On October 21, 2026 the PHP project released emergency security updates for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Security researchers nicknamed the pair “PHP2Shell”. Because PHP runs most of the web, including WordPress, Drupal and Joomla, the news reached website owners all over the world, and Armenia is no exception.
What was found
Both flaws are memory-handling bugs. In CVE-2026-109618, PHP can abandon a request when a memory allocation fails and then clean up data that was only partly set up. In CVE-2026-109619, some internal state outlives the memory it points to, so the next request handled by the same worker can read stale data. Both were rated 9.2 out of 10 on the CVSS 4.0 scale. In simple terms, a specially crafted request can confuse PHP’s memory and, in the worst case, let an attacker execute code on the server without logging in.
Who is affected
Any server that runs PHP to serve web pages can be affected: PHP-FPM, Apache with mod_php, php-cgi, LiteSpeed and FrankenPHP. Apache with mod_php is considered the highest risk, because an attack can succeed before any website code runs. Researchers demonstrated attacks against current WordPress, Drupal and Joomla container images, and the discoverers at Wiz said that even a minimal “Hello World” PHP page on a vulnerable version can be exposed. Wiz also claims that the flaws touch around 70% of the internet, which is their own estimate.
Timeline
- Aug 19–24, 2026: Wiz finds the first bug and reports it to the PHP project.
- Oct 17: Amazon’s honeypot records an exploitation attempt four days before disclosure.
- Oct 20: details leak on social media before the planned date.
- Oct 21: PHP ships the fixes and discloses both bugs.
- Oct 26: according to Rapid7, CISA adds the flaws to its Known Exploited Vulnerabilities list.
Sources disagree on how widely the flaws are being exploited. Rapid7 reports public proof-of-concept code and exploitation attempts, while watchTowr says it has seen attacks in the wild since October 21. The sensible conclusion is the same either way: treat this as urgent.
What to do now
The only complete fix is to update PHP to a patched version. We explain the exact versions and the steps in our guide on how to fix PHP2Shell, and in a separate article on checking and upgrading your PHP version.
Frequently asked questions
What does PHP2Shell mean for a small business website?
If your site runs on PHP, which is true for almost every WordPress site, the server’s PHP version matters. An unpatched server can be attacked even if your plugins and theme are fully updated.
Is my WordPress site hacked because of this?
Not necessarily. The flaw creates a risk, it does not mean every site was attacked. Update PHP first, then check for signs of compromise, such as unknown admin users or unfamiliar PHP files.
Who can update PHP on my hosting?
On shared hosting the provider usually patches the server, and you may be able to pick the PHP version in the control panel. On a VPS or dedicated server you or your administrator must do it.
Read next
- How to Fix PHP2Shell: Update PHP and Protect Your Website
- How to Check and Upgrade the PHP Version of Your WordPress Site
- WordPress Security Checklist for Business Websites
Need help keeping your WordPress site secure? We offer maintenance, updates and security checks. Contact us
