{"id":42013,"date":"2026-10-22T15:48:01","date_gmt":"2026-10-22T12:48:01","guid":{"rendered":"https:\/\/coma.lv\/2026\/10\/22\/php2shell-critical-php-vulnerability-cve-2026-109618\/"},"modified":"2026-10-22T15:56:17","modified_gmt":"2026-10-22T12:56:17","slug":"php2shell-critical-php-vulnerability-cve-2026-109618","status":"publish","type":"post","link":"https:\/\/coma.lv\/en\/2026\/10\/22\/php2shell-critical-php-vulnerability-cve-2026-109618\/","title":{"rendered":"PHP2Shell: Critical PHP Vulnerability (CVE-2026-109618) \u2013 What to Do Today"},"content":{"rendered":"<style>#top .p2s{--ink:#1d2327;--muted:#59636b;--line:#e2e5e8;--gold:#b48e5f;--red:#c62828;--redbg:#fdeceb;--amber:#a15c00;--amberbg:#fff3df;--green:#1b7a3d;--greenbg:#e6f4ea;--dark:#14181c}#top .p2s{color:var(--ink);font-size:17px;line-height:1.65}#top .p2s *,#top .p2s *:before,#top .p2s *:after{box-sizing:border-box}#top .p2s p{margin:0 0 1em}#top .p2s h2{margin:2.1em 0 .6em;line-height:1.25}#top .p2s a{text-decoration:underline;text-underline-offset:2px}#top .p2s a.p2s-btn{text-decoration:none}#top .p2s .p2s-hero{background:linear-gradient(135deg,#fff3f2,#fff 70%);border:1px solid #f1c9c6;border-left:6px solid var(--red);border-radius:10px;padding:22px 22px 18px;margin:0 0 26px}#top .p2s .p2s-kicker{display:flex;align-items:center;gap:10px;margin:0 0 12px;font-weight:700;letter-spacing:.06em;text-transform:uppercase;font-size:13px;color:var(--red)}#top .p2s .p2s-dot{width:11px;height:11px;border-radius:50%;background:var(--red);display:inline-block;flex:none;animation:p2s-pulse 1.8s infinite}@keyframes p2s-pulse{0%{box-shadow:0 0 0 0 rgba(198,40,40,.55)}70%{box-shadow:0 0 0 12px rgba(198,40,40,0)}100%{box-shadow:0 0 0 0 rgba(198,40,40,0)}}@media (prefers-reduced-motion:reduce){#top .p2s .p2s-dot{animation:none}}#top .p2s .p2s-lead{font-size:1.06em}#top .p2s .p2s-stats{display:grid;grid-template-columns:repeat(4,1fr);gap:12px;margin:18px 0}#top .p2s .p2s-stat{background:#fff;border:1px solid var(--line);border-radius:8px;padding:12px 12px 10px}#top .p2s .p2s-stat b{display:block;font-size:26px;line-height:1.1;color:var(--red)}#top .p2s .p2s-stat span{display:block;font-size:13px;line-height:1.35;color:var(--muted);margin-top:5px}#top .p2s .p2s-note{font-size:14px;color:var(--muted);margin:0}#top .p2s .p2s-cta{display:flex;flex-wrap:wrap;gap:10px;margin:16px 0 12px}#top .p2s a.p2s-btn,#top .p2s button.p2s-btn{display:inline-flex;align-items:center;gap:8px;padding:12px 18px;border-radius:8px;font-weight:700;font-size:15px;line-height:1.2;border:2px solid transparent;cursor:pointer;font-family:inherit}#top .p2s .p2s-btn svg{width:18px;height:18px;fill:currentColor;flex:none}#top .p2s a.p2s-btn-main{background:var(--gold);color:#14181c}#top .p2s a.p2s-btn-main:hover{background:#c9a273;color:#14181c}#top .p2s a.p2s-btn-wa{background:#12803f;color:#fff}#top .p2s a.p2s-btn-tg{background:#1b73b3;color:#fff}#top .p2s a.p2s-btn-dark{background:var(--dark);color:#fff}#top .p2s a.p2s-btn-line,#top .p2s button.p2s-btn-line{background:transparent;color:#fff;border-color:#fff}#top .p2s button.p2s-btn-ghost{background:#fff;color:var(--dark);border-color:var(--dark)}#top .p2s .p2s-tldr{background:#f6f7f8;border:1px solid var(--line);border-radius:10px;padding:16px 20px;margin:0 0 22px}#top .p2s .p2s-tldr .p2s-h{display:block;margin-bottom:6px;font-size:18px}#top .p2s .p2s-tldr ul{margin:0 0 0 1.1em;padding:0}#top .p2s .p2s-tldr li{margin:5px 0}#top .p2s .p2s-tl{list-style:none;margin:18px 0;padding:0 0 0 22px;border-left:3px solid var(--line)}#top .p2s .p2s-tl li{position:relative;margin:0 0 18px;padding:0 0 0 8px}#top .p2s .p2s-tl li:before{content:\"\";position:absolute;left:-33px;top:4px;width:15px;height:15px;border-radius:50%;background:#fff;border:3px solid var(--gold)}#top .p2s .p2s-tl li.p2s-now:before{border-color:var(--red);background:var(--red)}#top .p2s .p2s-date{display:inline-block;font-weight:700;font-size:13px;letter-spacing:.04em;background:var(--dark);color:#fff;border-radius:4px;padding:2px 8px;margin-right:8px}#top .p2s .p2s-now .p2s-date{background:var(--red)}#top .p2s .p2s-tweet{margin:22px 0;padding:18px;border:1px solid var(--line);border-radius:12px;background:#fff}#top .p2s .p2s-tweet blockquote{margin:0 0 10px;padding:0 0 0 16px;border-left:4px solid var(--dark);font-size:17px;font-style:normal;background:none}#top .p2s .p2s-tweet blockquote p{margin:0 0 .6em}#top .p2s .p2s-tweet blockquote,#top .p2s .p2s-tweet blockquote p{color:var(--ink);opacity:1;font-size:17px;line-height:1.55}#top .p2s .p2s-tweet blockquote a{color:#1b73b3}#top .p2s .p2s-tweet figcaption{font-size:14px;color:var(--muted)}#top .p2s .p2s-tweet-ui{display:flex;flex-wrap:wrap;align-items:center;gap:10px;margin-top:12px}#top .p2s .p2s-tweet-ui small{color:var(--muted);font-size:13px;line-height:1.4;flex:1 1 260px}#top .p2s .p2s-tweet-on .p2s-tweet-ui{display:none}#top .p2s .p2s-vt{width:100%;border-collapse:separate;border-spacing:0;margin:16px 0;font-size:15px;border:0}#top .p2s .p2s-vt th{background:var(--dark);color:#fff;text-align:left;padding:10px 12px;font-weight:600;border:0}#top .p2s .p2s-vt td{padding:10px 12px;border:0;border-bottom:1px solid var(--line);vertical-align:top;background:#fff}#top .p2s .p2s-vt tr td,#top .p2s .p2s-vt tr:nth-child(even) td,#top .p2s .p2s-vt tr:nth-child(odd) td{background:#fff;color:var(--ink);opacity:1}#top .p2s .p2s-pill{display:inline-block;padding:2px 10px;border-radius:99px;font-weight:700;font-size:13px;white-space:nowrap}#top .p2s .p2s-ok{background:var(--greenbg);color:var(--green)}#top .p2s .p2s-bad{background:var(--redbg);color:var(--red)}#top .p2s .p2s-warn{background:var(--amberbg);color:var(--amber)}#top .p2s .p2s-steps{list-style:none;counter-reset:s;margin:16px 0;padding:0}#top .p2s .p2s-steps li{counter-increment:s;position:relative;margin:0 0 14px;padding:4px 0 0 52px;min-height:38px}#top .p2s .p2s-steps li:before{content:counter(s);position:absolute;left:0;top:0;width:36px;height:36px;border-radius:50%;background:var(--dark);color:#fff;font-weight:700;display:flex;align-items:center;justify-content:center}#top .p2s .p2s-det{border:1px solid var(--line);border-radius:8px;margin:10px 0;background:#fff}#top .p2s .p2s-det summary{cursor:pointer;padding:12px 16px;font-weight:700}#top .p2s .p2s-det .p2s-det-b{padding:0 16px 12px}#top .p2s .p2s-det .p2s-det-b p:last-child,#top .p2s .p2s-det .p2s-det-b ul:last-child{margin-bottom:0}#top .p2s .p2s-sit{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:16px 0}#top .p2s .p2s-card{border:1px solid var(--line);border-top:4px solid var(--gold);border-radius:10px;padding:14px 16px;background:#fff}#top .p2s .p2s-card b{display:block;margin-bottom:6px}#top .p2s .p2s-card span{display:block;color:var(--muted);font-size:15px;line-height:1.5}#top .p2s .p2s-flow{display:grid;grid-template-columns:repeat(4,1fr);gap:12px;margin:20px 0;padding:0;list-style:none;counter-reset:f}#top .p2s .p2s-flow li{counter-increment:f;position:relative;background:#f6f7f8;border:1px solid var(--line);border-radius:10px;padding:46px 14px 14px;font-size:15px;line-height:1.5}#top .p2s .p2s-flow li:before{content:counter(f);position:absolute;left:14px;top:12px;width:26px;height:26px;border-radius:50%;background:var(--gold);color:#14181c;font-weight:700;display:flex;align-items:center;justify-content:center}#top .p2s .p2s-flow b{display:block;margin-bottom:4px;font-size:16px}#top .p2s .p2s-chips{display:flex;flex-wrap:wrap;gap:8px;margin:14px 0;padding:0;list-style:none}#top .p2s .p2s-chips li{background:var(--greenbg);color:var(--green);border-radius:99px;padding:5px 12px;font-size:14px;font-weight:600;margin:0}#top .p2s .p2s-band{background:var(--dark);color:#fff;border-radius:12px;padding:24px 24px 18px;margin:28px 0}#top .p2s .p2s-band .p2s-band-h{font-size:22px;line-height:1.25;font-weight:700;margin:0 0 6px;color:#fff}#top .p2s .p2s-band p{color:#d5dadd}#top .p2s .p2s-band .p2s-cta{margin-bottom:6px}#top .p2s .p2s-links{font-size:15px;color:var(--muted)}#top .p2s .p2s-src li{margin:4px 0}@media (max-width:760px){#top .p2s .p2s-stats{grid-template-columns:repeat(2,1fr)}#top .p2s .p2s-sit{grid-template-columns:1fr}#top .p2s .p2s-flow{grid-template-columns:1fr}#top .p2s .p2s-vt thead{display:none}#top .p2s .p2s-vt tr{display:block;border:1px solid var(--line);border-radius:8px;margin:0 0 10px;padding:6px 0;background:#fff}#top .p2s .p2s-vt td{display:block;border:0;padding:4px 12px}#top .p2s .p2s-vt td:before{content:attr(data-l);display:block;font-size:12px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted)}#top .p2s a.p2s-btn,#top .p2s button.p2s-btn{width:100%;justify-content:center}}<\/style>\n<div class=\"p2s\">\n<div class=\"p2s-hero\">\n<p class=\"p2s-kicker\"><span class=\"p2s-dot\" aria-hidden=\"true\"><\/span>Important \u00b7 updated 22 October 2026<\/p>\n<p class=\"p2s-lead\">On 21 October 2026 the PHP project released emergency patches for a <strong>critical PHP vulnerability, PHP2Shell<\/strong> \u2014 two remote code execution (RCE) flaws, CVE-2026-109618 and CVE-2026-109619. The bugs sit in the PHP engine itself, so they affect any website running an unpatched PHP version: WordPress, WooCommerce, Joomla, Drupal, Magento, Laravel or custom code. Attack attempts began before the patches were public and have increased sharply since the announcement.