On 21 October the team behind PHP released emergency fixes for two serious security flaws. Together they are called PHP2Shell. They let an attacker run code on a web server without logging in, and attackers have already started trying.
If your website runs on PHP, which includes WordPress, this is worth five minutes today.
What PHP2Shell is
Both flaws are remote code execution bugs that need no login. They share one root cause: PHP can leave its memory corrupted when a web request ends abnormally.
- CVE-2026-109618 can give an attacker code execution with the rights of the web worker account, through a chain of weaknesses that start with running out of memory.
- CVE-2026-109619 abuses stale global state, allowing a heap “use-after-free” (reading or writing memory that has already been released), memory disclosure and code execution.
Both are rated 9.2 out of 10, critical, on the CVSS 4.0 scale. The PHP team says the risk is highest on Apache with mod_php, where a demonstrated exploit uses a single unauthenticated request, before any of your own code runs.
What is affected
Every PHP install that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. BleepingComputer cites an estimate of more than 5.1 million PHP hosts exposed online, about 3.8 million of them with at least one open port.
Cloudflare says it has seen early attack attempts, even with its firewall rules in place. Those rules are temporary. The UK’s National Cyber Security Centre has told organisations to update immediately or take systems offline.
What to do
Update PHP to a fixed version: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The developers say no mitigation fully blocks the attacks.
For a WordPress site, the fix is in PHP itself, not in WordPress or its plugins. Our reading, and a point Vercel’s advisory also makes in coverage we saw but did not open: updating WordPress or a plugin does not replace the PHP update.
1. Find your PHP version. In WordPress, go to Tools, then Site Health, then Info, then Server. Your host’s control panel also shows it. 2. Check it against the list above. If it is lower, or not on those branches, ask your host or switch the version in the panel. 3. On managed or shared hosting, the host usually applies the fix. Ask them to confirm in writing that your site is patched.
If you are on an older PHP
PHP 8.1 and earlier no longer get updates from the project. Linux distributions and long-term-support vendors may ship their own backports, so ask yours. For people who build PHP from source, the team published minimal backports for 7.4, 8.0 and 8.1. BleepingComputer says anyone on PHP 7 or earlier should move to a fixed release.
If you cannot update straight away
The PHP team lists temporary measures for administrators:
- For CVE-2026-109618, set memory_limit to -1 in a way the application cannot override (for example with php_admin_value), set a low post_max_size (8M without uploads, 32M with uploads) and use container or cgroup limits.
- For CVE-2026-109619, set session.upload_progress.enabled to 0 and restart all workers. On PHP 8.5, set fatal_error_backtraces to 0. Remove invalid or obsolete per-request settings, and fix fatal errors and timeouts an attacker can reach.
- Hiding errors with error_reporting, display_errors or the @ operator does not help.
These reduce risk. They are not a substitute for the update.
For another recent case with practical steps, see the OpenCode breach, and for how access to live systems can go wrong, AI agents that reached live systems without authorisation.
What we could not confirm
We did not open the php.net announcement itself. BleepingComputer gives no WordPress-specific details, and we do not know which hosting companies have already patched. We have not tested any of the mitigations.
Leave a Reply