Critical PHP Security Vulnerability 2026: CVE-2026-109618 and CVE-2026-109619 Explained

By Connect Digital World | Security Made Easy

Imagine your house has a very common type of front door lock. One day, locksmiths announce that a hidden flaw in that lock lets a stranger open it without a key. Worse, they say that bad guys have already started trying it on houses. The lock company quickly makes a fix, and everyone is told: change the lock today.

That is what is happening right now with PHP, the programming language that powers a huge part of the internet, including most WordPress websites. Two serious security holes, nicknamed PHP2Shell, were announced this week. If you run a website, this guide explains what happened in simple words and what you should do today.

Quick Summary: The News in 30 Seconds

• Two critical flaws in PHP are tracked as CVE-2026-109618 and CVE-2026-109619. Together they are called PHP2Shell.
• They can let an attacker run their own code on a web server, without needing a password.
• Both are rated 9.2 out of 10 for severity, which is “critical”.
• PHP released emergency fixes on October 21, 2026.
• Security companies say attackers began trying to exploit the flaws very quickly, after details leaked early.
• The PHP team says there is no complete workaround. Updating PHP is the safe choice.
• The US cyber agency CISA urged people to patch immediately.

What Is PHP? (Simple Explanation)

PHP is a programming language that runs on web servers. When you visit a website, PHP is often the helper working behind the scenes. It builds the page, talks to the database and handles things like logins and forms.

You may not see PHP, but you meet it every day. WordPress, one of the most popular website tools in the world, is written in PHP. So are many online shops, forums and business sites. That is why a serious PHP flaw is such big news.

What Is a Server?

A server is a powerful computer that stores a website and sends it to visitors. Your hosting company runs servers for your site. PHP runs on that server, not on your own computer.

What Is PHP2Shell?

PHP2Shell is the nickname for two different security holes in PHP. The word “shell” comes from computer language. A shell is a way to give commands to a computer. If an attacker gets a “shell” on a server, it is like getting the remote control for that server.

The official name for this kind of problem is remote code execution, or RCE. It means someone far away can make your server run their instructions. This is one of the most dangerous kinds of security flaws, because it can lead to a full website takeover.

The Two Flaws in Plain Words

• CVE-2026-109618: Reports describe this as a memory problem triggered when the server runs out of memory partway through a task. PHP is then left with messy, half-finished data, and its cleanup steps trip over it.
• CVE-2026-109619: Reports describe this as PHP keeping a pointer to data after that data was already thrown away, like a note pointing to a locker that has been emptied and given to someone else.

We are not going to explain how anyone could abuse these flaws. The important thing is that both are serious and both are fixed in the new PHP versions.

Why Is This So Serious?

1. No login needed. The reports describe these as unauthenticated, meaning the attacker does not need a username or password.
2. It affects lots of setups. Reports say it affects PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
3. It reaches back a long way. Reports say very old PHP versions, as far back as PHP 5.4, are affected too.
4. Attackers moved fast. Technical details leaked online before the official fix, and security firms reported exploitation attempts shortly after. That is why speed matters.
5. A hacked server can mean a hacked website. Attackers could steal data, hide malicious code, send spam or attack other sites.

Timeline: What Happened and When

Which PHP Versions Are Fixed?

The PHP team says the following versions contain the fix:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

If you use one of these branches, update to the latest number in your branch. If you use an older branch, such as PHP 8.1, 8.0, 7.x or 5.x, read the next section carefully.

What If I Use an Older PHP Version?

Official PHP fixes were announced for the four branches above. Older branches may no longer receive updates from the PHP project. Some Linux providers back-port fixes to older versions. One example in security reports is a Red Hat update for PHP 7.4. So:

• Ask your hosting company or server provider whether they have a patch for your version.
• Plan to move to a supported PHP version as soon as possible. It is the right move even without this news.
• Test your site first, because very old plugins and themes may not work with the newest PHP.

How to Check Your PHP Version

Method 1: WordPress Site Health (Easiest)

1. Log in to your WordPress dashboard.
2. Go to Tools → Site Health.
3. Click the Info tab.
4. Open the Server section and look for PHP version.

Remember, the version shown may be a number like 8.3.30. Compare it to the fixed numbers above.

Method 2: Your Hosting Control Panel

Most hosts (cPanel, Plesk, and others) have a page called PHP version, MultiPHP Manager or Select PHP Version. It shows the version for each site.

Method 3: The Command Line (For Server Owners)

If you manage your own server, type this command:

php -v

Note that a server can have more than one PHP version, and the one used by the website might be different from the one in the terminal. Check the version used by your web server too.

How to Update PHP: Step by Step

If You Use Shared or Managed Hosting

1. Back up your site first. Save both your files and your database.
2. Check your host’s announcements. Many hosts patch PHP for you. Look at their status page or email.
3. Open your hosting panel and look for the PHP version tool.
4. Choose a patched, supported version (for example, the newest 8.3 or 8.4 your host offers).
5. Visit your site and click through key pages, including checkout and contact forms.
6. Contact support if you cannot see a patched version or if you are not sure.

If You Run Your Own Server (VPS)

1. Back up your data.
2. Update PHP through your operating system’s package manager, or from the repository you normally use.
3. Restart PHP and your web server so the new version is really running.
4. Confirm the version again.
5. Check your error logs for problems.

If You Use Containers or Docker

Update the base image to the patched PHP version, rebuild your containers and redeploy. Old images keep running old PHP until they are replaced.

