PHP2Shell vulnerability: What PHP and WordPress websites need to do right now?

The PHP2Shell vulnerability (CVE-2026-109618 and CVE-2026-109619) is the most critical PHP security incident in over a decade, according to many experts. These two bugs allow attackers to execute remote code (RCE) without authentication on servers running PHP – the language powering about 70% of websites on the Internet, including WordPress.

If you are operating a WordPress website, WooCommerce, or any PHP application, this article briefly explains what is happening, the actual risk level, and what you need to do today.

What is the PHP2Shell vulnerability?

PHP2Shell is the collective name for two vulnerabilities in the PHP core, disclosed on October 21, 2026, and discovered with the assistance of AI:

• CVE-2026-109619: A use-after-free vulnerability in the file upload progress tracking feature of PHP sessions. Old data is freed but the pointer is still reused, opening the door for memory overwrites.
• CVE-2026-109618: A memory corruption flaw that occurs when PHP runs out of memory and skips normal cleanup, leaving uninitialized memory regions to be read back when the request ends.

The dangerous part: an attacker only needs to send a multipart/form-data POST request to any address that accepts file uploads. PHP’s session layer handles the upload process before the application code runs, so no matter how carefully your plugin or theme checks, it cannot be blocked.

Impact level of PHP2Shell

According to Palo Alto Networks, as of October 29, more than 22.6 million PHP servers exposed to the Internet are potentially affected. On October 26, CISA (US) added both vulnerabilities to the known exploited vulnerabilities catalog.

Notable statistics

• A hacker group combined PHP2Shell with a Linux kernel privilege escalation flaw to gain root access on at least 25 Palo Alto firewalls with management interfaces exposed to the Internet.
• Cato Networks recorded about 96% of attacks targeting CVE-2026-109618, with 41% attempting to execute remote commands.
• Security firm Defiant (Wordfence) recorded over 77,000 exploit requests from more than 2,000 IP addresses targeting WordPress websites.

Good news for WordPress users

As of October 28, Defiant has not recorded any WordPress websites compromised via PHP2Shell. The reason: exploit code usually needs to be fine-tuned for each server (PHP build, extensions, memory limits, ASLR, etc.). However, Defiant warns that attackers are still improving their tools, and if successful, they could access all website files, databases, and passwords.

Which PHP versions are affected?

According to Akamai’s analysis, the vulnerabilities affect PHP version 5 and above. The patched versions are:

• PHP 8.5: update to 8.5.12 or higher
• PHP 8.4: update to 8.4.27 or higher
• PHP 8.3: update to 8.3.36 or higher
• PHP 8.2: update to 8.2.35 or higher
• PHP 8.1, 8.0, 7.x and below: end-of-life, must upgrade to a still-patched branch

Note: some Linux distributions (Ubuntu, Debian, RHEL, etc.) backport fixes to older versions, so please also check the security notices of your operating system or hosting provider.

Website protection checklist against PHP2Shell

1. Check your running PHP version

In WordPress, go to Tools → Site Health → Info → Server to view the PHP version. For VPS, run the php -v command and check PHP-FPM as well.

2. Update PHP immediately

If using shared hosting, change the version in cPanel/DirectAdmin or contact your provider. Many hostings and Cloudflare have deployed WAF rules to block PHP2Shell, but WAF is only a temporary protection layer – patching PHP is the root solution.

3. Temporarily disable upload progress if you cannot patch yet

CVE-2026-109619 requires the session.upload_progress.enabled option (enabled by default). If you cannot patch immediately, you may consider setting this value to Off in php.ini after confirming your website does not use the upload progress bar feature. This is a mitigation measure, not a replacement for a patch.

4. Backup and scan for signs of compromise

• Create a full backup (files + database) and store it separately from the server.
• Scan for malware, look for strange PHP files in the wp-content/uploads folder.
• Check for newly appeared admin accounts and access logs with unusual POST activity.

5. Update WordPress to 7.1.4

This same week, WordPress also released version 7.1.4 patching 22 vulnerabilities. See details in the article WordPress 7.1.4: Security Patch.

Long-term lesson: don’t wait until an incident happens

PHP2Shell shows that AI is helping find vulnerabilities faster than ever – and bad actors are exploiting them faster too. A routine maintenance process (updating PHP, core, plugins, backups, monitoring) will help you react in hours instead of weeks. You can refer to the monthly WordPress maintenance checklist to get started.

Conclusion

The PHP2Shell vulnerability affects almost all unpatched PHP servers. The most important thing you need to do right away: check your PHP version, update to the patched version, backup data, and check for anomalies. If you are not sure if your website is secure, please contact Gnurt for inspection and update support.

References: SecurityWeek, Akamai, VnExpress.