a complete backup. Save your files and database before any change.
- Check compatibility. Test on a staging copy if possible. Older plugins and themes may not work on newer PHP.
- Update PHP to a patched version. Then restart PHP services so running workers load the fixed code. Shared hosting customers should ask their host to do this.
- Test your website. Check forms, logins, checkout, and key pages.
- Review your logs. Look for unusual requests, unexpected files, new admin users, and odd outbound connections.
- Update WordPress, plugins, and themes. Remove any you no longer use.
- Set up ongoing monitoring. Reliable website maintenance services can help you keep this routine.
A web application firewall (WAF) is not a substitute for patching. Cloudflare’s emergency rules were described as a stopgap, and attackers were reported changing their payloads. The PHP security team says updating is the only complete mitigation.
Temporary settings may make attacks harder. They do not remove the flaw.
Is there a newer PHP advisory?
Yes. On October 23, 2026, PHP disclosed CVE-2026-115560. It is a separate session-handling flaw that the October 21 releases do not fix. PHP considers it unlikely to affect most sites and plans a routine fix. It recommends disabling session upload progress until then. No exploitation of this issue has been reported.
Why Regular Website Maintenance Is Important for Security
PHP2Shell shows how short the gap between disclosure and attack can be. Attack attempts were reported before the patches arrived. Sites without a routine update process fall behind quickly.
Regular maintenance helps in practical ways:
- Someone watches for security advisories.
- Updates are tested before they go live.
- Backups are ready if something goes wrong.
- Server and site changes are reviewed on a schedule.
Many business owners do not have time for this work. Webolute offers professional website maintenance to help businesses keep their websites secure, updated, and running smoothly. No service can promise complete protection from cyberattacks. A steady process does lower risk and shortens response time.
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the name used for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. Both can allow remote code execution without a login. PHP released fixes on October 21, 2026.
Is my WordPress site affected by CVE-2026-109618 and CVE-2026-109619?
It is if your server runs an unpatched PHP version. The flaws are in PHP, not in WordPress core. Your host or server administrator must install the PHP update.
Which PHP version should I use?
Use PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or a later release in the same branch. If you run PHP 8.1 or older, plan an upgrade to a supported branch.
Can a firewall protect me from PHP2Shell?
A firewall can block some attacks. It does not fix the flaw. Install the PHP security patch as well.
Is PHP2Shell being exploited?
Yes. Researchers have reported exploitation attempts, including one recorded by Amazon on October 17. CISA had not added either CVE to its exploited vulnerabilities list as of October 23.
Conclusion
The critical PHP vulnerability of 2026 affects the engine behind many business websites. The risk is real, and attacks have been reported. The fix is clear: update PHP to a patched version.
Start by confirming your PHP version today. Back up your site, update PHP, restart services, and test. Then keep WordPress, plugins, and themes current.
If you would rather not manage this alone, Webolute’s website maintenance service can help you stay on top of updates and security checks.
3. Sources and References
- PHP security team announcement of CVE-2026-109618 (oss-security, October 21, 2026): https://openwall.com/lists/oss-security/2026/10/21/6
- Help Net Security, “PHP2Shell: Critical PHP vulnerabilities patched, update now!”: https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/
- watchTowr, PHP2Shell FAQ: https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
- The Hacker News, on CVE-2026-115560: https://thehackernews.com/2026/10/urgent-php-warns-of-another-unpatched.html
- AWS Security Bulletin 2026-143 (affected and fixed version ranges): https://aws.amazon.com/security/security-bulletins/2026-143-aws/
- Canadian Centre for Cyber Security, Alert AL26-026: https://cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619
- Cloudflare WAF response, as reported by PPC Land: https://ppc.land/cloudflare-blocks-php2shell-exploits-9-hours-before-php-flaws-went-public/
