[![PHP2Shell — critical PHP vulnerability CVE-2026-109618 and CVE-2026-109619](https://coma.lv/wp-content/uploads/2026/10/php2shell-cover-en.jpg)](https://coma.lv/wp-content/uploads/2026/10/php2shell-cover-en-1030x541.jpg)

# PHP2Shell: Critical PHP Vulnerability (CVE-2026-109618) – What to Do Today

Oct 22, 2026/by [Vadim Pavlovich](https://coma.lv/en/author/djcoma/)

Important · updated 22 October 2026

On 21 October 2026 the PHP project released emergency patches for a **critical PHP vulnerability, PHP2Shell** — two remote code execution (RCE) flaws, CVE-2026-109618 and CVE-2026-109619. The bugs sit in the PHP engine itself, so they affect any website running an unpatched PHP version: WordPress, WooCommerce, Joomla, Drupal, Magento, Laravel or custom code. Attack attempts began before the patches were public and have increased sharply since the announcement.

**9.2**CVSS v4.0 score for each of the two flaws **RCE**remote code execution without logging in **PHP 5.4+**affected versions reach back as far as PHP 5.4 **millions**exploitation attempts seen on Cloudflare’s network (22 Oct)  [Request a website check](https://coma.lv/en/contacts/)[WhatsApp](https://wa.me/37129394520?text=Hello%21%20I%20would%20like%20you%20to%20check%20my%20website%20regarding%20PHP2Shell%20%28CVE-2026-109618%29.%20Website%20address%3A%20)[Call +371 29394520](tel:+37129394520)

Attempts are not confirmed breaches, and security vendors differ on how many attacks succeed. But waiting for confirmation means patching too late. We reply within one business day. For urgent cases, call or message us on WhatsApp.

**In short**

- Two critical PHP engine vulnerabilities (CVSS 9.2 each) that can be exploited without logging in.
- Fixed in **PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35**. PHP 8.1 and older have no official fix.
- After updating, PHP-FPM or Apache must be restarted — until then the old code keeps running.
- Host not updating PHP, or your site is stuck on an old version? We take over hosting, check the website and update it.

## What is PHP2Shell?

PHP2Shell is a critical PHP vulnerability — strictly, a pair of flaws in the PHP interpreter: **CVE-2026-109618** and **CVE-2026-109619**. The PHP security team rates both **Critical (CVSS v4.0: 9.2)** and says both can be exploited by an unauthenticated remote attacker.

Both are memory-handling bugs in the engine: in one, PHP runs out of memory while a request’s internal data is only partly set up; in the other, state left over from a previous request points to memory that has already been freed. In practice this can let an attacker run their own code on the server. The PHP advisory also lists memory disclosure as a confirmed impact, which researchers warn could expose passwords, session tokens or API keys held in server memory.

Because the flaw is in PHP itself, it doesn’t matter how well your plugins are maintained: if the server’s PHP version is vulnerable, every site on it is exposed. PHP considers the risk highest for Apache with mod_php, where an unauthenticated request can trigger the attack before any application code runs; PHP-FPM, CGI, FrankenPHP and LiteSpeed are affected as well.

## Timeline: what we know so far

1. 17 OctAmazon’s honeypots record a first exploitation attempt — four days before public disclosure.
2. 20 OctSecurity firm watchTowr reports reproducing remote code execution.
3. 21 OctPHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (around 14:00 UTC). Cloudflare reports early attacks and deploys initial WAF rules for all plans.
4. 22 OctCloudflare’s CEO reports that exploitation attempts have reached the millions. Assessments of success differ: Patchstack has so far seen only probing, while Sansec notes that public exploit code usually needs an additional weakness in the application itself.

> Some stats on [#php2shell](https://x.com/hashtag/php2shell?src=hash&ref_src=twsrc%5Etfw). In the 10 hours before it was publicly announced, across the [@Cloudflare](https://x.com/Cloudflare?ref_src=twsrc%5Etfw) network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
>
>
>
> — Matthew Prince 🌥 (@eastdakota) [October 22, 2026](https://x.com/eastdakota/status/2113079352682570051?ref_src=twsrc%5Etfw)

Cloudflare CEO Matthew Prince, 22 October 2026 — attempts to exploit PHP2Shell seen across Cloudflare’s network.Load the original post from XThe button loads third-party content from X and its cookies. If you have accepted marketing cookies, the post loads automatically.