<\/p>\n<div class=\"p2s-stats\">\n<div class=\"p2s-stat\"><b>9.2<\/b><span>CVSS v4.0 score for each of the two flaws<\/span><\/div>\n<div class=\"p2s-stat\"><b>RCE<\/b><span>remote code execution without logging in<\/span><\/div>\n<div class=\"p2s-stat\"><b>PHP 5.4+<\/b><span>affected versions reach back as far as PHP 5.4<\/span><\/div>\n<div class=\"p2s-stat\"><b>millions<\/b><span>exploitation attempts seen on Cloudflare&#8217;s network (22 Oct)<\/span><\/div>\n<\/div>\n<div class=\"p2s-cta\"><a class=\"p2s-btn p2s-btn-main\" href=\"https:\/\/coma.lv\/en\/contacts\/\">Request a website check<\/a><a class=\"p2s-btn p2s-btn-wa\" href=\"https:\/\/wa.me\/37129394520?text=Hello%21%20I%20would%20like%20you%20to%20check%20my%20website%20regarding%20PHP2Shell%20%28CVE-2026-109618%29.%20Website%20address%3A%20\" target=\"_blank\" rel=\"noopener\"><svg viewBox=\"0 0 32 32\" aria-hidden=\"true\"><path d=\"M16.04 4c-6.6 0-11.96 5.33-11.96 11.9 0 2.1.56 4.14 1.62 5.95L4 28l6.32-1.65a12 12 0 0 0 5.72 1.45h.01c6.6 0 11.95-5.33 11.95-11.9C28 9.33 22.64 4 16.04 4zm0 21.82h-.01a9.9 9.9 0 0 1-5.04-1.38l-.36-.21-3.75.98 1-3.65-.23-.37a9.83 9.83 0 0 1-1.51-5.29c0-5.46 4.46-9.9 9.91-9.9a9.86 9.86 0 0 1 9.9 9.91c0 5.46-4.45 9.9-9.9 9.9zm5.43-7.42c-.3-.15-1.76-.87-2.04-.97-.27-.1-.47-.15-.67.15-.2.3-.77.97-.94 1.17-.17.2-.35.22-.64.07-.3-.15-1.26-.46-2.4-1.48-.88-.79-1.48-1.76-1.65-2.06-.17-.3-.02-.46.13-.6.13-.14.3-.35.45-.52.15-.18.2-.3.3-.5.1-.2.05-.37-.03-.52-.07-.15-.67-1.6-.91-2.2-.24-.58-.49-.5-.67-.5l-.57-.01c-.2 0-.52.07-.8.37-.27.3-1.04 1.02-1.04 2.5 0 1.47 1.07 2.89 1.22 3.09.15.2 2.11 3.22 5.1 4.51.71.31 1.27.49 1.7.63.72.23 1.37.2 1.88.12.58-.09 1.76-.72 2-1.42.25-.7.25-1.29.18-1.42-.08-.12-.27-.2-.57-.34z\"\/><\/svg>WhatsApp<\/a><a class=\"p2s-btn p2s-btn-dark\" href=\"tel:+37129394520\"><svg viewBox=\"0 0 24 24\" aria-hidden=\"true\"><path d=\"M6.6 10.8a15.1 15.1 0 0 0 6.6 6.6l2.2-2.2a1 1 0 0 1 1-.25 11.4 11.4 0 0 0 3.6.57 1 1 0 0 1 1 1V20a1 1 0 0 1-1 1A17 17 0 0 1 3 4a1 1 0 0 1 1-1h3.5a1 1 0 0 1 1 1c0 1.25.2 2.45.57 3.57a1 1 0 0 1-.25 1z\"\/><\/svg>Call +371 29394520<\/a><\/div>\n<p class=\"p2s-note\">Attempts are not confirmed breaches, and security vendors differ on how many attacks succeed. But waiting for confirmation means patching too late. We reply within one business day. For urgent cases, call or message us on WhatsApp.<\/p>\n<\/div>\n<div class=\"p2s-tldr\"><strong class=\"p2s-h\">In short<\/strong><\/p>\n<ul>\n<li>Two critical PHP engine vulnerabilities (CVSS 9.2 each) that can be exploited without logging in.<\/li>\n<li>Fixed in <strong>PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35<\/strong>. PHP 8.1 and older have no official fix.<\/li>\n<li>After updating, PHP-FPM or Apache must be restarted \u2014 until then the old code keeps running.<\/li>\n<li>Host not updating PHP, or your site is stuck on an old version? We take over hosting, check the website and update it.<\/li>\n<\/ul>\n<\/div>\n\n<h2>What is PHP2Shell?<\/h2>\n<p>PHP2Shell is a critical PHP vulnerability \u2014 strictly, a pair of flaws in the PHP interpreter: <strong>CVE-2026-109618<\/strong> and <strong>CVE-2026-109619<\/strong>. The PHP security team rates both <strong>Critical (CVSS v4.0: 9.2)<\/strong> and says both can be exploited by an unauthenticated remote attacker.<\/p>\n<p>Both are memory-handling bugs in the engine: in one, PHP runs out of memory while a request&#8217;s internal data is only partly set up; in the other, state left over from a previous request points to memory that has already been freed. In practice this can let an attacker run their own code on the server. The PHP advisory also lists memory disclosure as a confirmed impact, which researchers warn could expose passwords, session tokens or API keys held in server memory.<\/p>\n<p>Because the flaw is in PHP itself, it doesn&#8217;t matter how well your plugins are maintained: if the server&#8217;s PHP version is vulnerable, every site on it is exposed. PHP considers the risk highest for Apache with mod_php, where an unauthenticated request can trigger the attack before any application code runs; PHP-FPM, CGI, FrankenPHP and LiteSpeed are affected as well.<\/p>\n<h2>Timeline: what we know so far<\/h2>\n<ol class=\"p2s-tl\">\n<li><span class=\"p2s-date\">17 Oct<\/span>Amazon&#8217;s honeypots record a first exploitation attempt \u2014 four days before public disclosure.<\/li>\n<li><span class=\"p2s-date\">20 Oct<\/span>Security firm watchTowr reports reproducing remote code execution.<\/li>\n<li><span class=\"p2s-date\">21 Oct<\/span>PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (around 14:00 UTC). Cloudflare reports early attacks and deploys initial WAF rules for all plans.