PHP Vulnerability php2shell: What to Patch Today

A PHP vulnerability made public on Wednesday, October 21, 2026 means the server behind your website could run code sent by a stranger, in a single request, without a password. If your site runs on WordPress, Drupal, Laravel or a custom PHP application, treat it as exposed until someone confirms the fix is in.

Most business owners hear about this from their hosting company, in an email that lands next to the promotions. That is normal, and it is also why it gets missed.

What the php2shell PHP Vulnerability Is

The PHP project released fixes for two flaws, CVE-2026-109618 and CVE-2026-109619, and rates both critical at 9.2 on the CVSS version 4 scale, according to its security advisory. Together they are known as php2shell. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The first flaw sits in how PHP recovers when it runs out of memory partway through a request. The advisory states that “the confirmed impact is unauthenticated remote code execution as the web worker account,” and that full code execution was validated with default PHP input and memory limits.

The second flaw lets data from one request survive after its memory is freed, so a later request on the same worker can use it. The second advisory says one confirmed path, session upload progress, is switched on by default, and the application does not need to start a session for it to work.

In plain terms, the attacker does not need a weak plugin or a stolen login. The PHP vulnerability is in the engine underneath the application.

How Wide the PHP Vulnerability Reaches

PHP runs 69.3% of websites whose server side language can be identified, according to W3Techs data for October 22, 2026. WordPress alone runs 39.6% of all websites, per the same W3Techs survey. If your business has a website, there is a good chance PHP is running somewhere, even if nobody on staff has ever written a line of it.

It is not limited to one server setup either. The Canadian Centre for Cyber Security says in alert AL26-026 that all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project rates mod_php as the highest risk, because a demonstrated exploit fires before any application code runs.

Older sites are the bigger worry. WordPress.org’s own usage statistics show about 36% of WordPress sites still on PHP 8.1 or older as of October 22, 2026. The PHP project no longer ships releases for those branches, and has published minimal source backports for 7.4, 8.0 and 8.1 instead.

Here is the part people get wrong. The version number a server reports does not settle the question by itself. The Canadian Centre for Cyber Security notes that some Linux distributions and long term support vendors backport fixes, so the only answer that counts comes from whoever builds your PHP, which is usually your host or your Linux distribution.

Is the PHP Vulnerability Being Exploited?

The Canadian Centre for Cyber Security says open source reporting shows a proof of concept is available, with no active exploitation identified at the time of its October 21 alert, and it warns that this can change quickly. CERT-EU, which protects the European Union’s institutions, says in its advisory that circulating proofs of concept raise the likelihood that attackers are already exploiting the flaws.

The UK’s national cyber agency, the NCSC, goes further in its guidance. It says all versions of PHP may be affected, and that if you cannot update or apply the temporary measures quickly, you should consider taking the system offline.

When a fix and working proof of concept code are both public, every unpatched server is a target, whether or not anyone has been hit yet. This PHP vulnerability does not need to be widely exploited to hurt you, it only needs to reach your server once.

What to Do Next: Seven Steps

None of these steps needs a new website. They need someone to own the list and finish it this week.

1. Find every place PHP runs: the main website, but also the admin panel, the client portal, the old staging copy, the booking tool, and any appliance or hosted service that bundles PHP. The Netherlands’ national cyber agency, NCSC-NL, keeps a public list of software with a PHP dependency that may be affected.
2. Ask your host one question in writing: which PHP build is my site running, and does it include the fixes for CVE-2026-109618 and CVE-2026-109619? On shared hosting the update is usually theirs to apply, not yours.
3. Update to a fixed release: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution’s patched package. The PHP project says updating is the only complete fix for this PHP vulnerability.
4. Move off PHP 8.1 or older: if your site cannot run on 8.2 or later, that is now a security problem, not a maintenance item. Test the move on a copy first, because old plugins and themes can break on newer PHP.
5. Apply the temporary measures if you must wait: the advisories list enforcing memory_limit=-1 so applications cannot override it, setting session.upload_progress.enabled=0, keeping post_max_size conservative, and blocking multipart form data at the web server if your application does not use it. Do not use RLIMIT_AS or RLIMIT_DATA, which the advisory says trigger the vulnerable path. None of these make PHP safe, they only narrow the opening.
6. Put a web application firewall in front: a WAF with rules for this attack can block known request patterns while the update is scheduled. It reduces exposure and does not replace the update. Our guide to web application firewalls explains how they work.
7. Check for signs of compromise: the Canadian Centre for Cyber Security recommends reviewing web server, application, authentication and endpoint logs, and looking into unexpected processes, files, accounts or outbound connections tied to PHP. Report matching activity through My Cyber Portal or contact@cyber.gc.ca.

