Security · PHP
PHP2Shell (CVE-2026-109618 and CVE-2026-109619): the critical PHP vulnerability and what every WordPress site owner needs to know
In October 2026, two critical PHP vulnerabilities, collectively known as PHP2Shell, were disclosed. Both allow remote code execution without logging in, and because PHP powers an enormous share of the web, they affect WordPress, Drupal and countless other sites too. In this article we go through what this is about, what you need to do now, and why a static site avoids the whole problem.
Breaking: The vulnerabilities are already being actively exploited in the wild. If you run a PHP-based site, update PHP to a patched version without delay. Instructions are below.
PHP2Shell refers to two vulnerabilities in the PHP core, CVE-2026-109618 and CVE-2026-109619. Both allow remote code execution without logging in and they are rated critical (CVSS 9.2). A successful attack can lead to a full server takeover and to the leaking of passwords and keys held in memory.
Because the flaws are in the PHP core, they affect every site running on a vulnerable PHP version: WordPress, Drupal, Laravel and custom applications, regardless of plugins. The single most important action is to update PHP to a patched version (8.5.12, 8.4.27, 8.3.36 or 8.2.35) and restart the server.
A static site does not run a PHP interpreter at all, so a vulnerability based on PHP remote code execution does not apply to it. Novavalo produces exactly these kinds of static sites, so sites built with Novavalo are not exposed to this PHP vulnerability.
What is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?
PHP2Shell is the collective name for two vulnerabilities in the PHP core that were disclosed in October 2026. Both allow remote code execution (RCE) without logging in and they are rated critical in severity (CVSS 9.2). In practice, an attacker can run their own code on the server, which can lead to a takeover of the entire system.
The existence of the flaws became public ahead of the planned schedule, when information leaked online. The PHP developers responded quickly and released an emergency update on 21 October 2026. The vulnerabilities were found by the security company Wiz. Unfortunately, the information leaking meant that attackers also got an early hint: active exploitation of the flaws has been observed in the wild since the day of disclosure, and working proof-of-concept attacks are publicly available.
The name PHP2Shell describes the outcome aptly. The attacker's goal is to get from PHP to the server's command shell, from where they can do practically anything on the site and the server: install malware, steal data, or use the server as a stepping stone for further attacks.
Why did the vulnerability surface only now?
The code behind the bugs had been in PHP for a long time. What is new is not the bug itself but the fact that in 2026 researchers used AI to demonstrate how the bugs can be exploited in practice. An old flaw that had lain dormant for years turned into a real attack.
There had been signs of the second issue back in 2024, but a working attack method was not found at the time and the fix was delayed. This happens often in software: a suspicion of a possible bug does not yet mean that someone knows how to take advantage of it. That is precisely why some vulnerabilities go unpatched for years, until someone figures out how to make them trigger.
In this case the decisive step was taken with the help of AI. The researchers used AI to map out a complex attack chain that would have taken a human considerably more time. The discovery came out of the researchers' own research work, not from investigating an observed breach, which is good news: the fix was ready before widespread abuse. At the same time, the case is a reminder that AI lowers the barrier to building complex attacks. Old bugs that were long considered harmless can become exploitable, and that is one reason why reducing the attack surface is now more important than ever.
Why does this affect WordPress and other PHP sites in particular?
WordPress is built on top of PHP, and these vulnerabilities are in the PHP core, not in individual plugins. That is why they affect every WordPress site that runs on a vulnerable PHP version, regardless of which plugins or themes are installed.
This makes the situation exceptional. Usually WordPress breaches come from plugins, themes and weak credentials, as we wrote earlier in the article WordPress sites keep getting hacked. Here the flaw is deeper: it is in PHP itself, which WordPress runs on. Researchers have shown that the vulnerability can be exploited even against the latest WordPress installations without logging in.
PHP powers an enormous share of the web, so the scope of impact is broad. In addition to WordPress, Drupal, Laravel and many custom PHP applications are also exposed. The risk is especially high when PHP is run with Apache's mod_php module, in which case an unauthenticated request can trigger the attack before any of the application's own protections has a chance to react. PHP-FPM, php-cgi and other execution modes are also exposed.
What do the vulnerabilities mean technically?
Both flaws relate to how PHP handles memory between requests. The details are technical, but the core idea can be summed up clearly.
| Vulnerability | Type | What it is about |
|---|---|---|
| CVE-2026-109618 | Memory corruption on out-of-memory | If the server runs out of memory while PHP's request data is only partially initialised, the cleanup that follows can treat the incomplete data as valid. This can be used for code execution. |
| CVE-2026-109619 | Use of freed memory (use-after-free) | State left over from one request can point to memory that has already been freed. A request processed later in the same worker process can take advantage of this stale state. |
In addition to code execution, the flaws can leak information. They make it possible to read the memory of the PHP worker process, which may contain passwords, session identifiers and API keys. On a WordPress site this can mean, for example, the exposure of database credentials or the keys of third-party services. That is exactly why patching alone is not always enough, and after patching it is worth considering rotating passwords and keys too.
What should you do now?
The most important action is a single one: update PHP to a patched version and restart the server. The update alone fixes the vulnerability completely. Everything else is secondary.
Action list for a PHP site owner
- Update PHP to a patched version. Update PHP to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35 depending on which branch you use.
- Restart the service. Restart PHP-FPM or your web server after the update, so that old worker processes do not keep running on the old code.
- Old PHP version? Contact your host. If you are running PHP 8.1 or older, there is no official binary update. Ask your hosting provider to update to a supported version (8.2 or newer).