<\/li>\n<li class=\"p2s-now\"><span class=\"p2s-date\">22 Oct<\/span>Cloudflare&#8217;s CEO reports that exploitation attempts have reached the millions. Assessments of success differ: Patchstack has so far seen only probing, while Sansec notes that public exploit code usually needs an additional weakness in the application itself.<\/li>\n<\/ol>\n<figure class=\"p2s-tweet\" id=\"p2s-tweet\">\n<blockquote class=\"twitter-tweet\" data-lang=\"en\" data-dnt=\"true\" data-conversation=\"none\">\n<p lang=\"en\" dir=\"ltr\">Some stats on <a href=\"https:\/\/x.com\/hashtag\/php2shell?src=hash&amp;ref_src=twsrc%5Etfw\">#php2shell<\/a>. In the 10 hours before it was publicly announced, across the <a href=\"https:\/\/x.com\/Cloudflare?ref_src=twsrc%5Etfw\">@Cloudflare<\/a> network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.<\/p>\n<p>&mdash; Matthew Prince \ud83c\udf25 (@eastdakota) <a href=\"https:\/\/x.com\/eastdakota\/status\/2113079352682570051?ref_src=twsrc%5Etfw\">October 22, 2026<\/a><\/blockquote><figcaption>Cloudflare CEO Matthew Prince, 22 October 2026 \u2014 attempts to exploit PHP2Shell seen across Cloudflare&#8217;s network.<\/figcaption><div class=\"p2s-tweet-ui\"><button type=\"button\" class=\"p2s-btn p2s-btn-ghost\" id=\"p2s-tweet-btn\">Load the original post from X<\/button><small>The button loads third-party content from X and its cookies. If you have accepted marketing cookies, the post loads automatically.<\/small><\/div>\n<\/figure>\n<p><script>(function(){var f=document.getElementById('p2s-tweet');var b=document.getElementById('p2s-tweet-btn');if(!f)return;function go(){if(f.getAttribute('data-on'))return;f.setAttribute('data-on','1');f.classList.add('p2s-tweet-on');var s=document.createElement('script');s.src='https:\/\/platform.twitter.com\/widgets.js';s.async=true;document.body.appendChild(s)}if(b)b.addEventListener('click',go);try{var p=document.cookie.split(';');for(var i=0;i<p.length;i++){var c=p[i].trim();if(c.indexOf('coma_consent=')===0){var v=JSON.parse(decodeURIComponent(c.slice(13)));if(v){if(v.marketing)go()}}}}catch(e){}})();<\/script>\n<h2>Is my website affected? PHP versions at a glance<\/h2>\n<p>If your site runs on PHP and the server's PHP version is below the fixed release for its branch, treat it as vulnerable. The table shows the status by branch.<\/p>\n<table class=\"p2s-vt\">\n<thead>\n<tr>\n<th>PHP branch<\/th>\n<th>Fixed version<\/th>\n<th>Status<\/th>\n<th>What to do<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td data-l=\"PHP branch\"><strong>PHP 8.5<\/strong><\/td>\n<td data-l=\"Fixed version\">8.5.12<\/td>\n<td data-l=\"Status\"><span class=\"p2s-pill p2s-ok\">Fixed<\/span><\/td>\n<td data-l=\"What to do\">Update to 8.5.12 or newer and restart PHP.<\/td>\n<\/tr>\n<tr>\n<td data-l=\"PHP branch\"><strong>PHP 8.4<\/strong><\/td>\n<td data-l=\"Fixed version\">8.4.27<\/td>\n<td data-l=\"Status\"><span class=\"p2s-pill p2s-ok\">Fixed<\/span><\/td>\n<td data-l=\"What to do\">Update to 8.4.27 or newer and restart PHP.<\/td>\n<\/tr>\n<tr>\n<td data-l=\"PHP branch\"><strong>PHP 8.3<\/strong><\/td>\n<td data-l=\"Fixed version\">8.3.36<\/td>\n<td data-l=\"Status\"><span class=\"p2s-pill p2s-ok\">Fixed<\/span><\/td>\n<td data-l=\"What to do\">Update to 8.3.36 or newer and restart PHP.<\/td>\n<\/tr>\n<tr>\n<td data-l=\"PHP branch\"><strong>PHP 8.2<\/strong><\/td>\n<td data-l=\"Fixed version\">8.2.35<\/td>\n<td data-l=\"Status\"><span class=\"p2s-pill p2s-ok\">Fixed<\/span><\/td>\n<td data-l=\"What to do\">Update to 8.2.35 or newer and restart PHP.<\/td>\n<\/tr>\n<tr>\n<td data-l=\"PHP branch\"><strong>PHP 8.1, 8.0, 7.4<\/strong><\/td>\n<td data-l=\"Fixed version\">no official release<\/td>\n<td data-l=\"Status\"><span class=\"p2s-pill p2s-warn\">No official fix<\/span><\/td>\n<td data-l=\"What to do\">End of life. PHP's security team published minimal source backports, and some Linux distributions and hosts port the fix to their own builds. Ask for written confirmation, or move to PHP 8.3 \/ 8.4.<\/td>\n<\/tr>\n<tr>\n<td data-l=\"PHP branch\"><strong>PHP 7.3 and older (back to 5.4)<\/strong><\/td>\n<td data-l=\"Fixed version\">none<\/td>\n<td data-l=\"Status\"><span class=\"p2s-pill p2s-bad\">No fix<\/span><\/td>\n<td data-l=\"What to do\">End of life. Move to a supported version and check plugin and theme compatibility.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>The version number can mislead.<\/strong> Linux distributions and some hosts backport fixes without changing the number \u2014 and an updated package does nothing until PHP is restarted. Ask your host to confirm in writing that PHP has been updated and restarted.<\/p>\n<p><strong>At the highest risk:<\/strong><\/p>\n<ul>\n<li>sites running PHP 7.4, 8.0, 8.1 or older;<\/li>\n<li>sites at hosts that haven't updated PHP yet;<\/li>\n<li>VPS and servers with nobody responsible for them;<\/li>\n<li>sites whose developer is no longer around;<\/li>\n<li>sites with outdated plugins or a theme that blocks a safe move to newer PHP.