Today, October 21, 2026, the PHP security team fast-tracked emergency updates to patch two critical Remote Code Execution (RCE) flaws collectively known as "PHP2Shell".
Tracked as CVE-2026-109618 and CVE-2026-109619, these flaws carry a massive severity rating of 9.2 out of 10 (CVSS v4.0). Because technical details and an exploit script leaked online yesterday ahead of schedule, attackers are already actively scanning the internet.
Why This is Massive: It's Not Just WordPress
Because PHP powers roughly 70% of all websites whose server-side language is known, the blast radius of PHP2Shell is staggering.
- The bug is in the PHP engine itself, not your application code.
- Web application firewalls (WAFs) and security plugins are only temporary band-aids.
- Custom applications, enterprise backend portals, and major CMS engines like Drupal, Joomla, and Magento are equally vulnerable.
- In some server environments (like mod_php), an unauthenticated request can trigger code execution before your website's actual code even loads.
What is the Core Issue?
The joint security disclosures outline two highly destructive paths:
- CVE-2026-109618 (RCE via Memory Exhaustion): Out-of-memory errors use a mechanism that can leave internal data in a partially initialized state. A subsequent request cleanup reads this corrupted memory, allowing an unauthenticated attacker to execute code.
- CVE-2026-109619 (RCE via Stale Global State): Internal server structures survive in memory even after being freed. A later request handled by the same backend worker can hijack that stale state to run malicious code.
How to Check Your Vulnerability Status
Every server infrastructure setup running an exposed PHP environment (including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed) must be checked immediately.
Via Command Line (SSH):
Run the following command on your server terminal:
php -v
Via WordPress / CMS Dashboards:
If you are managing a WordPress instance, navigate to Tools ➡️ Site Health ➡️ Info ➡️ Server to view your active running version.
Cross-Reference the Safe Versions:
The emergency patches were deployed to the following branches today. If your server falls below these numbers, you are vulnerable:
| PHP Branch | Vulnerable (below version) | Safe (update to) |
|---|---|---|
| PHP 8.5 | 8.5.11 | 8.5.12 or higher |
| PHP 8.4 | 8.4.26 | 8.4.27 or higher |
| PHP 8.3 | 8.3.35 | 8.3.36 or higher |
| PHP 8.2 | 8.2.34 | 8.2.35 or higher |
| PHP 8.1 / 7.x / 5.x | All versions | End-of-life. No fix is coming. Upgrade to a supported branch immediately. |
Your Action Plan Right Now
1. Apply Server Upgrades Immediately
- Managed Hosting / cPanel: Go to your PHP Version Manager and upgrade to the unvulnerable releases. If your provider hasn't listed them yet, open a high-priority support ticket.
- Linux Packages: Distribution repositories are actively backporting patches. Run your system updates (apt-get update && apt-get upgrade or yum update) to pull vendor-supplied fixes.
- Docker Environments: Rebuild your container arrays. Ensure you clear your base cache and pull down the latest official images stamped with today's builds. Crucial: Fully restart php-fpm or your web server engine to flush the vulnerable shared memory blocks.
2. Temporary Mitigations (If Patching is Delayed)
If your infrastructure team cannot update the core binaries today, international cybersecurity authorities recommend taking highly critical, unpatchable legacy systems completely offline.
Alternatively, you can limit the exploit surface area by disabling targeted features in your server's php.ini file:
opcache.enable = 0
session.upload_progress.enabled = 0
(Warning: Turning off OPcache will result in sudden, severe website performance drops, but it will disrupt the specific type-confusion exploit chains attackers are currently using.)
3. Review Web Server Logs
Check your connection logs for abnormally large POST requests, anomalous multipart file uploads, or a spike in unexpected PHP worker process crashes, which are common indicators of failed or successful exploit attempts.