On October 21, 2026, the PHP project released emergency security updates for two critical vulnerabilities, nicknamed PHP2Shell by the researchers at Wiz who found them. They're tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated critical (CVSS 9.2).
The short version for WordPress site owners: the problem is in PHP itself, not in WordPress or your plugins, so keeping WordPress updated doesn't protect you on its own. What matters is which version of PHP your server runs.
What happened
PHP is the language WordPress runs on. The two flaws are memory-safety bugs in the core PHP engine:
- CVE-2026-109618: an out-of-memory error can interrupt PHP while request data is only partly set up, and the clean-up step then trusts that broken data.
- CVE-2026-109619: internal data from one request can survive after its memory is freed, and a later request on the same worker can use that stale data.
According to the advisories, these can lead to remote code execution without logging in and to leaks of server memory. In plain terms, an attacker could run their own code on your server.
Wiz reports that they demonstrated the attack against a standard, up-to-date WordPress install during their research. The vulnerable code is in PHP, so WordPress was simply a representative target. Other PHP applications are exposed in the same way.
Who is affected
Every PHP version from 5.4 through 8.5.11 is affected by at least one of the two flaws.
The fixed versions are:
| PHP branch | Update to |
|---|---|
| 8.5 | 8.5.12 or later |
| 8.4 | 8.4.27 or later |
| 8.3 | 8.3.36 or later |
| 8.2 | 8.2.35 or later |
| 8.1 and older | No fix. These versions are end of life, so you need to upgrade to a supported branch |
Step 1: Check which PHP version your site runs
In your WordPress dashboard, go to Tools > Site Health > Info, open the Server section, and look at PHP version.
You can also find it in your hosting control panel, usually under a "PHP version" or "PHP settings" page.
Step 2: Update PHP
If you're on managed WordPress hosting, your host may already have patched PHP for you. Check their status page or ask support directly: "Has my server been updated to a PHP release that fixes CVE-2026-109618 and CVE-2026-109619?" Get a clear yes, not a general "we take security seriously".
If you manage your own server or VPS, install the patched PHP release from your operating system's packages or your PHP source, then restart PHP-FPM or your web server so the new version is actually running.
If you're on PHP 8.1 or older, there is no patch for your version. You need to move to a supported branch. PHP 8.2 itself reaches end of life on December 31, 2026, so if you're upgrading anyway, aim for 8.3 or 8.4 to avoid doing this twice.
Step 3: Test before and after a big PHP jump
Moving from an old PHP version to a new one can break outdated themes or plugins. To keep the site up:
- Take a full backup of files and database.
- If your host offers a staging site, switch PHP there first and click through your key pages, forms, and checkout.
- Update WordPress, your theme, and plugins before switching PHP. Newer versions are usually compatible.
- Switch the live site, then check the homepage, a form, and the admin area straight away.
Don't let compatibility worries delay the update for long. A site that's vulnerable to unauthenticated code execution is a bigger risk than a plugin that needs replacing.
Step 4: Add a safety net while you update
If you can't update today, a web application firewall can buy time. Wiz notes that providers including Cloudflare, Fastly, and Vercel offer mitigations for these flaws. If your site is behind one of them, check that the relevant protections are turned on.
Treat this as temporary. Updating PHP is the only complete fix.
Step 5: Look for warning signs
Wiz suggests watching server logs for:
- Unusual multipart (file upload) requests followed by memory-limit errors or repeated 500 errors
- Unusually large or malformed
PHPSESSIDcookies - PHP worker processes restarting more often than usual for no clear reason
If you see these, or anything else that looks wrong, such as new admin users, files you didn't add, or unexpected redirects, treat the site as possibly compromised. Restore from a clean backup taken before the problem started, change all passwords, and update PHP before bringing the site back.
The bigger lesson: who's watching your server?
Most WordPress security advice focuses on plugins and passwords, and those still matter. PHP2Shell is a reminder that the layer underneath needs looking after too. A quick checklist for any business site:
- Know which PHP version you run, and stay on a supported branch
- Keep WordPress, themes, and plugins updated, and delete what you don't use
- Use strong, unique passwords and two-factor authentication for admin accounts
- Keep automatic, off-site backups, and test that they restore
- Put the site behind a firewall or CDN with security rules
- Have someone responsible for checking advisories when news like this breaks
If you're not sure which PHP version your site runs, or you'd like help testing and updating it safely, get in touch. It's exactly the kind of maintenance work I do.
Sources
- PHP: release announcements for 8.5.12, 8.4.27, 8.3.36 and 8.2.35
- Google Cloud: Responding to critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
- Wiz Research: PHP2Shell, critical PHP remote code execution vulnerabilities
- WIRED: This Is Not a Drill: 2 PHP Vulnerabilities Are Setting the Internet on Fire