<\/li>\n<\/ul>\n<h2>How to check your PHP version<\/h2>\n<ul>\n<li><strong>WordPress:<\/strong> Tools \u2192 Site Health \u2192 Info \u2192 Server \u2192 PHP version.<\/li>\n<li><strong>Plesk:<\/strong> Websites &amp; Domains \u2192 PHP Settings. <strong>cPanel:<\/strong> MultiPHP Manager.<\/li>\n<li><strong>Ask your host:<\/strong> has PHP been updated to a release that fixes CVE-2026-109618 and CVE-2026-109619, and have the PHP workers been restarted?<\/li>\n<li><strong>Server admins:<\/strong> <code>php -v<\/code>, plus the restart time of the PHP-FPM \/ Apache service.<\/li>\n<\/ul>\n<h2>What to do right now: 5 steps<\/h2>\n<ol class=\"p2s-steps\">\n<li><strong>Find out your PHP version and who is responsible.<\/strong> Who administers the server \u2014 your host, an agency, or you?<\/li>\n<li><strong>Update PHP<\/strong> to 8.3.36, 8.4.27 or newer on your branch, and restart PHP-FPM \/ Apache. Ask your host to confirm.<\/li>\n<li><strong>On PHP 8.1 or older,<\/strong> plan a move to a supported version. Don't just switch versions on a live site: take a backup, test on a staging copy and check that plugins and the theme are compatible.<\/li>\n<li><strong>Look for warning signs in your logs:<\/strong> unusual multipart\/form-data requests followed by memory-limit errors or repeated HTTP 500 responses; unusually large or malformed PHPSESSID cookies; unexplained PHP worker restarts. They are not proof of compromise, but worth checking.<\/li>\n<li><strong>If you suspect a hacked website:<\/strong> update PHP first, then treat the server as potentially compromised \u2014 change database, admin, SFTP and API credentials, scan for malware and restore a clean backup if needed. We do <a href=\"https:\/\/coma.lv\/en\/hacked-wordpress-repair\/\">hacked WordPress website repair<\/a> (from about \u20ac250, depending on scope).<\/li>\n<\/ol>\n<details class=\"p2s-det\">\n<summary>Temporary measures for server admins (not a substitute for updating)<\/summary>\n<div class=\"p2s-det-b\">\n<ul>\n<li>Per PHP's guidance: set <code>session.upload_progress.enabled=0<\/code> in the PHP-FPM pool or server config (not <code>.user.ini<\/code>) and restart all PHP workers. On PHP 8.5, also set <code>fatal_error_backtraces=0<\/code>.<\/li>\n<li>Cloudflare has published initial WAF rules for known exploit vectors, available on all plans including free. They only help if your server accepts traffic exclusively from Cloudflare.<\/li>\n<li>PHP's security team stresses that these steps reduce exposure but don't make an installation safe \u2014 updating is the complete fix.<\/li>\n<\/ul>\n<\/div>\n<\/details>\n<div class=\"p2s-band\">\n<p class=\"p2s-band-h\">Not sure which PHP version your website runs on?<\/p>\n<p>Send us the website address \u2014 we'll find out what it runs on and what needs to be done.<\/p>\n<div class=\"p2s-cta\"><a class=\"p2s-btn p2s-btn-main\" href=\"https:\/\/coma.lv\/en\/contacts\/\">Request a website check<\/a><a class=\"p2s-btn p2s-btn-wa\" href=\"https:\/\/wa.me\/37129394520?text=Hello%21%20I%20would%20like%20you%20to%20check%20my%20website%20regarding%20PHP2Shell%20%28CVE-2026-109618%29.%20Website%20address%3A%20\" target=\"_blank\" rel=\"noopener\"><svg viewBox=\"0 0 32 32\" aria-hidden=\"true\"><path d=\"M16.04 4c-6.6 0-11.96 5.33-11.96 11.9 0 2.1.56 4.14 1.62 5.95L4 28l6.32-1.65a12 12 0 0 0 5.72 1.45h.01c6.6 0 11.95-5.33 11.95-11.9C28 9.33 22.64 4 16.04 4zm0 21.82h-.01a9.9 9.9 0 0 1-5.04-1.38l-.36-.21-3.75.98 1-3.65-.23-.37a9.83 9.83 0 0 1-1.51-5.29c0-5.46 4.46-9.9 9.91-9.9a9.86 9.86 0 0 1 9.9 9.91c0 5.46-4.45 9.9-9.9 9.9zm5.43-7.42c-.3-.15-1.76-.87-2.04-.97-.27-.1-.47-.15-.67.15-.2.3-.77.97-.94 1.17-.17.2-.35.22-.64.07-.3-.15-1.26-.46-2.4-1.48-.88-.79-1.48-1.76-1.65-2.06-.17-.3-.02-.46.13-.6.13-.14.3-.35.45-.52.15-.18.2-.3.3-.5.1-.2.05-.37-.03-.52-.07-.15-.67-1.6-.91-2.2-.24-.58-.49-.5-.67-.5l-.57-.01c-.2 0-.52.07-.8.37-.27.3-1.04 1.02-1.04 2.5 0 1.47 1.07 2.89 1.22 3.09.15.2 2.11 3.22 5.1 4.51.71.31 1.27.49 1.7.63.72.23 1.37.2 1.88.12.58-.09 1.76-.72 2-1.42.25-.7.25-1.29.18-1.42-.08-.12-.27-.2-.57-.34z\"\/><\/svg>WhatsApp<\/a><a class=\"p2s-btn p2s-btn-line\" href=\"tel:+37129394520\"><svg viewBox=\"0 0 24 24\" aria-hidden=\"true\"><path d=\"M6.6 10.8a15.1 15.1 0 0 0 6.6 6.6l2.2-2.2a1 1 0 0 1 1-.25 11.4 11.4 0 0 0 3.6.57 1 1 0 0 1 1 1V20a1 1 0 0 1-1 1A17 17 0 0 1 3 4a1 1 0 0 1 1-1h3.5a1 1 0 0 1 1 1c0 1.25.2 2.45.57 3.57a1 1 0 0 1-.25 1z\"\/><\/svg>Call +371 29394520<\/a><a class=\"p2s-btn p2s-btn-tg\" href=\"https:\/\/t.me\/comaweb\" target=\"_blank\" rel=\"noopener\"><svg viewBox=\"0 0 24 24\" aria-hidden=\"true\"><path d=\"M9.78 18.65l.28-4.23 7.68-6.92c.34-.31-.07-.46-.52-.19L7.74 13.3 3.64 12c-.88-.25-.89-.86.2-1.3l15.97-6.16c.73-.33 1.43.18 1.15 1.3l-2.72 12.81c-.19.91-.74 1.13-1.5.71L12.6 16.3l-1.99 1.93c-.23.23-.42.42-.83.42z\"\/><\/svg>Telegram<\/a><a class=\"p2s-btn p2s-btn-line\" href=\"mailto:vadim@coma.lv\">Email us<\/a><\/div>\n<p class=\"p2s-note\" style=\"color:#aeb6bb\">We reply within one business day. For urgent cases, call or message us on WhatsApp.