PHP2Shell Vulnerability: PHP Security Update (2026)

If you run a WordPress site, a WooCommerce store or any custom PHP app, the week of 21 October 2026 was one to pay attention to. The PHP team shipped an emergency PHP security update in October 2026 to fix the PHP2Shell vulnerability, a pair of critical bugs that can let an attacker run code on your server without logging in. If you heard people talking about “the October 21 PHP bugs”, this is what they meant.

We know most site owners don’t read php.net for fun. You just want to know whether your site is at risk and what to do about it. So we’ve pulled the facts straight from the official PHP advisory and the CISA alert, and turned them into a plain, step by step plan.

Below you’ll find what happened, which PHP versions are affected, how to check the version your site runs, and how to update without breaking anything.

What Happened on 21 October 2026?

On 20 October 2026, the PHP security team posted an advance warning on php.net about an upcoming critical release, scheduled for Wednesday 21 October at 14:00 UTC. They said it would fix two critical vulnerabilities, both rated CVSS v4.0 9.2. That kind of advance notice is unusual, and it’s a big part of why the story spread so fast.

The next day the team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, along with a security advisory titled “Critical remote code execution vulnerabilities, update now”. In PHP’s own words, the fixes address “two critical vulnerabilities that can allow unauthenticated remote code execution”. You can read the full notice in the official PHP news archive.

The US Cybersecurity and Infrastructure Security Agency (CISA) followed with an alert the same day, calling the pair “php2shell” and urging organisations to patch immediately. On 26 October 2026, CISA added both CVEs to its Known Exploited Vulnerabilities catalogue, according to the updated CISA alert. That means this isn’t just a theoretical risk any more.

The PHP2Shell Vulnerability Explained in Plain English

There are two separate bugs behind the PHP2Shell name. Both live deep inside the PHP engine, not in WordPress or in any plugin, which is why they affect almost everyone.

CVE-2026-109618: RCE via OOM corruption. When PHP runs out of memory at exactly the wrong moment, it can stop while some internal request data is only half set up. The cleanup code may then treat that broken data as valid. An attacker who can trigger that situation can turn it into code execution. The GitHub advisory ID is GHSA-w8hw-w9fx-j79w.

CVE-2026-109619: RCE via stale global state. Some internal data that belongs to one request can survive after its memory has been freed. A later request handled by the same PHP worker may then use that stale data before it is reset. The GitHub advisory ID is GHSA-6wmf-4rv5-p3rp.

The scary part is the word “unauthenticated”. PHP says it has a demonstrated exploit for Apache with mod_php “where an unauthenticated request can trigger the attack before any application code runs”. In other words, your login page, your security plugin and your strong passwords don’t come into play. The request hits PHP itself.

Which PHP Versions Are Affected?

According to the PHP advisory, the risk covers all PHP installations serving web requests. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP considers mod_php the highest risk setup.

Here are the fixed versions for each supported branch:

If your site still runs PHP 8.1, 8.0 or 7.4, this is the moment to move. The PHP project no longer ships updates for those branches. The security team did publish minimal source backports for 7.4, 8.0 and 8.1 because of how serious this is, but those are meant for people who compile PHP themselves. On shared hosting, that isn’t you.

PHP 8.6 is still in testing, and RC4 (released on the same day) also includes the fixes. Nobody should run a release candidate on a live site anyway.

How Serious Is the Risk for Your Website?

Very. Remote code execution means an attacker could run their own commands on your server. On a typical WordPress site, that can lead to injected spam links, hidden admin users, stolen customer data, redirects to scam pages, or your server being used to attack others.

CISA’s advice is blunt. Organisations that can’t update immediately, or that still run PHP 8.1 or earlier, “should take PHP-based systems offline until they can be patched or updated”. It also says a web application firewall “may provide some protection” in the meantime, and recommends watching for PHP worker processes launching shells or downloading tools.

The good news is that the fix is a normal PHP version update. Linux distributions and LTS vendors got the patches in advance, so many hosts were able to roll them out quickly. Your job is to confirm that yours did.

How to Check Your PHP Version

You don’t need to be technical for this. Pick whichever method is easiest for you.

Option 1: WordPress Site Health

Log in to your WordPress dashboard and go to Tools, then Site Health, then the Info tab. Open the Server section and look for “PHP version”. It shows the full number, such as 8.3.36. If the last part is lower than the safe version in the table above, you’re not patched yet.

Option 2: Your hosting control panel

In cPanel, look for “Select PHP Version” or “MultiPHP Manager”. In Plesk, open your domain and check “PHP Settings”. Most managed WordPress hosts also show the PHP version on the site overview screen. Keep in mind that these panels often show only the branch (like 8.3), not the exact patch number, so Site Health is the more reliable check.