What About Mitigations and Workarounds?

The PHP team has said there are no complete mitigations, which means no simple setting that fully protects you, so updating is the only safe choice. Some security companies list temporary steps, but these may not stop every attack. Use them only as a short-term bandage, and never as a replacement for patching.

A web application firewall (WAF) can add an extra layer of protection by blocking suspicious requests. Many security vendors have been adding rules for PHP2Shell. That is helpful, but it is a seatbelt, not a substitute for fixing the engine.

WordPress Owners: A Special Note

WordPress itself is not the problem. The flaw is in PHP, which sits underneath WordPress. That means:

• Updating WordPress, themes and plugins is still important, but it will not fix this. You must update PHP.
• If your host manages PHP, they may do it for you. Do not assume. Check.
• After updating, make sure your plugins and themes still work. Update them first if they are old.
• Delete any plugins or themes you do not use. Fewer pieces mean fewer weak spots.

If you want to learn more about protecting your site, read our guide on how to stop WordPress spam posts and secure your website.

How to Tell If Your Site Might Already Be Hacked

Because attacks started quickly, it is smart to look for warning signs. Watch for:

• New admin users you do not recognise.
• Pages or posts you did not write, especially about strange products.
• Your site redirecting visitors to other websites.
• Unknown files in your website folders, or files changed recently.
• A sudden slow-down, high server load or strange emails sent from your domain.
• Warnings from your host, Google Search Console or your security plugin.

What to Do If You Suspect a Problem

1. Update PHP right away so attackers cannot get back in the same way.
2. Contact your hosting company. Many can scan and help clean the site.
3. Change all passwords: WordPress, hosting, database, FTP and email.
4. Run a malware scan using a trusted tool or your host’s scanner.
5. Restore a clean backup from before the problem, if you have one.
6. Remove unknown admin users and files.
7. Consider hiring a security professional if the site is important.

Important: updating PHP stops new attacks through these flaws, but it does not remove anything an attacker already planted. That is why checking and cleaning matter.

A Quick Safety Warning About “Exploit Code”

When big flaws like this appear, people post “proof-of-concept” code online. Do not download or run this code on your own to “test” it. Some of it is fake or includes malware aimed at curious people, and running attack code against servers you do not own is illegal in many places. If you are a professional defender, use trusted vendor scanners and official guidance instead.

Checklist: What to Do Today

1. Find out which PHP version your site uses.
2. Back up your files and database.
3. Update to a patched version (8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the newest in your branch).
4. Restart services if you manage your own server.
5. Test your site thoroughly.
6. Check for signs of compromise.
7. Turn on a firewall or WAF if you can.
8. Enable automatic updates where possible.
9. Tell your team, clients or hosting provider.

Lessons From PHP2Shell

• Keep software updated. Updates are not annoying chores. They are repairs for known holes.
• Use supported versions. Old PHP versions may never get fixes.
• Back up regularly. A recent clean backup can save your whole website.
• Layer your defences. Updates, firewalls, strong passwords and monitoring work best together.
• Know your hosting. Learn who is responsible for updating PHP on your site.

Simple Word List (Glossary)

• PHP: A programming language that runs many websites, including WordPress.
• Server: A powerful computer that stores and delivers websites.
• Vulnerability: A weak spot in software that attackers can try to use.
• CVE: A public ID number given to a known security flaw.
• RCE (remote code execution): When an attacker far away can run commands on your server.
• Unauthenticated: Needing no login or password.
• Shell: A way to give commands to a computer.
• Patch: A software fix.
• WAF: A web application firewall, which blocks suspicious website traffic.
• CISA: The US Cybersecurity and Infrastructure Security Agency.
• Proof-of-concept: Code that shows a flaw can be abused. Not safe for beginners to run.

Frequently Asked Questions (FAQ)

What is PHP2Shell?

It is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can let attackers run code on a server without logging in.

Is my WordPress site affected?

If your server runs a vulnerable PHP version, yes, it could be. WordPress runs on PHP, so you need to check and update PHP. Updating WordPress alone does not fix it.

Which PHP versions fix it?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Always check php.net for the latest information.

Is there a workaround if I cannot update?

The PHP team says there is no complete workaround. A firewall can reduce risk, but updating is the only safe fix.

Has PHP2Shell been used in real attacks?

Security firms reported exploitation attempts soon after details leaked and patches were released.

Should I run exploit code to test my site?

No. Use trusted scanners and your host’s advice. Unknown exploit code can be dangerous or illegal.

Do I need to update if my host manages PHP?

Check with your host. Many will patch for you, but do not assume. Confirm the PHP version in your hosting panel or WordPress Site Health.

What if my PHP version is very old?

Ask your host about patches for your version and plan to move to a supported release soon.

Final Thoughts

PHP2Shell is a reminder of how much of the internet depends on a few key building blocks. When one of them has a serious flaw, speed matters. The good news is that a fix is available, and for many website owners the solution is simple: back up, update PHP, test and check for trouble.

Do not wait. Take ten minutes today to check your PHP version. If you are not sure how, message your hosting provider and ask them directly. A quick update now can save you days of cleaning up later.

Did you update your site yet? Tell us in the comments if you need help. For more easy security guides, keep following Connect Digital World.

Sources and further reading: PHP project release announcements, CISA’s alert, BleepingComputer, SecurityWeek, Qualys, watchTowr and Recorded Future coverage of PHP2Shell. This is a fast-moving story, so check the official PHP security advisory for the latest.