Yesterday, details of two critical PHP vulnerabilities leaked to the public. Today, the patches came out. Attacks have already started.
If your website runs on WordPress, WooCommerce, Joomla, Drupal or Magento, this affects you. PHP powers a large part of the web, and this flaw sits in the core of the language itself, not in a plugin or a theme.
What happened
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, together known as PHP2Shell. Both are rated 9.2 out of 10 for severity (CVSS v4.0).
The key point: an attacker does not need to log in. A single malicious request to your server can be enough to run their own code on it. On setups using mod_php, this can happen before your site’s code even starts running.
The PHP security team had planned the patches for October 22. When the vulnerability IDs leaked early on October 20, they moved the release up to October 21. Cloudflare and watchTowr are already reporting the first exploitation attempts. Researchers at Calif have confirmed the attack works against specific versions of WordPress, Drupal, Joomla and Magento.
Who is at risk
According to the PHP team, every PHP installation that serves web requests is at risk. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
Affected versions go all the way back to PHP 5.4. Fixes are available in these releases:
| PHP branch | Status |
|---|---|
| 8.5 | Fixed in 8.5.12 |
| 8.4 | Fixed in 8.4.27 |
| 8.3 | Fixed in 8.3.36 |
| 8.2 | Fixed in 8.2.35 |
| 7.4 to 8.1 | No official release, source code patches only |
| 5.4 to 7.3 | No fix |
Old sites are the most exposed. PHP 8.1 lost support at the end of 2025, PHP 7.4 back in 2022. If your site still runs on one of these versions and your host has not manually applied the patches, your site is open.
What to do today
Find out which PHP version you are running
In WordPress, you will find it under Tools → Site Health → Info → Server. Most hosting providers also show it in the control panel (cPanel, Plesk or their own dashboard). If you cannot find it, ask your host.
Ask your hosting provider whether the patch is installed
On shared hosting, PHP is updated by your provider, not by you. Larger hosts received the patches in advance and are rolling them out today. Do not assume it is handled, though. Send a short question: “Has PHP on my account been updated for CVE-2026-109618 and CVE-2026-109619?”
If you run your own server, update now
Install the patched version from your distribution’s packages and restart every PHP worker. The fix does not take effect while the old processes are still running.
If you cannot update right away, the PHP team lists temporary measures, such as session.upload_progress.enabled=0 for the second vulnerability. These reduce the risk, but they do not make the site safe. Updating is the only real fix.
Move to a supported version
If your site runs on PHP 8.1 or older, now is the time to move to 8.3 or newer. Check first that your theme and plugins are compatible, and do the upgrade on a staging copy of the site, not on the live one.
How to stay careful when news like this breaks
Every major vulnerability brings the same mistakes. A few rules that apply next time too:
Do not download “test” code from the internet. Supposed exploit samples are already circulating, and nobody has verified them. The PHP team warns they may contain malware. Unless you are a security professional, do not run them.
Watch out for fake warnings. Attackers use panic. An email saying “your site is at risk, click here” is often the attack itself. Contact your hosting provider through their official website, not through a link in a message.
Check whether it is already too late. Signs of a breach include new admin accounts you did not create, unknown files on the server, redirects to foreign sites and sudden warnings from Google. If you notice any of these, updating is not enough. The site needs to be cleaned.
Keep a backup that is not on the same server. If an attacker takes over the server, they take over the backups on it too. Your backup needs to live elsewhere, and it needs to be tested.
A firewall helps, but it does not solve the problem. Cloudflare has already added rules that block known forms of the attack, including on the free plan. That is a good first line of defence, but only for traffic routed through Cloudflare and only for known attack variants.
The lesson beyond this week
PHP2Shell will not be the last vulnerability. Researchers expect a long tail of unmaintained sites that will never be updated. Those will remain targets for months.
Most breaches are not the work of brilliant attackers. They happen to sites nobody is responsible for. The site was built five years ago, the agency is gone, the logins are with a former employee and PHP is still on a version from 2020.
So ask yourself two questions. Who takes care of updates on your site? And how many parts of your site are exposed? Every plugin, every PHP version and every database is another part that needs maintenance.
Static sites, like the ones we build with Astro and host on Cloudflare, do not run PHP on the server at all. On those sites, vulnerabilities like PHP2Shell have nothing to attack. That is no reason to throw away every site, but it is a reason to ask, at your next redesign, whether your company website really needs a server that has to be patched.
How we can help
If you are not sure whether your site is at risk, get in touch. At WebZone we can:
- check your PHP version and the state of your site, and tell you whether action is needed,
- update PHP, your theme and plugins on a staging copy first, then safely on the live site,
- look for signs of a breach and clean up the site if one has already happened,
- take over regular maintenance, so you do not learn about security updates from the news,
- plan a move to a static site, where it makes sense.
Contact us today. With a vulnerability that is already being exploited, every day counts.