If your website runs WordPress, Drupal, Joomla, Magento, Laravel, or another PHP-powered application, an urgent security update deserves your attention.
On October 21, 2026, the PHP project released emergency security patches for two critical vulnerabilities that could allow attackers to execute code on a server without authentication. These flaws affect PHP itself, meaning that updating WordPress core, installing plugin updates, or changing your theme will not resolve the underlying problem.
The solution is to update PHP to a patched version or apply an appropriate security backport for an older branch. The vulnerabilities, collectively referred to here as PHP2Shell, have been assigned CVE-2026-109618 and CVE-2026-109619. Both received a CVSS severity score of 9.2 out of 10.
Security researchers have demonstrated potential exploitation in real-world CMS environments, and security firms have reported attack attempts. In this guide, you'll learn what happened, which hosting configurations are affected, how to check your PHP version, and what steps to take to protect your website.
What Happened on October 21, 2026?
On October 21, 2026, at 14:00 UTC, the PHP project published a security advisory alongside four patched releases: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The release was moved forward by one day after vulnerability details leaked on October 20.
The two vulnerabilities can potentially enable unauthenticated remote code execution (RCE). In practical terms, an attacker may be able to execute malicious code on a vulnerable server without first logging in.
The discovery also involved AI-assisted security research. Calif identified one vulnerability using OpenAI's GPT-5.6 Sol as part of its Patch the Planet initiative, while researchers at Wiz independently discovered and reported both flaws. Wiz demonstrated pre-authentication remote code execution against WordPress, Drupal, and Joomla environments, and showed that attackers could potentially expose memory belonging to PHP worker processes.
The situation escalated quickly. Australian government websites were reportedly being taken offline as agencies worked to apply patches, while Cloudflare's CTO said the company was "seeing early attacks emerging". Security firm watchTowr also reported active exploitation attempts targeting both vulnerabilities. These developments make prompt patching especially important for website owners and hosting administrators.
Why WordPress Plugins Cannot Protect You
Website owners often approach security by updating WordPress core, plugins, and themes. While these updates remain essential, they cannot independently fix vulnerabilities inside the PHP runtime.
PHP is the server-side engine that executes the code behind WordPress and many other web applications. If the runtime is vulnerable, an otherwise fully updated website may remain exposed.
The PHP security team's position is clear: "There are no complete mitigations; updating is the only safe choice."
Understanding the Two PHP2Shell Vulnerabilities
- CVE-2026-109618: remote code execution through memory corruption. This vulnerability involves an out-of-memory condition during a PHP request. The request may terminate while internal data structures are only partially initialized, and cleanup operations can mistakenly treat that incomplete data as valid — potentially creating an opportunity for code execution.
- CVE-2026-109619: remote code execution through stale global state. This flaw involves internal data that can persist after its associated memory has been freed. A later request handled by the same worker may encounter that stale state. Attackers can send repeated pairs of requests in an attempt to reach a worker with compromised state and exploit it.
Which PHP Hosting Configurations Are Vulnerable?
According to the advisory, the affected scope includes installations serving web requests through PHP-FPM (including common Nginx configurations), Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The reported risk is particularly concerning for mod_php, because exploitation was demonstrated through an unauthenticated request before application code executed.
If your website uses PHP, check the exact runtime version rather than assuming your hosting configuration is protected.
Step 1: Check Your Current PHP Version
Before applying an update, identify the PHP version running your website.
| PHP Branch | Required Patched Version |
|---|---|
| PHP 8.5 | 8.5.12 or newer |
| PHP 8.4 | 8.4.27 or newer |
| PHP 8.3 | 8.3.36 or newer |
| PHP 8.2 | 8.2.35 or newer |
| PHP 8.1 and older | No official release — contact your host or vendor |
Three straightforward ways to check your PHP version:
- WordPress: open Tools → Site Health → Info → Server and locate the PHP version.
- cPanel: open MultiPHP Manager or Select PHP Version to view the version assigned to your website.
- SSH: on a server you control, run
php -vto display the PHP CLI version.
Important: the CLI version can differ from the version serving your website. Confirm the web runtime as well — that is the one attackers reach.
If your active PHP branch is below the applicable patched version, contact your hosting provider or upgrade promptly.
Step 2: Install the PHP Security Update
Updating PHP is the primary fix. Choose the method appropriate to your hosting environment.
Shared hosting and cPanel. Open MultiPHP Manager, select a patched PHP version supported by your website, and apply the change. Many hosting providers distributed the patches shortly after release, so the updated version may already appear in the selector.
