PHP2Shell: Two Critical PHP Flaws Every Site Owner Should Check
Your dashboard can look fully updated while the PHP underneath is still open to attack.
PHP shipped security releases on October 21 to fix two critical flaws that let an attacker run code on your server without logging in, WordPress.com said that day. Your host has to update PHP on your server.
Running WordPress?
Then no plugin or core update will fix it for you. The same goes for Drupal and Joomla, which researchers have shown can be fully taken over, according to MalCare.
What PHP fixed
MalCare names the bugs CVE-2026-109618 and CVE-2026-109619. It says the PHP security team rates both as critical, with a CVSS v4.0 score of 9.2.
One bug is triggered when a request makes PHP run out of memory, which can leave its internal request data only partly set up.
The other lets internal state from one request survive after its memory is freed, so a later request on the same worker can reuse it.
Here are the fixed versions, as MalCare and Astra list them:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
MalCare says every common hosting setup is in scope, so it doesn’t matter which one your host picked for you:
- PHP-FPM
- php-cgi
- Apache’s mod_php
- LiteSpeed
On any of these setups, the attack fires while PHP is still reading the incoming request, before WordPress or any plugin has loaded.
Are attackers already using it?
MalCare says yes.
MalCare says Cloudflare and several hosting companies were reporting attacks by the morning of October 21. A public exploit tool is available, and MalCare expects attacks to grow quickly.
WordPress.org News says these issues are not specific to WordPress and affect any server that hosts a PHP application. No WordPress update is required or planned.
So where do you look? WordPress shows your PHP version under Tools > Site Health > Info > Server.
PHP versions before 8.2 no longer receive security updates from the PHP project, so an older branch has no official fix.
Can’t update yet? MalCare says your host can apply PHP’s interim mitigations, such as turning off session.upload_progress.enabled.
These reduce exposure but do not make the site safe, since the only fix is a PHP update.
Two days later, on October 23, PHP disclosed another code execution bug, CVE-2026-115560, according to Astra.
Astra says the fix is queued for the next routine release, and the mitigation is session.upload_progress.enabled=0.
Why it matters
Most of you never touch PHP yourselves, and that’s exactly where this one bites, because the job sits with a host you may not have emailed in a year or two.
Auto-updates won’t help here. I’d email your host today and ask for three things:
- confirmation that PHP on your server is patched for both CVEs
- the PHP version each of your sites runs
- a date to move you off 8.1 or 8.2
Your dashboard can look green while the server runs an older 8.3 release. Only your host sees the real state.
That said, a version number alone won’t settle it.
MalCare says some Linux distributions and long-term-support vendors patch older packages without changing the main version number, so get the answer in writing.
Still on PHP 8.1 or older? Then the upgrade you’ve been putting off just got urgent.
Of course, 8.2 isn’t the finish line either. PHP’s supported-versions page lists security support for 8.2 ending on 31 December 2026.
Ask your host to move PHP on your server to 8.3 or newer, which gets security support until 31 December 2027.
Common Questions
Does a WordPress update fix the PHP2Shell vulnerabilities?
No. WordPress.org says the flaws are not specific to WordPress, and no WordPress update is required or planned. Your host has to update PHP on your server to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and if you run your own server, WordPress.com’s advice is to update now.
Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both, and Astra lists them as patched on October 21. PHP versions before 8.2 get no security updates from the PHP project, though some Linux distributions and long-term-support vendors patch older packages without changing the main version number.
How do I check which PHP version my WordPress site runs?
Open Tools, then Site Health, then Info, and look at the Server section, which shows your PHP version. If it isn’t 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer, ask your host whether PHP on your server is patched for both CVEs.