<\/p>\n<\/div>\n<h2>How we can help: hosting takeover, website check and update<\/h2>\n<p>PHP can't always just be updated: the host is slow to respond, the service was taken offline as a precaution, the site runs on PHP 8.1 or older, or the developer is gone. These are exactly the situations we handle: we <strong>take over hosting<\/strong>, <strong>check the website<\/strong>, <strong>update it<\/strong> so it runs on a patched PHP version, and <strong>bring it back online<\/strong>. That is practical website security \u2014 not just advice, but the work done.<\/p>\n<div class=\"p2s-sit\">\n<div class=\"p2s-card\"><b>Your host isn't updating PHP or isn't answering<\/b><span>We handle the hosting migration to our servers, which run PHP 8.3.36 and 8.4.27.<\/span><\/div>\n<div class=\"p2s-card\"><b>Your site runs on PHP 8.1 or older<\/b><span>We test plugin and theme compatibility on a staging copy, then move you to a supported PHP version.<\/span><\/div>\n<div class=\"p2s-card\"><b>Your site was suspended or taken offline<\/b><span>We take a copy, check it, update it and bring it up on an updated server \u2014 provided we can get the files and database from the previous host.<\/span><\/div>\n<div class=\"p2s-card\"><b>Nobody maintains the site any more<\/b><span>We take over WordPress maintenance: updates, backups, monitoring (from \u20ac50\/month + VAT).<\/span><\/div>\n<\/div>\n<ol class=\"p2s-flow\">\n<li><b>Request<\/b>Message or call us \u2014 the website address and where it is hosted now are enough.<\/li>\n<li><b>Check<\/b>We identify the PHP version, CMS and plugins, outdated components and signs of compromise.<\/li>\n<li><b>Move & update<\/b>Backup, migration to our servers, compatibility testing on a copy and a planned DNS switch to keep downtime minimal.<\/li>\n<li><b>Live & monitored<\/b>Monitoring, backups and updates \u2014 with a maintenance plan if you want one.<\/li>\n<\/ol>\n<ul class=\"p2s-chips\">\n<li>PHP 8.3.36 and 8.4.27 on our servers<\/li>\n<li>Hetzner infrastructure in Finland<\/li>\n<li>Free SSL<\/li>\n<li>WooCommerce supported<\/li>\n<li>Migration planned for minimal downtime<\/li>\n<\/ul>\n<p>We can't promise that old or damaged code will run on newer PHP unchanged \u2014 that is why we start with a check. After it you get a clear plan and price before any work begins. The first consultation is free.<\/p>\n<p class=\"p2s-links\">See also: <a href=\"https:\/\/coma.lv\/en\/services\/wordpress-hosting\/\">WordPress hosting<\/a> \u00b7 <a href=\"https:\/\/coma.lv\/en\/services\/wordpress-website-maintenance\/\">WordPress maintenance<\/a> \u00b7 <a href=\"https:\/\/coma.lv\/en\/hacked-wordpress-repair\/\">hacked website repair<\/a> \u00b7 <a href=\"https:\/\/coma.lv\/en\/2026\/07\/16\/what-does-wordpress-website-maintenance-include\/\">what website maintenance includes<\/a><\/p>\n<div class=\"p2s-band\">\n<p class=\"p2s-band-h\">Not sure which PHP version your website runs on?<\/p>\n<p>Send us the website address \u2014 we'll find out what it runs on and what needs to be done.<\/p>\n<div class=\"p2s-cta\"><a class=\"p2s-btn p2s-btn-main\" href=\"https:\/\/coma.lv\/en\/contacts\/\">Request a website check<\/a><a class=\"p2s-btn p2s-btn-wa\" href=\"https:\/\/wa.me\/37129394520?text=Hello%21%20I%20would%20like%20you%20to%20check%20my%20website%20regarding%20PHP2Shell%20%28CVE-2026-109618%29.%20Website%20address%3A%20\" target=\"_blank\" rel=\"noopener\"><svg viewBox=\"0 0 32 32\" aria-hidden=\"true\"><path d=\"M16.04 4c-6.6 0-11.96 5.33-11.96 11.9 0 2.1.56 4.14 1.62 5.95L4 28l6.32-1.65a12 12 0 0 0 5.72 1.45h.01c6.6 0 11.95-5.33 11.95-11.9C28 9.33 22.64 4 16.04 4zm0 21.82h-.01a9.9 9.9 0 0 1-5.04-1.38l-.36-.21-3.75.98 1-3.65-.23-.37a9.83 9.83 0 0 1-1.51-5.29c0-5.46 4.46-9.9 9.91-9.9a9.86 9.86 0 0 1 9.9 9.91c0 5.46-4.45 9.9-9.9 9.9zm5.43-7.42c-.3-.15-1.76-.87-2.04-.97-.27-.1-.47-.15-.67.15-.2.3-.77.97-.94 1.17-.17.2-.35.22-.64.07-.3-.15-1.26-.46-2.4-1.48-.88-.79-1.48-1.76-1.65-2.06-.17-.3-.02-.46.13-.6.13-.14.3-.35.45-.52.15-.18.2-.3.3-.5.1-.2.05-.37-.03-.52-.07-.15-.67-1.6-.91-2.2-.24-.58-.49-.5-.67-.5l-.57-.01c-.2 0-.52.07-.8.37-.27.3-1.04 1.02-1.04 2.5 0 1.47 1.07 2.89 1.22 3.09.15.2 2.11 3.22 5.1 4.51.71.31 1.27.49 1.7.63.72.23 1.37.2 1.88.12.58-.09 