Option 3: Ask your host

Send a short support ticket: “Has my server been updated to a PHP build that fixes CVE-2026-109618 and CVE-2026-109619?” A good host will answer in minutes. If they can’t tell you, that tells you something too. Our guide on how to choose WordPress hosting covers what to look for in a host that takes security seriously.

How to Update PHP Safely

A patch release inside the same branch (say 8.3.35 to 8.3.36) is low risk, because it only contains fixes. Jumping between branches (say 8.1 to 8.3) is where things can break. Either way, follow these steps.

Back up first. Take a full backup of your files and database, and store a copy off the server. If anything goes wrong, you can roll back in minutes instead of hours.

Use staging for branch upgrades. If your host offers a staging site, clone your site there, switch it to the new PHP branch, and click through the important pages: home, contact form, checkout, login. This is where outdated plugins usually show themselves.

Check plugin and theme compatibility. Update WordPress core, your theme and every plugin before you change PHP. Abandoned plugins that haven’t been updated in years are the most common cause of trouble after a PHP upgrade.

Switch and test. Change the PHP version in your panel, clear every cache (plugin, host and CDN), and test again. Keep an eye on your error log for the first day.

Know your way back. If you see a blank page after switching, don’t panic. Our walkthrough on how to fix the WordPress white screen of death covers the usual causes and fixes.

What WordPress Users Should Do Right Now

WordPress itself wasn’t the source of these bugs, but WordPress runs on PHP, so every WordPress site is in scope until its PHP build is patched. Here’s what we recommend for WordPress owners specifically:

• Confirm the exact PHP version in Site Health, not just the branch.
• Update core, themes and plugins so a PHP change won’t trip over old code.
• Turn on your firewall (host level or a security plugin with a WAF) as an extra layer, not a replacement for patching.
• Review admin users and remove any accounts you don’t recognise.
• Scan for changed files with your security plugin or ask your host for a malware scan.

If you’d rather have someone keep an eye on all of this for you, our WordPress website maintenance guide explains what a good monthly routine looks like.

PHP Security Update October 2026: Temporary Safeguards

PHP is clear that updating is the only complete fix. But if you manage your own server and can’t update today, the advisory lists measures that reduce exposure. These are for developers or sysadmins, so pass them on if that isn’t you.

For CVE-2026-109619. Set session.upload_progress.enabled=0 in php.ini, the FPM pool or server configuration, then restart every worker. PHP warns not to rely on ini_set() or a .user.ini file for this. On PHP 8.5, also set fatal_error_backtraces=0.

For CVE-2026-109618. PHP suggests setting memory_limit=-1 in a way apps can’t override, keeping post_max_size low (8M if you don’t need uploads, 32M if you do), and using a container or cgroup memory limit as a boundary.

Here’s what the session setting looks like in php.ini:

; Extra safeguard recommended in the PHP advisory
session.upload_progress.enabled = 0

There’s one more reason to keep that line. On 23 October 2026, PHP published an informational advisory about a third issue, CVE-2026-115560. It only affects an unusual setup where an app switches session.serialize_handler at runtime, and it will be fixed in the next regular release. PHP’s advice is the same: keep session.upload_progress.enabled=0 in place. On 26 October, PHP also released updated Windows builds (marked with a “-1” suffix) to fix a separate Brotli bug, CVE-2026-111497, which matters only if you run PHP on Windows.

Conclusion

The PHP2Shell vulnerability is one of the most serious PHP issues in years: two unauthenticated remote code execution bugs, a rare advance warning, and confirmation from CISA that they’re being exploited.

The fix is simple, though. Check your exact PHP version, make sure it’s 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer, back up before you change anything, and move off PHP 8.1 or older as soon as you can.

Five minutes of checking today beats a week of cleanup tomorrow.

FAQ’s

Q1: What is the PHP2Shell vulnerability? PHP2Shell is the name used for two critical PHP bugs, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. Both can allow unauthenticated remote code execution, which means an attacker could run code on your server without logging in.

Q2: Which PHP versions fix PHP2Shell? PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the fixes. Any later release in those branches is also safe. PHP 8.1 and older get no official release, so you should upgrade to a supported branch.

Q3: Is my WordPress site affected? If your server runs an unpatched PHP build and serves web requests, yes. The bugs are in PHP itself, not WordPress, so every WordPress site depends on its host applying the patched PHP version.

Q4: How do I check my PHP version in WordPress? Go to Tools, then Site Health, then the Info tab, and open the Server section. The “PHP version” line shows the exact number you are running.

Q5: Will updating PHP break my website? A patch update within the same branch rarely breaks anything because it only contains fixes. Moving to a newer branch can expose outdated plugins or themes, so take a backup and test on staging first.

Q6: Is a security plugin or firewall enough to protect me? No. CISA says a web application firewall may provide some protection, and PHP says the available mitigations reduce exposure but do not make an installation safe. Updating PHP is the only complete fix.