Managed WordPress hosting. Some providers manage PHP updates automatically. Contact support and ask them to confirm whether the PHP runtime itself has been patched to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or whether an applicable backport has been installed.
VPS and dedicated servers. On supported Ubuntu systems using Ondrej-based PHP packages, run sudo apt update && sudo apt upgrade. On RHEL-family systems, the suggested package-update command is sudo dnf update php*. Check your distribution's package naming before executing commands. After updating, restart PHP-FPM or the relevant web server so running workers load the patched code.
PHP 8.1 and older. The PHP project no longer provides official releases for these branches. Minimal source backports were published for PHP 7.4, 8.0, and 8.1, but website owners should consult their Linux distribution or long-term-support vendor for a supported backported package — or upgrade to a supported PHP branch.
Back up first: back up your website files and database before making changes. Security releases are intended to fix vulnerabilities, but a complete backup gives you a recovery option if compatibility problems occur.
Running WordPress? Let me handle the update safely
I update and secure WordPress sites for clients — full backups first, then a safe PHP upgrade and post-update checks, without downtime.
Chat on WhatsAppStep 3: Strengthen Your Website Security
Patching is essential, but additional precautions can help reduce exposure:
- Disable session upload progress if unused. PHP recommends disabling this feature when it is unnecessary, and WordPress does not use it by default. In
php.ini, setsession.upload_progress.enabled = 0. - Recycle PHP workers regularly. On servers you control, consider a PHP-FPM configuration such as
pm.max_requests = 100to recycle workers more frequently. - Use a web application firewall. A WAF or ModSecurity with current rules may help reduce some malicious traffic, but it is not a complete mitigation.
- Monitor server logs. Watch for unusual request spikes, repeated suspicious requests, and unexpected activity involving PHP endpoints.
Freelancer tip: if you manage client websites, notify your clients and verify their hosting environments individually. A PHP security update is a legitimate maintenance priority — the clients who pay for updates are the ones who never get hacked.
What If Your Website Was Already Compromised?
Installing the patch prevents exploitation through the corrected vulnerability, but it does not automatically remove an attacker who gained access beforehand.
Watch for suspicious administrator accounts, unfamiliar files, unexpected redirects, or other unexplained changes. If you suspect a breach, treat it as a security incident: consider restoring from a clean backup dated before October 20, rotate all passwords and WordPress security salts — including those in wp-config.php — and get professional malware cleanup before reconnecting the website.
Investigate the cause and verify that the environment is secure before returning the site to normal operation.
Frequently Asked Questions
Does updating WordPress or its plugins fix PHP2Shell?
No. The vulnerabilities exist in the PHP runtime, not in WordPress core, plugins, or themes. Updating PHP itself — or applying an appropriate vendor-provided security backport — is necessary.
How can I tell whether my website has been attacked?
Review access logs for unusual repeated requests and check for unfamiliar administrator accounts, suspicious files, and unexpected redirects. Security firms have reported exploitation attempts, but there is no single check that can conclusively determine whether a website was compromised.
Is a plugin firewall enough to protect my website?
No. A WAF or plugin firewall may help filter suspicious traffic, but it cannot replace the PHP security update. The PHP advisory states that its listed mitigations do not provide complete protection.
My hosting provider says everything is updated. Am I safe?
Ask for the exact PHP version serving your website and confirmation that the relevant vulnerability fixes have been applied. Look for PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or a verified security backport for an older branch.
Are static HTML and Next.js websites affected?
No. Static HTML sites and Node.js or Python backends are not directly affected by these PHP runtime vulnerabilities. The issue applies to websites served by vulnerable PHP installations, including WordPress, Drupal, Joomla, Magento, Laravel, and other PHP-powered platforms.
Final Thoughts: Update PHP Before It's Too Late
The October 2026 PHP security advisory describes a serious situation: two critical vulnerabilities, potential unauthenticated remote code execution, no complete workaround, and reported exploitation attempts.
The most important action is straightforward: check your PHP version, install the appropriate security fix, restart the relevant workers where necessary, and verify the result. Do not assume your website is protected simply because WordPress and its plugins are up to date — check the PHP runtime itself, secure your hosting environment, and investigate any signs of compromise.
A timely security update can make the difference between a routine maintenance task and a major website incident.
Sources: PHP security advisory (October 21, 2026); Snyk security analysis; Wiz Research; The Diary of AI, October 21, 2026; Cloudflare CTO statement via Tenable, October 21, 2026.