## Is my website affected? PHP versions at a glance

If your site runs on PHP and the server's PHP version is below the fixed release for its branch, treat it as vulnerable. The table shows the status by branch.

| PHP branch | Fixed version | Status | What to do |
| --- | --- | --- | --- |
| **PHP 8.5** | 8.5.12 | Fixed | Update to 8.5.12 or newer and restart PHP. |
| **PHP 8.4** | 8.4.27 | Fixed | Update to 8.4.27 or newer and restart PHP. |
| **PHP 8.3** | 8.3.36 | Fixed | Update to 8.3.36 or newer and restart PHP. |
| **PHP 8.2** | 8.2.35 | Fixed | Update to 8.2.35 or newer and restart PHP. |
| **PHP 8.1, 8.0, 7.4** | no official release | No official fix | End of life. PHP's security team published minimal source backports, and some Linux distributions and hosts port the fix to their own builds. Ask for written confirmation, or move to PHP 8.3 / 8.4. |
| **PHP 7.3 and older (back to 5.4)** | none | No fix | End of life. Move to a supported version and check plugin and theme compatibility. |

**The version number can mislead.** Linux distributions and some hosts backport fixes without changing the number — and an updated package does nothing until PHP is restarted. Ask your host to confirm in writing that PHP has been updated and restarted.

**At the highest risk:**

- sites running PHP 7.4, 8.0, 8.1 or older;
- sites at hosts that haven't updated PHP yet;
- VPS and servers with nobody responsible for them;
- sites whose developer is no longer around;
- sites with outdated plugins or a theme that blocks a safe move to newer PHP.

## How to check your PHP version

- **WordPress:** Tools → Site Health → Info → Server → PHP version.
- **Plesk:** Websites & Domains → PHP Settings. **cPanel:** MultiPHP Manager.
- **Ask your host:** has PHP been updated to a release that fixes CVE-2026-109618 and CVE-2026-109619, and have the PHP workers been restarted?
- **Server admins:** php -v, plus the restart time of the PHP-FPM / Apache service.

## What to do right now: 5 steps

1. **Find out your PHP version and who is responsible.** Who administers the server — your host, an agency, or you?
2. **Update PHP** to 8.3.36, 8.4.27 or newer on your branch, and restart PHP-FPM / Apache. Ask your host to confirm.
3. **On PHP 8.1 or older,** plan a move to a supported version. Don't just switch versions on a live site: take a backup, test on a staging copy and check that plugins and the theme are compatible.
4. **Look for warning signs in your logs:** unusual multipart/form-data requests followed by memory-limit errors or repeated HTTP 500 responses; unusually large or malformed PHPSESSID cookies; unexplained PHP worker restarts. They are not proof of compromise, but worth checking.
5. **If you suspect a hacked website:** update PHP first, then treat the server as potentially compromised — change database, admin, SFTP and API credentials, scan for malware and restore a clean backup if needed. We do [hacked WordPress website repair](https://coma.lv/en/hacked-wordpress-repair/) (from about €250, depending on scope).

Temporary measures for server admins (not a substitute for updating)

- Per PHP's guidance: set session.upload_progress.enabled=0 in the PHP-FPM pool or server config (not .user.ini) and restart all PHP workers. On PHP 8.5, also set fatal_error_backtraces=0.
- Cloudflare has published initial WAF rules for known exploit vectors, available on all plans including free. They only help if your server accepts traffic exclusively from Cloudflare.
- PHP's security team stresses that these steps reduce exposure but don't make an installation safe — updating is the complete fix.

Not sure which PHP version your website runs on?

Send us the website address — we'll find out what it runs on and what needs to be done.

[Request a website check](https://coma.lv/en/contacts/)[WhatsApp](https://wa.me/37129394520?text=Hello%21%20I%20would%20like%20you%20to%20check%20my%20website%20regarding%20PHP2Shell%20%28CVE-2026-109618%29.%20Website%20address%3A%20)[Call +371 29394520](tel:+37129394520)[Telegram](https://t.me/comaweb)[Email us](https://coma.lv/cdn-cgi/l/email-protection#0a7c6b6e63674a6965676b24667c)

We reply within one business day. For urgent cases, call or message us on WhatsApp.

## How we can help: hosting takeover, website check and update

PHP can't always just be updated: the host is slow to respond, the service was taken offline as a precaution, the site runs on PHP 8.1 or older, or the developer is gone. These are exactly the situations we handle: we **take over hosting**, **check the website**, **update it** so it runs on a patched PHP version, and **bring it back online**. That is practical website security — not just advice, but the work done.

