Last checked: 1 November 2026
Your website can have the latest WordPress updates and still need an urgent security fix.
The reason is PHP. It is the software that runs behind many websites. Two serious problems in PHP have become known as PHP2Shell.
These problems can let an attacker run commands or read sensitive information on an affected server. The attacker may not need to log in.
The good news is that security fixes are available. This guide explains the problem and the steps website owners should take.
What is PHP?
PHP is a programming language used to build websites. It runs on the web server.
When you open a WordPress page, PHP helps prepare the content sent to your browser. Drupal, Joomla, and MediaWiki also use PHP.
Think of your website as a restaurant. The page you see is the meal. PHP is part of the kitchen that prepares it.
A problem in that kitchen can affect the website even when its own code is up to date.
What is PHP2Shell?
PHP2Shell is the name given to a group of serious PHP security flaws. The original disclosure covers two vulnerability identifiers:
- CVE-2026-109618
- CVE-2026-109619
Both received a critical severity rating of 9.2 out of 10. This is a severity score. It does not mean there is a 92% chance that a website will be hacked.
Researchers at Wiz describe attacks that could expose passwords, access tokens, and API keys held in a PHP process. They also demonstrated attacks against WordPress, Drupal, and Joomla deployments. That does not mean every installation of those platforms was hacked. 1
What went wrong?
The two problems involve how PHP handles memory.
Problem 1: PHP handles a memory failure unsafely
PHP uses memory while processing a request. Sometimes an operation needs more memory than it can use.
In affected versions, a memory failure can interrupt PHP before internal data is ready. PHP may then try to clean up that unfinished data as if it were valid.
An attacker can use this unsafe behaviour to cause memory corruption. Under the right conditions, this can lead to remote code execution. This problem is CVE-2026-109618. 2
Problem 2: PHP keeps an old memory reference
A PHP worker is a process that handles website requests. It may handle many requests over time.
In some cases, it keeps a reference to memory after that memory has been released. A later request can cause PHP to use the old reference.
This is called a use-after-free problem. It can lead to data leaks or remote code execution. This problem is CVE-2026-109619. 3
Does remote code execution mean full server control?
Remote code execution means an attacker can make software run commands from a distance.
For these flaws, the commands initially run with the PHP worker’s permissions. The attacker does not automatically become the server administrator.
However, those permissions may still allow access to website files and application data. AWS says the impact depends on the affected worker’s permissions. It has not established cross-customer propagation. 4
Are attackers using these flaws?
Yes. On 26 October 2026, CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalogue. 5
This matters because some early reports said successful attacks had not been confirmed. Those reports describe an earlier stage of the incident.
Still, attack attempts and successful break-ins are different things. A large number of blocked requests does not prove that the same number of websites were compromised.
How did AI play a role?
Wiz says AI tools helped researchers find the problems and build working attacks. The work included testing and adapting attacks to different environments. 1
The lesson is simple. A flaw that is difficult to exploit can become easier to use as tools improve.
This does not mean AI can instantly hack every PHP website. The server setup still matters.
Which PHP versions contain the fixes?
The PHP project released these first fixed versions on 21 October 2026: 6
| PHP branch | First version fixing the original two flaws |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Install a current, supported release containing these fixes. You do not have to change to a different PHP branch if your current supported branch has a suitable update.
Some hosting and Linux vendors add fixes to their own packages. Ask your provider to confirm the exact package is patched. A version label alone may not tell the whole story. 6
How to protect your website
1. Check the PHP version serving your website
In WordPress, open Tools → Site Health → Info → Server. Look for the PHP version.
You can also check your hosting control panel. Record the complete version, including the numbers after the second dot.
Check the live website. Your local development copy may use a different PHP version.
2. Ask your hosting provider for confirmation
Send this question to support:
Has the PHP runtime serving my website been patched for CVE-2026-109618 and CVE-2026-109619? Please confirm the exact build and whether all PHP workers are running it. Please also assess CVE-2026-115560.
This is more useful than asking whether the server is generally secure.
3. Install the PHP security update
For managed hosting, the provider normally controls the available PHP builds.
For a self-managed server, the administrator must update the relevant packages or container images. Confirm that running PHP workers use the new build.
Updating WordPress, a theme, or a plugin does not replace the PHP update. Cloudflare makes this distinction clear in its guidance. 7
4. Test your website after the update
Check the homepage, dashboard, forms, media uploads, and important customer journeys. Test checkout if you run a shop.
Keep a recent backup of both website files and the database before maintenance. If compatibility problems appear, resolve them with your host rather than leaving the site on an exposed runtime.
5. Keep firewall protection enabled
A web application firewall can block known attack patterns. Cloudflare has deployed protections for PHP2Shell.
However, a firewall is an extra layer. It does not replace the PHP fix, and coverage can depend on configuration. 7
6. Review possible signs of a break-in
If your website remained exposed, ask the host to review relevant logs and suspicious activity.
Check unexpected administrator accounts, changed files, unusual redirects, and unexplained scheduled tasks. These checks are useful, but a clean-looking homepage does not prove the site is safe.
The UK’s NCSC recommends checking for compromise and backdoors where appropriate. A patch does not remove access that an attacker already established. 8
What about the third PHP vulnerability?
PHP disclosed a related issue, CVE-2026-115560, on 23 October.
It involves session upload progress and an unusual combination of settings and application behaviour. PHP recommended disabling session.upload_progress.enabled while awaiting the relevant update. Applications that never change the session serialisation handler at runtime can keep the feature enabled, according to PHP. 6
Ask your hosting provider to assess this setting. Do not assume that changing a setting in WordPress will protect every PHP request.
Common questions
Can a fully updated WordPress website still be affected?
Yes. WordPress and PHP are separate software. The PHP runtime needs its own security update. 7
Does HTTPS stop PHP2Shell?
HTTPS encrypts traffic between visitors and your site. It does not repair a PHP memory flaw. You need both secure connections and patched software.
Is PHP-FPM automatically safe?
No. Some attack paths differ from Apache mod_php, but PHP’s advisories describe conditions affecting FPM too. Do not use the runtime type as a reason to skip patching. 23
Should I take my website offline?
First establish whether it is patched. If it remains vulnerable and cannot be promptly protected, discuss temporary isolation with the provider. The UK NCSC advises considering taking systems offline when updates or temporary mitigations cannot be applied. 8
What to do today
Check your live PHP version. Get clear patch confirmation from your host. Apply the update, test the website, and review any period of exposure.
You do not need to understand memory management to take the right action. You need evidence that the PHP software serving your website contains the security fixes.
Sources
- Wiz: PHP2Shell research
- PHP: RCE via out-of-memory corruption
- PHP: RCE via stale global state
- AWS: PHP web runtime security bulletin
- CISA: Both PHP vulnerabilities added to KEV
- PHP: Official October 2026 announcements
- Cloudflare: PHP2Shell protection guidance
- UK NCSC: Critical security issue affecting PHP
More from TechDrivenz
Explore our guide to the technologies shaping the future of internet connectivity.
