PHP2Shell: What the Critical PHP Vulnerability Means for Your Website

On October 21, the PHP project shipped emergency patches for two critical security flaws, released a day early because the details had already leaked. Together they're being called PHP2Shell, and they allow an attacker to run code on a vulnerable web server without logging in to anything. Exploitation attempts were observed before the flaws were even public.

If your website runs WordPress, Drupal, Joomla, or Magento, it runs PHP, and this applies to you. Here is what happened, how to find out if you're exposed, what to do today, and why this class of emergency keeps happening to PHP websites when it doesn't have to.

Quick answer: PHP2Shell is the name for two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2) patched on October 21, 2026. They allow unauthenticated remote code execution on web servers running PHP, with affected code dating back to PHP 5.4. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; older branches get partial fixes or none. Every WordPress site runs PHP.

What happened

Two bugs in PHP itself, not in any plugin or theme: one a memory-corruption flaw (CVE-2026-109618), the other a use-after-free that can also leak server memory (CVE-2026-109619). The PHP Foundation rates both 9.2 on CVSS v4.0. The release was scheduled for October 22 and pulled forward a day after the CVE details leaked, along with an exaggerated 10.0 severity score that PHP has corrected.

The exploitation window didn't wait for the announcement. Amazon's threat-intelligence honeypots recorded an exploitation attempt on October 17, four days before disclosure, and both Amazon and Cloudflare now report attack attempts in the wild. Public exploit code is circulating.

That last row matters more than it looks: hundreds of thousands of end-of-life PHP hosts can never be patched against this. If your site is on one of them, the only fix is moving.

Is your website exposed?

You don't have to know what PHP is to be running it. PHP is the language behind WordPress, Drupal, Joomla, Magento, and most "custom" sites built in the 2010s. WordPress alone powers about 43% of all websites, and roughly three-quarters of sites with a known server-side language run PHP (W3Techs).

Five ways to tell:

• Your site runs WordPress, Drupal, Joomla, or Magento: you run PHP.
• Your site has a /wp-admin or /administrator login page: you run PHP.
• Your agency built it "custom" before about 2020 and you're not sure in what: probably PHP; ask.
• Your host runs Apache with mod_php: the highest-risk configuration; PHP demonstrated an exploit that triggers by unauthenticated request before your site's own code even runs.
• Your PHP version starts with 5, 6, or 7.0–7.3: no patch exists for you.

The practical test is one email to your host or agency: "What PHP version are we running, and has it been patched for PHP2Shell?" A good host answers with a version number and a date this week. A vague answer is itself the finding.

What to do today

Patch first, decide later. In order:

1. Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. On managed WordPress hosting, confirm your host has done it; the good ones already have.
2. Can't update immediately? PHP published interim settings that reduce exposure without making you safe: set memory_limit so applications cannot override it, disable session.upload_progress, and restart every PHP worker after the change. A WAF in front of the site is a stopgap, not a fix.
3. Update WordPress core and plugins too. It is unrelated to PHP2Shell, but the same attackers scan for everything at once. Our best practices to protect your WordPress website covers the routine.
4. On an end-of-life PHP branch? Treat the site as exposed from today onward and start planning its replacement. There is no patch coming.

The part no advisory says out loud: this will happen again

PHP2Shell is unusual only in being in PHP's core. The surrounding weather is constant. Patchstack's 2026 State of WordPress Security report counted 11,334 new WordPress-ecosystem vulnerabilities in 2025, up 42% in a year, with more than nine in ten found in plugins. Disclosure-to-mass-exploitation now has a median measured in hours, and nearly half the disclosed flaws need no login to exploit.

This is the maintenance treadmill every PHP site owner is on: monitor, patch, hope the window was short enough, repeat. Each patch is necessary. None of them makes next month's disclosure less likely, and the plugins you added for speed and features widen the target, the same dynamic covered in why WordPress sites struggle to stay fast.

The structural fix: remove the attack surface instead of guarding it

A traditional PHP website executes code to answer every visitor. That means three standing doors on your public domain: a language runtime that executes on every request, a database connected to it, and an admin login (/wp-admin) reachable by anyone. PHP2Shell was a flaw in the first door. Most WordPress hacks come through the plugins behind it. Credential stuffing goes after the third.

The custom website design and development work we do closes all three by not shipping them. Pages are pre-rendered to plain HTML and served from a CDN. When a visitor requests a page, the server hands back a file; no code executes, so there is no code to exploit. There is no database on the request path and no admin login anywhere on your domain: content editing happens in a separate, managed CMS behind its own authentication, and publishing regenerates the files.

A PHP2Shell-class vulnerability cannot touch a site built this way, whatever next year's version of it turns out to be. Not because the stack is patched faster — because the thing the exploit needs to run inside doesn't exist.

What a static build doesn't fix

Honesty requires this section. No website is unhackable. A static architecture still depends on your domain registrar and DNS account, your hosting account's credentials, the third-party scripts you choose to embed, and the CMS vendor's own security. Those doors are fewer, smaller, and mostly not on your domain, and none of them is patched on your schedule at 2 a.m. That is the realistic claim: not zero risk, but an attack surface reduced to a fraction of what a PHP site carries, with the emergency-patch treadmill gone entirely.

If this is your second PHP emergency

Most people reading PHP2Shell coverage own a WordPress site that was due for a rebuild anyway: slow, plugin-heavy, and now exposed twice in one news cycle. A rebuild is a smaller project than it sounds: most land between $3,000 and $10,000 one-time, and the pricing calculator gives a range in about 60 seconds. A redesign done without losing rankings covers the migration that protects your Google positions on the way over. Builds run from about 30 days.

Get off the treadmill

Patch today regardless; that part is urgent and free. Then decide whether you want to be reading the next one of these advisories as an affected party or as a spectator. Get a Build Estimate for a security-focused rebuild, or run the pricing calculator for a 60-second ballpark.