PHP Vulnerability Risk for Canadian Businesses

Many Canadian small businesses run their website on hosted WordPress, which puts the update in one of two places. On shared hosting, the provider updates PHP for every customer on the server at once. On a virtual private server or a cloud instance, nobody does it unless you or your developer do.

The harder cases are the systems nobody lists as a website: the client portal a contractor built years ago, a staging copy still online, a device whose web console runs PHP. Those are the ones most likely to be missed when the PHP vulnerability is patched everywhere else.

There is a privacy side too. If a compromised server held customer personal information, PIPEDA may require you to report the breach to the Office of the Privacy Commissioner of Canada when it creates a real risk of significant harm, and to notify the people affected.

Where Secur-IT Data Fits

Being straight about our role here. We do not host websites and we do not run your servers, so the update itself belongs to your host, your developer or your IT provider. What our team does is the security layer around it, kept independent of the people who build and run the site.

• Penetration testing shows which of your internet facing systems still answer with a vulnerable PHP build, seen from outside the way an attacker sees them.
• Continuous vulnerability management keeps checking after the patch, with a monthly list for your IT provider of what still needs updating, so the next critical PHP vulnerability is not found by an attacker first.
• 24/7 monitoring with active containment watches the devices we protect for the signs of compromise listed above.

You can read how that works day to day in our overview of 24/7 managed cybersecurity services in Toronto. None of it is complicated. It takes a complete list of where PHP runs, a confirmed fix on each one, and someone watching the systems that have to wait.

Common Mistakes to Avoid

• Assuming the website is the only PHP you run.
• Treating the host’s “rollout in progress” email as proof your own site is done.
• Reading the version number and stopping there.
• Leaving a staging or old copy of the site online.
• Turning on a temporary setting and forgetting the update.
• Waiting for confirmed attacks before acting on a PHP vulnerability.

Frequently Asked Questions

Q: What is the php2shell PHP vulnerability?

php2shell is the name for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, made public on October 21, 2026. Both are rated 9.2 and can let an attacker run code on a web server without logging in. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Q: Does this affect my WordPress site?

If your WordPress site runs on a PHP build without the fix, yes. WordPress is not the flaw, the PHP underneath it is, so the fix comes from whoever manages your PHP, usually your host.

Q: How do I check which PHP version my site uses?

In WordPress, open Tools, then Site Health, then the Info tab, and expand the Server section. Then ask your host whether that build includes the fixes, because some distributions patch without changing the number.

Q: I am on PHP 8.1 or older. What now?

There is no official release for your branch. Plan the move to 8.2 or later, test it on a copy of the site, and ask your host or vendor whether they offer a backported fix in the meantime.

Q: Is a web application firewall enough?

No. A WAF can block known attack requests and buys time, but the PHP project says updating is the only complete fix.

If you want to know which of your systems still run PHP without the fix, and what to close first, our team at Secur-IT Data can walk you through it.

References

1. PHP project: GHSA-w8hw-w9fx-j79w, RCE via OOM corruption (CVE-2026-109618)
2. PHP project: GHSA-6wmf-4rv5-p3rp, RCE via stale global state (CVE-2026-109619)
3. Canadian Centre for Cyber Security: AL26-026 Critical vulnerabilities impacting PHP
4. CERT-EU: Security Advisory 2026-018, Critical Vulnerabilities in PHP
5. UK NCSC: Critical security issue affecting PHP

For securing AI systems as part of a modern security program, SecuritAI is built for exactly that.

Krikor Tengerian

Krikor Tengerian is the CEO and founder of Secur-IT Data Solutions, a Toronto-based cybersecurity firm focused on helping Canadian organizations secure their infrastructure and critical systems. With over 25 years of experience across cybersecurity and IT infrastructure, he has supported organizations in hardening networks, protecting critical workloads, and aligning security controls with business and regulatory requirements.​
Krikor actively shapes the direction and themes of Secur-IT’s educational content, collaborating with AI tools to structure, refine, and expand articles while providing the real-world context, use cases, and review to keep them accurate and practical for readers. He regularly shares insights on OT security, threat detection, incident response, and Canadian cybersecurity compliance to help industrial and commercial organizations better understand and reduce their cyber risk.