Published on October 21, 2026 · The mitza.es team
On October 21, 2026, the PHP team released an emergency security update to fix two critical remote code execution vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and known as “PHP2Shell”. The UK's National Cyber Security Centre (NCSC) warned that they can allow an attacker to run commands on any web server that uses PHP. If you have a website on WordPress, PrestaShop, Joomla, Magento or any custom PHP development, this affects you.
What happened
On October 20, details of the two vulnerabilities leaked online ahead of coordinated disclosure, and the security firm watchTowr confirmed that the flaws were real. After the leak, the PHP team brought the release of the patches forward to Wednesday, October 21. On its site, php.net now shows a security notice about critical remote code execution vulnerabilities and urges users to update.
What the two flaws are, in plain language
- CVE-2026-109618: a memory corruption flaw that occurs when PHP runs out of memory while the internal data of a request is only partially prepared. The cleanup that follows treats that data as valid and, under certain conditions, it can be exploited.
- CVE-2026-109619: the internal state of a request can survive after its memory has been freed, and a later request served by the same process can end up using it before it is reset.
The PHP security team rates them 9.2 out of 10 on CVSS v4.0. According to the NCSC, the memory corruption would allow code to be executed without authentication. In other words, you don't need a password or a vulnerable plugin: the flaw is in the PHP engine itself.
Who is affected
The NCSC states that organizations using any version of PHP are affected, and older versions are the biggest concern. PHP points out that every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. According to Huntress, there is an exploit for mod_php in which a single unauthenticated request can trigger the attack before the application code even runs.
That includes WordPress, Drupal, Joomla, Magento, PrestaShop and any custom PHP development, because the flaw sits below all of them. Updating WordPress or its plugins doesn't fix it: you have to update PHP.
Fixed versions and what happens with the old ones
- PHP 8.5: version 8.5.12.
- PHP 8.4: version 8.4.27.
- PHP 8.3: version 8.3.36.
- PHP 8.2: version 8.2.35.
For 7.4, 8.0 and 8.1, the PHP team released only minimal source code fixes: these are branches without official support, so if you use one of them you should ask your provider or, better, move to a supported branch. Linux distributions and long-term support providers received the patches before the release, so it's worth checking their packages. On shared hosting, it's your host that has to apply them.
Is it already being exploited?
The sources don't agree, so the prudent assumption is that it is. Huntress said that, as of the morning of October 21, it had not observed active exploitation among its customers. However, Cloudflare's chief technology officer said they were seeing early attacks, watchTowr says it has reproduced one of the flaws, and public exploit code is circulating, although unverified. When a critical vulnerability goes public and an exploit exists, automated attack attempts usually start within hours.
What to do today: a checklist for a small business with a PHP website
- Find out your PHP version. It's in your hosting control panel and, in WordPress, under Tools, Site Health, Info tab, Server section.
- Ask your host whether it has already applied the patches, or update yourself to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 from the panel if it lets you. Ask for the answer in writing.
- Make a backup before changing anything and test the site afterwards: a version change can break older plugins. If you don't have a reliable backup system, see our business backup guide.
- If you use PHP 8.1 or earlier, plan the migration to a supported branch; in the meantime, don't leave that server exposed without additional protection.
- Consider a web application firewall (WAF). Cloudflare has deployed rules for the known attack vectors, available even on its free plan, but they only cover the traffic that passes through it and are a temporary stopgap, not a solution.
- Watch for signs of compromise: new or modified files in the web directory, unknown scheduled tasks, new users, or web server processes launching strange commands.
What about php.ini settings?
Some publications have suggested changing configuration settings as a stopgap. PHP's maintainers advise against it as a solution: according to Help Net Security, lead developer Gina Peter Banyard said the only mitigation is to patch or update PHP, and another maintainer ruled out that configuration settings would be enough. Use them, at most, as a last-minute measure while you update.
If you can't update today
The NCSC recommends taking an inventory of systems that run PHP, starting with those exposed to the internet, keeping an eye on vendors whose software includes PHP, and applying the temporary mitigations indicated by the PHP team. If that isn't possible, it advises considering taking the system offline until it can be mitigated and, if it can neither be updated nor taken offline, assessing it for signs of compromise. You can find the full NCSC advisory on its website.
Why this puts maintenance back on the table
Flaws like this are fixed the same way: someone has to find out, test and update quickly. Websites that nobody maintains are the ones that pay the price, as we saw with this summer's critical WordPress flaws and the plugins exploited in October. If you have nobody to take care of it, ongoing website maintenance or a website security audit will tell you what state your site is in before an attacker finds out.