On 21 October the PHP project released emergency fixes for two critical vulnerabilities in PHP itself. An attacker can use them to run their own code on a web server without an account or a password. Most small business websites and web shops run on PHP, so this is worth a direct question to whoever hosts yours.
Updated 22 October: latest reports on exploitation attempts.
What is PHP2Shell?
PHP2Shell is the nickname for two flaws published together at 14:00 UTC on 21 October:
| CVE | PHP’s title | What goes wrong |
|---|---|---|
| CVE-2026-109618 | RCE via OOM corruption | When PHP runs out of memory while handling a request, it can be left in a half-prepared state that an attacker can turn into code execution. |
| CVE-2026-109619 | RCE via stale global state | Data from one request survives after its memory is freed, and a later request on the same worker can abuse it to run code or leak memory contents, such as passwords, tokens and API keys. |
The PHP security team rates both CVSS v4.0 9.2 (critical). NIST’s National Vulnerability Database adds its own CVSS v3.1 score of 9.8. Either way, these are critical.
Three things make them serious:
- No login is needed. The attacker does not need an account on your site.
- Your website’s own code may never run. In one demonstrated case the exploit fires before the application is loaded, so WordPress logins and plugin settings play no part.
- PHP is everywhere. According to W3Techs, PHP runs on about 69% of websites whose server-side language is known. PHP says all installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php the highest risk.
A successful attacker gets the same rights on the server as the website itself. That is usually enough to change pages, read the database and use the server for further attacks.
Is my WordPress site affected?
Yes, if the server runs an unpatched PHP version. The flaw is in PHP, not in WordPress, so updating WordPress, your theme or your plugins does not fix it. According to Huntress, researchers at Wiz demonstrated unauthenticated code execution against WordPress, Drupal and Joomla. The same applies to WooCommerce shops and custom PHP applications.
On shared or managed hosting, PHP is updated by your hosting provider, not by you.
Which PHP versions are fixed?
| PHP branch | Fixed in | Notes |
|---|---|---|
| 8.5 | 8.5.12 | Released 21 October |
| 8.4 | 8.4.27 | Released 21 October |
| 8.3 | 8.3.36 | Released 21 October |
| 8.2 | 8.2.35 | Released 21 October; support ends 31 December 2026 |
| 8.1, 8.0, 7.4 | No official release | PHP published minimal source patches for Linux distributions and long-term support vendors |
| 7.3 and older | No fix | Upgrade to a supported branch |
Linux distributions received the patches in advance. Your host may therefore run a distribution package that contains the fix under a different version number. In that case, ask them to confirm the fix for CVE-2026-109618 and CVE-2026-109619 is included.
How did it become public?
PHP planned a coordinated release for Thursday 22 October. On the morning of 20 October an anonymous post on Hacker News claimed two critical PHP flaws were coming, and screenshots spread on social media even after it was removed. PHP had reserved the right to release early if details leaked, and moved the release to Wednesday 21 October.
Is PHP2Shell being exploited?
As of 22 October, reports differ:
- Cloudflare deployed firewall rules about nine hours before disclosure, observed attack traffic against its customers, and saw attackers modify payloads to get around the rules. The rules cover Free plans automatically.
- watchTowr reports active exploitation attempts against both CVEs.
- Amazon recorded an attempt on its honeypot on 17 October, four days before disclosure, according to Help Net Security. We could not find Amazon’s own statement.
- CISA had not added either CVE to its Known Exploited Vulnerabilities catalogue as of the 21 October catalogue.
- CERT-FR knows of working proofs of concept for specific PHP set-ups but does not report confirmed attacks.
In Estonia, RIA estimates that tens of thousands of servers could be vulnerable and has not confirmed any exploitation here.
What to do now
- Ask your hosting provider or IT partner in writing whether PHP is on 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor package with the fix, and whether PHP was restarted afterwards.
- If you run your own server, update and restart PHP now. Every PHP-FPM, Apache or LiteSpeed worker has to restart before the fix takes effect, and containers should be rebuilt from an updated image, as Wordfence advises.
- If the update has to wait, apply PHP’s temporary settings. The advisories list them, such as switching off session upload progress in the server configuration. They reduce the risk, but PHP is clear that “only an update is a complete solution.”
- List every system that uses PHP. Besides the website, think of customer portals, booking tools and bought-in products with PHP inside. RIA advises starting with internet-facing systems, keeping logs and being ready to take a system offline.
- If you are on PHP 8.1 or older, agree an upgrade date. Until then, the UK NCSC and CERT-EU advise considering taking systems that cannot be patched offline.
A web application firewall such as Cloudflare buys time, but it only sees traffic that passes through it and does not fix the server.
How to check your PHP version
- WordPress: go to Tools → Site Health → Info → Server and read the PHP version.
- Hosting control panel: most panels show the PHP version per site.
- Ask your host: “Is our server patched against CVE-2026-109618 and CVE-2026-109619, and when were the PHP workers last restarted?”
Our free PHP check reads the PHP version your website shows to every visitor. It sends no attack traffic. Many servers hide their version, which is good practice; in that case, ask your host.
Frequently asked questions
Does updating PHP remove an attacker who is already in?
No. The update closes the hole but does not remove anything an attacker has already placed on the server. If your logs show anything suspicious, assume the server has been taken over: change the passwords and API keys it holds, report it to CERT-EE (cert@cert.ee) and get help before you simply update and move on.
Does Cloudflare’s free plan protect me?
Partly. Cloudflare’s rules block known attack patterns, but it reports that attackers are already modifying their requests to get past them. Treat a firewall as a stopgap, not a fix.
Is this a crisis?
Taavi Kupper, head of RIA’s incident handling department, told ERR on 22 October that it is not a crisis, but a new normal. The fix exists. What matters is how quickly each server gets it.
For other quick checks, including whether someone can send email in your domain’s name, see our free checks.
Sources
- PHP: Security advisory and fixed releases, 20–21 October 2026
- PHP security advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
- PHP security advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
- Cloudflare: PHP vulnerabilities and WAF protection
- CERT-FR: CERTFR-2026-ALE-014
- RIA: PHP-s tuvastati kaks kriitilist turvanõrkust (in Estonian)
We used AI to help write this post. The facts come from the sources listed below and reflect what was known on the day the news broke. How we use AI.
