Prepared: October 24, 2026

Two critical vulnerabilities in PHP can let a remote attacker run code on a vulnerable web server without logging in. CISA is urging organizations to patch immediately. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, are being referred to as “PHP2Shell.” The PHP maintainers rated both critical, with CVSS 9.2.

This affects more than teams that develop PHP applications. PHP is the runtime underneath many websites and content management systems, including WordPress. Updating WordPress core, themes, or plugins does not patch the PHP runtime provided by your web host.

Which PHP versions contain the fixes?

The PHP project released patched versions on October 21: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Move to the fixed release for your supported branch, or to a newer supported branch. Hosting providers and Linux distributions may package or backport security fixes differently, so confirm that the package your provider supplies includes these fixes.

The two issues involve memory corruption during out-of-memory handling and stale request state in PHP workers. The official advisories describe conditions that can lead to remote code execution. PHP says updating is the only complete mitigation; configuration changes and a web application firewall are not substitutes for the fixed release.

What website owners should do

• Check the PHP runtime actually serving the site. For WordPress, review the server details in Tools → Site Health → Info, and compare that with the version selected in your hosting panel. Check staging sites and other applications on the same account too.
• Upgrade through your host or package manager. On shared hosting, use the PHP version selector or ask the provider to confirm the active runtime is patched. A version label alone may not show whether a vendor has backported the fix.
• Verify the change took effect. Recheck the live runtime after the upgrade and follow the host’s process for restarting PHP workers or services if required.
• Do not leave unsupported PHP branches exposed. PHP 8.1 and earlier no longer receive upstream fixes. CISA advises taking PHP-based systems offline if they cannot be updated promptly.
• Review server telemetry. CISA recommends watching for unusual PHP worker behavior, including workers launching shell processes or downloading tools. If you suspect compromise, investigate the host; patching alone does not establish that an attacker was never present.

CISA’s alert was updated October 23 with additional detection guidance. For site owners, the immediate priority remains the same: identify the PHP runtime, install a fixed or vendor-confirmed patched build, and verify that the public site is using it.

Primary sources

• CISA: Critical Vulnerabilities in PHP Require Immediate Patching
• PHP project security advisory and fixed releases
• PHP advisory: RCE via out-of-memory corruption
• PHP advisory: RCE via stale global state
• CERT/CC vulnerability note and interim mitigations