**Your host isn't updating PHP or isn't answering**We handle the hosting migration to our servers, which run PHP 8.3.36 and 8.4.27. **Your site runs on PHP 8.1 or older**We test plugin and theme compatibility on a staging copy, then move you to a supported PHP version. **Your site was suspended or taken offline**We take a copy, check it, update it and bring it up on an updated server — provided we can get the files and database from the previous host. **Nobody maintains the site any more**We take over WordPress maintenance: updates, backups, monitoring (from €50/month + VAT).

1. **Request**Message or call us — the website address and where it is hosted now are enough.
2. **Check**We identify the PHP version, CMS and plugins, outdated components and signs of compromise.
3. **Move & update**Backup, migration to our servers, compatibility testing on a copy and a planned DNS switch to keep downtime minimal.
4. **Live & monitored**Monitoring, backups and updates — with a maintenance plan if you want one.

- PHP 8.3.36 and 8.4.27 on our servers
- Hetzner infrastructure in Finland
- Free SSL
- WooCommerce supported
- Migration planned for minimal downtime

We can't promise that old or damaged code will run on newer PHP unchanged — that is why we start with a check. After it you get a clear plan and price before any work begins. The first consultation is free.

See also: [WordPress hosting](https://coma.lv/en/services/wordpress-hosting/) · [WordPress maintenance](https://coma.lv/en/services/wordpress-website-maintenance/) · [hacked website repair](https://coma.lv/en/hacked-wordpress-repair/) · [what website maintenance includes](https://coma.lv/en/2026/07/16/what-does-wordpress-website-maintenance-include/)

Not sure which PHP version your website runs on?

Send us the website address — we'll find out what it runs on and what needs to be done.

[Request a website check](https://coma.lv/en/contacts/)[WhatsApp](https://wa.me/37129394520?text=Hello%21%20I%20would%20like%20you%20to%20check%20my%20website%20regarding%20PHP2Shell%20%28CVE-2026-109618%29.%20Website%20address%3A%20)[Call +371 29394520](tel:+37129394520)[Telegram](https://t.me/comaweb)[Email us](https://coma.lv/cdn-cgi/l/email-protection#562037323f3b1635393b37783a20)

We reply within one business day. For urgent cases, call or message us on WhatsApp.

## PHP2Shell FAQ

What is PHP2Shell?

PHP2Shell is the name for two critical PHP engine vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution on a server without logging in. Patches were released on 21 October 2026.

Is WordPress itself vulnerable?

No — the flaws are in PHP, not in WordPress core or a specific plugin. But any WordPress site on a vulnerable PHP version is exposed, and sites on old PHP often have outdated plugins too, which makes moving harder.

Which PHP versions are safe?

Patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (or newer). PHP 8.1 and older have no official release; only source patches and fixes backported by some vendors are available.

How do I find out my PHP version?

In WordPress admin: Tools → Site Health → Info → Server. In your hosting panel (for example Plesk) under PHP Settings. Or ask your host.

Is a firewall or Cloudflare enough?

Cloudflare WAF rules and other firewalls help against known attack patterns and are useful as a stopgap, but the PHP project states that updating PHP is the complete fix.

My host hasn't updated PHP. What now?

Ask for written confirmation and a deadline. If you can't get one, the site can be moved to another host — we can take over hosting, check and update the website.

Are your servers patched?

Yes. Our hosting servers run PHP 8.3.36 and 8.4.27 — the fixed releases — and the PHP workers were restarted on the day the patches were released, 21 October 2026. We host no sites on PHP 8.1 or older.

How much does it cost?

The first consultation is free. After checking your site we give a concrete price before work starts. Ongoing WordPress maintenance is from €50/month + VAT; hacked website repair starts from about €250.

How fast can you start?

We reply to requests within one business day; for urgent cases call or message us on WhatsApp.

## Sources and updates

Facts checked against:

- [Patchstack](https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/)
- [Tenable](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote)
- [Sansec](https://sansec.io/research/php2shell)
- [The Hacker News](https://thehackernews.com/2026/10/php-issues-emergency-patches-for-two.html)
- [Matthew Prince (Cloudflare), X](https://x.com/eastdakota/status/2113079352682570051)

**22 Oct 2026** — article published. This page will be updated as new information appears.

---

*Our specialization is WordPress website development, hosting and maintenance. Contact us for a free consultation — [vadim@coma.lv](mailto:vadim@coma.lv), [+371 29394520](tel:+37129394520)*