On 21 October 2026 the PHP project released emergency security updates for two critical flaws that, between them, touch almost every website running on PHP, which includes WordPress and most of the web. The flaws have been nicknamed PHP2Shell. Our servers have been patched, so every site we host for you is protected and there is nothing you need to do.
What happened
Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, sit deep inside the PHP engine itself rather than in any plugin or theme. Both allow remote code execution: an attacker can run their own code on a web server without needing to log in. One involves PHP being interrupted when it runs out of memory, the other involves leftover internal state being reused by a later request. Both are rated critical (CVSS 9.2), and researchers describe them as among the most serious PHP flaws ever found. They are reported to have been in PHP for decades, and security researchers say AI tools made it far easier to build a working exploit.
This is not just a theory. Amazon’s threat intelligence team recorded an exploitation attempt on 17 October, four days before the public announcement.
Who is affected
Any server that runs PHP to serve web pages, whichever way it is set up, in PHP 8.2 to 8.5 and in older versions too. Because the weakness is in PHP itself, keeping WordPress, plugins and themes up to date does not close it. The server’s PHP has to be updated.
What we have done
We have applied the fixed PHP releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35, or the equivalent backport for the version your site runs) across the servers that host our customers’ websites. If your site is hosted with us you do not need to update anything, change any settings or contact us.
If you host elsewhere
- Ask your host whether the fixed PHP version has been applied.
- If you manage your own server, update PHP to the fixed release for your branch, restart PHP and your web server, and check the version afterwards. In WordPress you can see it under Tools > Site Health > Info > Server.
- PHP 8.1 and older no longer receive official fixes, so move to a supported version (8.2 or later) as soon as you can.
- A web application firewall can help as a temporary measure, but it is not a substitute for patching.
Questions? Open a ticket from your ModuleFest account and we will help.
Sources: Help Net Security, GoDaddy, Wiz.