1.76-.72 2-1.42.25-.7.25-1.29.18-1.42-.08-.12-.27-.2-.57-.34z\"\/><\/svg>WhatsApp<\/a><a class=\"p2s-btn p2s-btn-line\" href=\"tel:+37129394520\"><svg viewBox=\"0 0 24 24\" aria-hidden=\"true\"><path d=\"M6.6 10.8a15.1 15.1 0 0 0 6.6 6.6l2.2-2.2a1 1 0 0 1 1-.25 11.4 11.4 0 0 0 3.6.57 1 1 0 0 1 1 1V20a1 1 0 0 1-1 1A17 17 0 0 1 3 4a1 1 0 0 1 1-1h3.5a1 1 0 0 1 1 1c0 1.25.2 2.45.57 3.57a1 1 0 0 1-.25 1z\"\/><\/svg>Call +371 29394520<\/a><a class=\"p2s-btn p2s-btn-tg\" href=\"https:\/\/t.me\/comaweb\" target=\"_blank\" rel=\"noopener\"><svg viewBox=\"0 0 24 24\" aria-hidden=\"true\"><path d=\"M9.78 18.65l.28-4.23 7.68-6.92c.34-.31-.07-.46-.52-.19L7.74 13.3 3.64 12c-.88-.25-.89-.86.2-1.3l15.97-6.16c.73-.33 1.43.18 1.15 1.3l-2.72 12.81c-.19.91-.74 1.13-1.5.71L12.6 16.3l-1.99 1.93c-.23.23-.42.42-.83.42z\"\/><\/svg>Telegram<\/a><a class=\"p2s-btn p2s-btn-line\" href=\"mailto:vadim@coma.lv\">Email us<\/a><\/div>\n<p class=\"p2s-note\" style=\"color:#aeb6bb\">We reply within one business day. For urgent cases, call or message us on WhatsApp.<\/p>\n<\/div>\n<h2>PHP2Shell FAQ<\/h2>\n<details class=\"p2s-det\">\n<summary>What is PHP2Shell?<\/summary>\n<div class=\"p2s-det-b\">\n<p>PHP2Shell is the name for two critical PHP engine vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution on a server without logging in. Patches were released on 21 October 2026.<\/p>\n<\/div>\n<\/details>\n<details class=\"p2s-det\">\n<summary>Is WordPress itself vulnerable?<\/summary>\n<div class=\"p2s-det-b\">\n<p>No \u2014 the flaws are in PHP, not in WordPress core or a specific plugin. But any WordPress site on a vulnerable PHP version is exposed, and sites on old PHP often have outdated plugins too, which makes moving harder.<\/p>\n<\/div>\n<\/details>\n<details class=\"p2s-det\">\n<summary>Which PHP versions are safe?<\/summary>\n<div class=\"p2s-det-b\">\n<p>Patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (or newer). PHP 8.1 and older have no official release; only source patches and fixes backported by some vendors are available.<\/p>\n<\/div>\n<\/details>\n<details class=\"p2s-det\">\n<summary>How do I find out my PHP version?<\/summary>\n<div class=\"p2s-det-b\">\n<p>In WordPress admin: Tools \u2192 Site Health \u2192 Info \u2192 Server. In your hosting panel (for example Plesk) under PHP Settings. Or ask your host.<\/p>\n<\/div>\n<\/details>\n<details class=\"p2s-det\">\n<summary>Is a firewall or Cloudflare enough?<\/summary>\n<div class=\"p2s-det-b\">\n<p>Cloudflare WAF rules and other firewalls help against known attack patterns and are useful as a stopgap, but the PHP project states that updating PHP is the complete fix.<\/p>\n<\/div>\n<\/details>\n<details class=\"p2s-det\">\n<summary>My host hasn't updated PHP. What now?<\/summary>\n<div class=\"p2s-det-b\">\n<p>Ask for written confirmation and a deadline. If you can't get one, the site can be moved to another host \u2014 we can take over hosting, check and update the website.<\/p>\n<\/div>\n<\/details>\n<details class=\"p2s-det\">\n<summary>Are your servers patched?<\/summary>\n<div class=\"p2s-det-b\">\n<p>Yes. Our hosting servers run PHP 8.3.36 and 8.4.27 \u2014 the fixed releases \u2014 and the PHP workers were restarted on the day the patches were released, 21 October 2026. We host no sites on PHP 8.1 or older.<\/p>\n<\/div>\n<\/details>\n<details class=\"p2s-det\">\n<summary>How much does it cost?<\/summary>\n<div class=\"p2s-det-b\">\n<p>The first consultation is free. After checking your site we give a concrete price before work starts. Ongoing WordPress maintenance is from \u20ac50\/month + VAT; hacked website repair starts from about \u20ac250.<\/p>\n<\/div>\n<\/details>\n<details class=\"p2s-det\">\n<summary>How fast can you start?<\/summary>\n<div class=\"p2s-det-b\">\n<p>We reply to requests within one business day; for urgent cases call or message us on WhatsApp.<\/p>\n<\/div>\n<\/details>\n<p><script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"What is PHP2Shell?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"PHP2Shell is the name for two critical PHP engine vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution on a server without logging in. Patches were released on 21 October 2026.\"}},{\"@type\":\"Question\",\"name\":\"Is WordPress itself vulnerable?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"No \u2014 the flaws are in PHP, not in WordPress core or a specific plugin. But any WordPress site on a vulnerable PHP version is exposed, and sites on old PHP often have outdated plugins too, which makes moving harder.\"}},{\"@type\":\"Question\",\"name\":\"Which PHP versions are safe?