On October 21, 2026, the PHP project released emergency patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that let an attacker take over a web server with a single unauthenticated request. The NSA is calling the pair “PHP2Shell” and has already issued an advisory urging immediate patching. If your website runs on WordPress (or Drupal, Laravel, Magento, or almost any other PHP application), this affects you.

I spent the last two days checking every site I host and manage. The short version for my clients: every one of you was protected before the patch was even public, and every site is now fully patched. Below I explain what happened, how to tell whether a site you own is at risk, and what to do if it is.

What the vulnerability actually is

This is a flaw in PHP itself, not in WordPress, not in a plugin, and not in anything you configured. Both bugs are rated CVSS 9.2 (critical) and both allow remote code execution, which is the worst category: an attacker can run their own code on your server, install a backdoor, steal your database, or use your site to attack others.

In plain terms:

  • CVE-2026-109618 abuses the way PHP handles running out of memory. An attacker sends a request crafted to exhaust memory at just the wrong moment, and PHP’s cleanup routine ends up trusting data it should not.
  • CVE-2026-109619 abuses leftover internal state. Data from one request can survive in a worker process and get reused by the next request before PHP resets it. The confirmed attack path goes through PHP’s session upload progress feature, which has been on by default since PHP 5.4.

Two things make this one unusually bad. First, the technical details leaked hours before the patch was published, so attackers had a head start. Second, the PHP team says the exploit can fire before any application code runs, so no WordPress security plugin can stop it on its own. Only updating PHP fully fixes it.

Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are end of life and did not get an official release. Ondřej Surý, who we should all appreciate right now, also patched some older versions on his repository if you need these to hold you over: https://github.com/oerdnj

How to tell if your site is at risk

You do not need to be technical to answer this. Work through these four checks.

1. Find out what PHP version your site is running.

In WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section. The PHP version is listed there. Compare it to the table below.

Your PHP version Status
8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer) Patched
Any other 8.2, 8.3, 8.4 or 8.5 release Vulnerable, update now
8.1, 8.0, 7.x or older Vulnerable and end-of-life, no official patch

If you cannot log in to WordPress, your hosting control panel (cPanel, Plesk, or your host’s dashboard) usually shows the PHP version too. Do not rely on online header checkers: VirusTotal’s scan found that roughly four out of five PHP servers hide their version from the outside, so an external tool saying “no version found” tells you nothing.

2. Check with your host.

If you are on managed hosting, your host is responsible for PHP. Look for an email, a blog post, or a status page entry dated October 21 or 22 that says all sites are patched. WP Engine, for example, published a customer notice and a status page incident confirming every site was patched, and no exploit attempts succeeded. If your host has said nothing, email them and ask directly: “What PHP version is my site on, and have CVE-2026-109618 and CVE-2026-109619 been patched?”

3. Know your exposure.

The PHP team considers the risk highest for Apache running mod_php, which is common on cheap shared hosting and on servers that were set up years ago and never revisited. If you self-host on a VPS, run an old cPanel box, or have a “set it and forget it” server, assume you are exposed until you have confirmed otherwise.

4. If your site was unpatched for any length of time, look for signs of compromise.

The exploit details were public from the early hours of October 21, and scanning started almost immediately. If your site sat unpatched after that, check for:

  • New administrator users you did not create
  • Unfamiliar files in wp-content/uploads, the site root, or wp-includes, especially .php or .html files
  • Modified dates on core files that do not match a WordPress update
  • Unexpected outbound traffic, new cron jobs, or your host warning about resource usage
  • Your site redirecting visitors, showing spam, or getting flagged by Google Safe Browsing. Google yourself and click to visit your website from your Google Business Profile. (Direct visits are not handled the same.)

If you are not sure how to check these, that is exactly the moment to ask someone who does, before deciding you are fine.

What to do if you are exposed

  1. Update PHP first. This is the only complete fix. On managed hosting, open a ticket and ask for the patched release. On your own server, install the vendor package or the fixed release for your branch and restart every PHP worker.
  2. If you cannot update today, apply the stopgaps. Set session.upload_progress.enabled=0 in php.ini or the FPM pool config (not in .user.ini or ini_set, which apply too late), set memory_limit=-1 at the server level, lower post_max_size to 8M if the site does not take uploads, and restart. The PHP team is clear that these reduce exposure but do not make a server safe.
  3. If you are on PHP 8.1 or older, upgrade the branch. There is no supported path forward. The NSA advisory goes as far as recommending that systems which cannot be patched be taken offline until they can be.
  4. Put a firewall in front of the site. Cloudflare and other edge providers shipped emergency rules on October 21. They help, but only if your origin server is not reachable directly, and only until the next variant.
  5. If you found signs of compromise, treat it as a breach. Rotate every password and API key, restore from a backup taken before October 21, and have the site reviewed before it goes back online. Patching a server that already has a backdoor on it does not remove the backdoor.

How my clients fared

Every site on my Hosting & Protection plan came through this clean. None of them were running a vulnerable PHP version by the time the exploit details were circulating, and none of them required a single action from the client.

Here is why. I do not put client sites on shared hosting or a bargain plan. Every site on my Hosting & Protection plan lives on WP Engine’s Agency tier, which I hold as a WP Engine Agency Partner. That tier runs each site in its own container on dedicated resources, with PHP and MySQL updates managed at the platform level. The difference between that and a $10-a-month plan is not just speed; it’s security and peace of mind knowing who is on the hook when something like this happens at midnight.

And this is what happened at midnight. Based on WP Engine’s published timeline, shortly after 12:00 AM Central on October 21, before the official patch existed, their security team turned on firewall rules to block the attack traffic. By 3:00 AM Central they had applied the recommended PHP mitigations across the platform. Once the official patch arrived from their enterprise PHP support vendor, they tested it and rolled it out to every site. Over the following 24 hours their firewall blocked more than a million requests tied to these vulnerabilities, with no successful exploit attempts.

The platform is only half of it. The other half is me. On the morning of October 21 I went through every site I manage: confirmed the patched PHP version in Site Health, checked file integrity and administrator accounts, and reviewed the firewall and access logs for anything unusual. Every site came back clean.

That is what the plan is for. The fee is not just for a server. It covers an agency-grade platform with a security team that works through the night, plus a person who knows your site, watches the announcements, and has already confirmed you are fine before you have had your coffee. For an incident like this one, where the fix had to happen in hours, and not days, that difference is the whole ballgame.

If your site is hosted elsewhere and you are not sure where you stand, I am happy to check it for you.

The takeaway

This will not be the last critical PHP bug, and the next one may not come with a day’s warning. Two habits protect you more than anything else: stay on a supported PHP branch (8.2 reaches end of life on December 31, 2026, so plan that move now), and host with someone who treats patching as their job, not yours.

Not sure where your site stands? Book a Discovery Call, and I will check it with you.

Sources