Critical PHP vulnerabilities (PHP2Shell): update PHP now

Overview

On 21 October 2026 the PHP project released emergency security updates for two vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, which researchers have nicknamed PHP2Shell. Both are rated 9.2 (critical) under CVSS v4.0 and can allow unauthenticated remote code execution: someone on the internet could run their own code on your web server without logging in.

The ACSC has issued a critical alert and says all PHP versions from PHP 5 onwards may be affected. At the time of writing it is not aware of successful exploitation in Australia, but scanning and exploit attempts have been reported elsewhere, including one observed before the details were made public.

These are bugs in PHP, not in a plugin or a theme. A well-maintained WordPress site is still exposed if the PHP version underneath it has not been updated.

Are you affected?

Probably, if your website or web application runs on PHP and the server has not been updated since 21 October. That covers most WordPress, Joomla, Drupal and WooCommerce sites, and most shared hosting.

• Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or later.
• PHP 8.1 and older no longer get updates from the PHP project. Some Linux distributions and hosting providers backport fixes; otherwise the answer is an upgrade.
• The PHP team rates the risk highest for servers running PHP as an Apache module (mod_php).

Not sure which version you run? Your hosting control panel usually shows it. In WordPress it is under Tools, Site Health, Info, Server.

What to do

1. Ask your host or developer to confirm that PHP has been updated to a fixed version, or that your distribution’s patched package is installed. Get the answer in writing.
2. If you manage the server yourself, update PHP now and restart the web server or PHP-FPM, so the new version is the one actually running.
3. On PHP 8.1 or older, plan the upgrade now. A backported fix buys time, but an unsupported version will not get the next fix.
4. If the server was exposed before patching, look for signs of compromise: new administrator accounts, unfamiliar files in upload folders, and unexpected outbound connections.
5. Do not rely on configuration workarounds. The PHP team says updating is the only complete fix.

Also worth knowing

On 23 October the PHP team published a separate, lower-risk notice (CVE-2026-115560) about session upload progress. It only affects an unusual configuration and has not been reported under attack. The interim advice is to set session.upload_progress.enabled=0 until the next bugfix release.