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (or newer). PHP 8.1 and older have no official release; only source patches and fixes backported by some vendors are available.\"}},{\"@type\":\"Question\",\"name\":\"How do I find out my PHP version?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"In WordPress admin: Tools \u2192 Site Health \u2192 Info \u2192 Server. In your hosting panel (for example Plesk) under PHP Settings. Or ask your host.\"}},{\"@type\":\"Question\",\"name\":\"Is a firewall or Cloudflare enough?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Cloudflare WAF rules and other firewalls help against known attack patterns and are useful as a stopgap, but the PHP project states that updating PHP is the complete fix.\"}},{\"@type\":\"Question\",\"name\":\"My host hasn't updated PHP. What now?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Ask for written confirmation and a deadline. If you can't get one, the site can be moved to another host \u2014 we can take over hosting, check and update the website.\"}},{\"@type\":\"Question\",\"name\":\"Are your servers patched?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes. Our hosting servers run PHP 8.3.36 and 8.4.27 \u2014 the fixed releases \u2014 and the PHP workers were restarted on the day the patches were released, 21 October 2026. We host no sites on PHP 8.1 or older.\"}},{\"@type\":\"Question\",\"name\":\"How much does it cost?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The first consultation is free. After checking your site we give a concrete price before work starts. Ongoing WordPress maintenance is from \u20ac50\/month + VAT; hacked website repair starts from about \u20ac250.\"}},{\"@type\":\"Question\",\"name\":\"How fast can you start?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"We reply to requests within one business day; for urgent cases call or message us on WhatsApp.\"}}]}<\/script><\/p>\n<h2>Sources and updates<\/h2>\n<p>Facts checked against:<\/p>\n<ul class=\"p2s-src\">\n<li><a href=\"https:\/\/patchstack.com\/articles\/php-major-vulnerability-alert-10-2026\/\" target=\"_blank\" rel=\"noopener\">Patchstack<\/a><\/li>\n<li><a href=\"https:\/\/www.tenable.com\/blog\/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote\" target=\"_blank\" rel=\"noopener\">Tenable<\/a><\/li>\n<li><a href=\"https:\/\/sansec.io\/research\/php2shell\" target=\"_blank\" rel=\"noopener\">Sansec<\/a><\/li>\n<li><a href=\"https:\/\/thehackernews.com\/2026\/10\/php-issues-emergency-patches-for-two.html\" target=\"_blank\" rel=\"noopener\">The Hacker News<\/a><\/li>\n<li><a href=\"https:\/\/x.com\/eastdakota\/status\/2113079352682570051\" target=\"_blank\" rel=\"noopener\">Matthew Prince (Cloudflare), X<\/a><\/li>\n<\/ul>\n<p><strong>22 Oct 2026<\/strong> \u2014 article published. This page will be updated as new information appears.<\/p>\n<hr \/>\n<p><em>Our specialization is WordPress website development, hosting and maintenance. Contact us for a free consultation \u2014 <a href=\"mailto:vadim@coma.lv\">vadim@coma.lv<\/a>, <a href=\"tel:+37129394520\">+371 29394520<\/a><\/em><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Important \u00b7 updated 22 October 2026 On 21 October 2026 the PHP project released emergency patches for a critical PHP vulnerability, PHP2Shell \u2014 two remote code execution (RCE) flaws, CVE-2026-109618 and CVE-2026-109619. The bugs sit in the PHP engine itself, so they affect any website running an unpatched PHP version: WordPress, WooCommerce, Joomla, Drupal, Magento, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":42016,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1225],"tags":[],"class_list":["post-42013","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wordpress"],"_links":{"self":[{"href":"https:\/\/coma.lv\/en\/wp-json\/wp\/v2\/posts\/42013","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/coma.lv\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/coma.lv\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/coma.lv\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/coma.lv\/en\/wp-json\/wp\/v2\/comments?post=42013"}],"version-history":[{"count":2,"href":"https:\/\/coma.lv\/en\/wp-json\/wp\/v2\/posts\/42013\/revisions"}],"predecessor-version":[{"id":42126,"href":"https:\/\/coma.lv\/en\/wp-json\/wp\/v2\/posts\/42013\/revisions\/42126"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/coma.lv\/en\/wp-json\/wp\/v2\/media\/42016"}],"wp:attachment":[{"href":"https:\/\/coma.lv\/en\/wp-json\/wp\/v2\/media?parent=42013"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/coma.lv\/en\/wp-json\/wp\/v2\/categories?post=42013"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/coma.lv\/en\/wp-json\/wp\/v2\/tags?post=42013"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}