Two critical PHP zero-day vulnerabilities let an attacker with no login run commands on your web server. That affects WordPress, WooCommerce, Magento, Drupal, Joomla, Laravel and custom PHP apps. I patch and upgrade PHP servers safely, then check whether anyone got in first.
Almost certainly, if your site runs PHP and hasn't been updated since 21 October 2026. Every PHP version from 5.4 to 8.5.11 is in the affected range. Find your PHP branch below.
| PHP branch | Vulnerable | Fixed in | What to do |
|---|---|---|---|
| 8.5 | below 8.5.12 | 8.5.12 | Patch |
| 8.4 | below 8.4.27 | 8.4.27 | Patch |
| 8.3 | below 8.3.36 | 8.3.36 | Patch |
| 8.2 | below 8.2.35 | 8.2.35 | Patch |
| 8.1 and older (7.x, 5.6, 5.4…) |
All versions | No fix coming | Upgrade to 8.2+ |
Running PHP 8.1 or older? These versions are end of life. The PHP project will not release a PHP2Shell fix for them, so a simple update won't help. The only fix is to upgrade to PHP 8.2 or newer, which often breaks old plugins, themes or custom code. That is exactly the kind of job I handle.
WordPress: go to Tools → Site Health → Info → Server and look for "PHP version".
Server access: run these on the web server.
# PHP version (the CLI can differ from what your web server uses) php -v # Settings that affect exposure to CVE-2026-109618 php -i | grep -E "^(memory_limit|post_max_size)"
Not sure what the output means, or have several sites on shared hosting? Send it to me and I'll tell you where you stand.
The attack is an unauthenticated remote code execution (RCE). A single crafted HTTP request can make the server run the attacker's commands. Strong passwords and 2FA don't stop it.
Requests can return a normal "200 OK" with no crashes and little in your application logs. A tell-tale sign is "Allowed memory size exhausted… in Unknown on line 0" in the web server error log.
The flaws were exploited before patches were out. Attackers use them to plant web shells, steal database passwords from config files and move to other systems. Patching later doesn't remove what was planted.
Hands-on PHP security work from a PHP developer with over 20 years' experience, not a ticket queue.
Rushing a PHP upgrade straight onto a live site is how checkouts and logins break. I follow the same software engineering practice on every job:
A full snapshot of files, database and server config before anything changes, so there's always a way back.
Upgrade the server packages and patch PHP to a fixed release, or move off an end-of-life version.
Test the patched stack on a copy of your site: pages, forms, logins, checkout and plugins.
Roll out to the live site only once staging passes, then confirm the fixed version is the one actually serving traffic.
I'm an Australia-based PHP and AWS consultant who has built and run large PHP eCommerce and SaaS platforms since 2003.
I'm active in the PHP community, which is how I heard about PHP2Shell early and contacted site owners before many knew they were exposed. I've already patched a number of WordPress sites against it using the process above.
You deal with me directly. I explain what I find in plain English and tell you honestly whether you need me at all.
View CredentialsPHP2Shell is the name given to two critical flaws in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. Both are rated CVSS 9.2. They abuse how PHP cleans up after fatal errors such as running out of memory, letting an unauthenticated attacker execute system commands over HTTP.
Yes. Details leaked before the patches were released, and exploitation was reported in the wild straight after. Fixed PHP versions are now available, but any server still on an older version remains exposed.
If your server runs PHP 5.4 through 8.5.11, it's in the affected range. The bug is in PHP, not in WordPress, so updating WordPress, themes or plugins does not fix it. PHP on the server has to be patched or upgraded. The same applies to WooCommerce, Magento, Drupal, Joomla and Laravel sites.
On managed hosting, check that your site actually reports a fixed version (8.5.12, 8.4.27, 8.3.36 or 8.2.35) once the host says it's done. If you're on PHP 8.1 or older, most hosts can't patch it for you. Your site has to be moved to PHP 8.2+, and that may need code changes.
Possibly. Attacks can look like normal traffic, and patching does not remove a web shell or backdoor planted before the fix. If your site was exposed during the zero-day window, a compromise check is worth doing.
A WAF such as Cloudflare or AWS WAF can reduce risk while you arrange the upgrade, but vendors are clear that patching PHP is the only complete fix.
Call, email or send the form. Tell me your site and PHP version if you know it, and I'll get back to you promptly.