PHP2Shell: critical PHP core flaw affects almost every WordPress site

CVE

CVE-2026-109618, CVE-2026-109619

Affected

PHP 8.2–8.5 · WordPress · Joomla · Webserver mit mod_php / PHP-FPM

Patched in

8.5.12 · 8.4.27 · 8.3.36 · 8.2.35

Attacks reported

26 Oct 2026

In short: Check today which PHP version your website runs on. Patched are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older branches (8.1 and earlier) get no official fix and must move to a supported version.

What to do now

1. Find the PHP version: in the hosting panel under “PHP version”, via SSH with “php -v”, or in WordPress under Tools → Site Health → Info → Server.
2. Update to a patched version (8.5.12, 8.4.27, 8.3.36 or 8.2.35) — or get written confirmation from your host that a vendor-patched package is installed.
3. If you run PHP 8.1 or older: migrate to a supported branch. There is no official fix for it. Test plugins and themes for compatibility first.
4. As a stopgap until the update, enable the WAF rules of your host or Cloudflare — with the clear aim of still applying the PHP update the same day.
5. Review access logs from 21 October on: unusual requests to PHP files, new or changed PHP files in upload and cache folders, unknown administrator accounts.
6. Follow-up CVE-2026-115560 (not yet patched): set “session.upload_progress.enabled = 0” in the PHP configuration. PHP rates the attack path as unlikely; no exploitation has been reported.

Who is affected?

• Every PHP installation that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
• The risk is highest with mod_php, where an unauthenticated request can trigger the attack before any application code runs.
• WordPress, Joomla and every other PHP system are affected because the flaw sits below the application — in the PHP core itself.

What is not enough

• WordPress, plugin or theme updates: the flaw is in the PHP core, not in the CMS.
• A firewall or WAF alone: it lowers the risk but does not replace the PHP update.
• Waiting to see whether “the host will handle it”: several large hosts have patched, others were still working on it on 22 October. Ask instead of assuming.

If you may have been compromised

• Update PHP and contain the damage first (maintenance mode, restrict write permissions) — clean up afterwards, not the other way round.
• Renew all credentials: database password, WordPress administrators, SFTP/SSH, API keys and the WordPress salts in wp-config.php.
• Restore from a clean backup taken before 21 October instead of trying to “clean” individual files.
• Call us if you are unsure: a suspicion can usually be assessed within a few hours.

Timeline

1. 21 Oct 2026The PHP project releases unscheduled security updates for two critical flaws after information leaked in advance. Cloudflare reports the first attack attempts against PHP sites at 07:43 UTC.
2. 22 Oct 2026Hosts report their status: mittwald, Hetzner, netcup and Hostinger have updated, IONOS and HostPress were still working on it (as of 11:00). Authorities take services offline as a precaution.
3. 23 Oct 2026PHP discloses another flaw, CVE-2026-115560. It is not patched yet; the fix is planned for the next routine release. Recommended mitigation: session.upload_progress.enabled = 0.
4. 26 Oct 2026The US agency CISA adds CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities (KEV) catalogue. Exploitation in the wild is thereby confirmed by an authority.

Not yet confirmed

• A researcher claims six further unpatched flaws in PHP. The PHP project has not confirmed any of them.
• Whether attackers exploited the flaws before disclosure is open.
• According to one source, the final list of affected versions is still outstanding.

Sources

• CISA — Known Exploited Vulnerabilities Catalog (Eintrag vom 26.10.2026)
• Patchstack — Major security alert: PHP vulnerable to critical RCE
• Codeable — PHP Security Release on 21 October 2026
• GoDaddy — Important PHP security update
• SiteGround — Critical PHP vulnerabilities
• Serverprofis — php2shell: Kritische PHP-Lücke
• security-insider.de — Kritische PHP-Schwachstellen: Behörden gehen offline

This assessment is based on the publications listed above. The vendor’s official notice remains authoritative; we update the advisory when the situation changes.

Get warned in advance next time