Security Brief: PHP2Shell Flaws Allow Remote Code Execution; Update PHP, Not WordPress
https://vulnify.app/blog/security-brief-cve-2026-109618-cve-2026-109619-php2shell

PHP2Shell (CVE-2026-109618, CVE-2026-109619) sits in PHP itself, so updating WordPress or plugins does not fix it. Update PHP and restart PHP workers, or ask your host.

PHP2Shell is a pair of critical flaws in the PHP runtime itself, CVE-2026-109618 and CVE-2026-109619, that can let an attacker with no account run code on a web server. Updating WordPress, Joomla or your plugins does not fix it. Update PHP to a fixed release and restart your PHP workers, or ask your host to do it. What happened The flaws are in how PHP cleans up memory when a request stops partway, for example when it runs out of memory or hits a fatal error, according to Cloudflare. A crafted HTTP request can then crash PHP, leak memory that may hold passwords and keys, or run code. PHP says every installation serving web requests is at risk, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php the highest risk. PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026, and rates both flaws 9.2 on CVSS v4.0. PHP 8.1 and older no longer get updates from the PHP project, though its security team published minimal source backports for 7.4, 8.0 and 8.1. On October 23, PHP published a separate advisory for a related, still-unfixed issue that needs an unusual configuration. CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26, 2026. That day, BleepingComputer reported confirmed code execution on honeypots run by Adel Karimi of Perplexity, running PHP 8.4.26 under Apache mod_php, a setup he calls intentionally favorable. SecurityWeek reports that a China-linked group rooted at least 25 Palo Alto Networks firewalls by chaining PHP2Shell with a Linux kernel bug, which Palo Alto confirmed. WordPress sites have fared better so far. Defiant told SecurityWeek that as of October 28 it knew of no WordPress site compromised through PHP2Shell, despite more than 77,000 related requests from over 2,000 IP addresses. It warns that attackers are still changing their tools. Why it matters for website owners The bug lives below your CMS, so a clean, fully updated WordPress or Joomla site can still be exposed. On shared or managed hosting, PHP is usually your host's job, so confirm the version rather than assume it. Distribution packages can carry the fix under an old-looking version number, so check the package changelog for the CVE IDs, as Debian advises (via The Hacker News). What to check on your site Update PHP. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor package that lists both CVE IDs. Then restart Apache, PHP-FPM and any long-running PHP workers. If your host manages PHP, ask them to confirm. Leave unsupported branches. On PHP 8.1 or older, move to a supported branch or a vendor backport. CISA says systems that cannot be updated should go offline until they are. Use stopgaps only as stopgaps. If you cannot update today, PHP lists partial measures: set memory_limit=-1 so applications cannot override it, keep post_max_size low, and set session.upload_progress.enabled=0 in php.ini or the FPM pool, then restart every worker. These do not make a server safe. CISA says a web application firewall may help until you patch. Review your logs. Researchers suggest watching for unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, oddly large PHPSESSID cookies, and unexplained PHP worker restarts (via The Hacker News). CISA adds PHP workers launching shells or downloading tools. See what your stack reveals. Technology Fingerprint shows what your headers and markup reveal, including any advertised PHP version. A hidden version does not mean you are patched, so confirm the version on the server. Check for public compromise signs. The Site Compromise Checker looks for public signs of compromise. It cannot rule out a server-side compromise, so pair it with the log review. Related reading Terminal List for Website Security Post-Incident Website Validation A 20-Minute Website Security Triage Sources PHP: Critical RCE security advisory (Oct 21, 2026) CISA: Critical Vulnerabilities in PHP (Oct 21, 2026) Cloudflare: php2shell protections (Oct 21, 2026) The Hacker News: PHP emergency patches (Oct 21, 2026) BleepingComputer: PHP2Shell exploited in the wild (Oct 26, 2026) SecurityWeek: PHP2Shell roots Palo Alto firewalls (Oct 30, 2026)