- Use temporary mitigations only as emergency relief. PHP Foundation guidance such as limiting the maximum request size (post_max_size) and disabling the session.upload_progress.enabled setting reduces the attack surface but does not replace the update.
- Watch for anomalies. Monitor unusual multipart requests and errors about memory limits being exceeded, which can indicate an exploitation attempt.
- Consider rotating credentials. Because memory may have been read, after patching change database passwords, API keys and other secrets if there is reason to suspect exposure.
- Do not trust fake plugins. Avoid unofficial plugins that claim to patch the vulnerability. Only PHP's official update fixes the flaw.
Which PHP versions are vulnerable and which are patched?
The vulnerability affects practically all PHP versions from years back right up to PHP 8. The table below shows which version you should update to.
| PHP branch | Status | Recommendation |
|---|---|---|
| PHP 8.5 | Patched in version 8.5.12 | Update to version 8.5.12 or newer. |
| PHP 8.4 | Patched in version 8.4.27 | Update to version 8.4.27 or newer. |
| PHP 8.3 | Patched in version 8.3.36 | Update to version 8.3.36 or newer. |
| PHP 8.2 | Patched in version 8.2.35 | Update to version 8.2.35 or newer. |
| PHP 8.1 and older | Vulnerable, no official binary update | Update to a supported version (8.2 or newer). Source code fixes are available for the end-of-life versions 7.4 to 8.1. |
If you do not know which PHP version your site uses, ask your hosting provider or check it in your control panel. For many shared hosting customers the provider handles the update, but it is worth confirming that it has actually been done.
Why does a static site avoid this entirely?
A static site does not run a PHP interpreter at all. The pages are pre-built HTML files that are served as-is through a fast CDN. Because the server does not execute PHP code for every request, a vulnerability based on PHP remote code execution simply does not apply to such a site.
This is where the lesson of the article's image lies. In the tale of the three little pigs, the straw hut and the stick hut collapse to the wolf's huff, but the brick house holds. On the web, the straw hut of PHP and the stick hut of WordPress are constantly buffeted by the wind as new vulnerabilities are found. A static site is the brick house: it has no database, no login panel, no plugins and no server-side code for an attack to latch onto.
It is only honest to say that no platform is magically safe from everything. Even a static site can be assembled carelessly, and forms and external services require their own care. The key point is that this particular class of vulnerability, PHP remote code execution, disappears entirely when a site has no PHP interpreter. At the same time, a large part of the attack surface that cyber criminals probe day after day vanishes with it.
Should I move away from WordPress?
A single vulnerability is no reason to panic, and above all it should be patched immediately. The longer-term question is nonetheless a fair one. If your site is an ordinary company presentation site with a few pages, contact details and maybe a contact form, a heavy PHP-based content management system brings with it an attack surface and a maintenance burden you may not need.
In such a case a static site is a lighter and safer option. You do not have to keep up with weekly security updates or chase after every new PHP or plugin vulnerability. For a large platform that requires a lot of functionality, WordPress may still be a justified choice, but for a presentation site it is often overkill. We wrote about the subject in more detail in the article why we left WordPress, and the whole arc is covered in the history of websites.
Build your site without PHP and without an update watch
Novavalo produces static sites that are not run on PHP or WordPress:
- No PHP interpreter, no database, no plugins, so this kind of PHP vulnerability does not affect your site.
- You tell us about your business and AI builds the pages, which are served through a fast CDN.
- No weekly security maintenance, so you focus on content, not on watching for updates.
Frequently asked questions
What is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?
PHP2Shell is the collective name for two critical PHP vulnerabilities disclosed in October 2026. Both allow remote code execution (RCE) without logging in and they are rated critical in severity (CVSS 9.2). A successful attack can lead to a full server takeover.
Does this affect my WordPress site?
Yes, if your site runs on a vulnerable PHP version. The vulnerabilities are in the PHP core, so they affect every WordPress site regardless of plugins and themes. Researchers have shown that the vulnerability can be used against even the latest WordPress installations without logging in.
What should I do right now?
Update PHP to a patched version (8.5.12, 8.4.27, 8.3.36 or 8.2.35) and restart PHP-FPM or your web server. If you are running PHP 8.1 or older, contact your hosting provider about updating to a supported version. The update alone fixes the problem completely.
Why is a static site not exposed to this vulnerability?
A static site does not run a PHP interpreter at all. The pages are ready-made HTML files served through a CDN. Because no PHP code is executed on the server per request, a vulnerability based on PHP remote code execution does not apply to such a site.
Is a mitigation alone enough without updating?
No. The PHP Foundation published temporary mitigations that reduce the attack surface, but on their own they do not make an installation safe. Only updating to a patched version fixes the vulnerability. Also avoid unofficial plugins that claim to patch the problem.
Does the vulnerability leak passwords and keys?
In addition to code execution, these vulnerabilities make it possible to read the memory of the PHP worker process, which may contain passwords, session identifiers and API keys. In the case of WordPress this can mean, for example, the exposure of database credentials or third-party keys. That is why many recommend rotating passwords and keys after patching as well.
Why is an old bug dangerous only now?
The code behind the bugs had been in PHP for a long time, and there were signs of the second issue back in 2024. A practical attack method was not found at the time, however. In 2026, researchers used AI to demonstrate how the bugs can be exploited. AI lowers the barrier to building complex attacks, so old bugs can become exploitable.
A secure site with no PHP attack surface
Let AI build your business a static site that has no PHP interpreter, no database and no plugins to watch over. You will see the result in a few minutes.
Start for free →Transparency note: This article was produced with the help of AI and Novavalo's editorial team is responsible for its content. The article is general information about security, and does not replace official security advisories. Always check the up-to-date instructions from the official sources listed below.