This article was originally published on ConvertElementor. Read the full article here: https://convertelementor.com/blog/php2shell-the-critical-php-flaw-that-lets-attackers-run-code-on-your-wordpress-server-and-updating-wordpress-won-t-fix-it-november-2026-20261106
Two critical flaws in PHP itself — CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell — let unauthenticated attackers run code on your server. The fixes shipped on October 21, 2026, but Censys data shows about 29 million servers were still unpatched two weeks later.
What PHP2Shell actually is
PHP2Shell is the nickname researchers gave to a pair of memory-safety failures in PHP's core request handling.
- CVE-2026-109618: when PHP runs out of memory while handling a request, some internal resources are not cleaned up properly, opening the door to remote code execution.
- CVE-2026-109619: a use-after-free bug where internal state belonging to one request survives into the next one, which an attacker can also use to run code.
The timeline: three weeks of bad news
- October 21, 2026: PHP released the emergency fixes — versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- October 23, 2026: the PHP team warned about a third vulnerability, CVE-2026-115560, which can also be used for remote code execution.
- October 25, 2026: PHP published a second round of builds — 8.2.35-1, 8.3.36-1, 8.4.27-1, and 8.5.12-1.
- October 26, 2026: CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities (KEV) catalog. This is actively exploited, not theoretical.
Which servers are at risk (probably yours)
PHP's advisory lists every setup that serves web requests as at risk: PHP-FPM, Apache with mod_php, and others. PHP singles out Apache with mod_php as the highest-risk deployment, with a demonstrated exploit.
Here is the part I keep repeating to clients: updating WordPress, your plugins, and your themes does nothing about this one. The flaws are in PHP itself, not in WordPress. WordPress.org has said no WordPress update is required — because the fix has to come from your PHP version.
How to check your site in two minutes
- Find your PHP version. In the WordPress dashboard, go to Tools, then Site Health, then the Info tab, and expand the Server section.
- Compare it against the fixed versions. You are safe from these two CVEs if you are on PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
- Do not stop at the version number. Ask your host whether they applied the October 25 "-1" rebuilds.
- If you manage your own server, update the PHP packages and restart PHP-FPM / your web server so the new build actually loads.
The third flaw nobody is talking about
The two CVEs in the headlines are patched. The third one, CVE-2026-115560, announced on October 23, is not, and it deserves more attention — it can also be used for remote code execution. A fully patched server is protected against the two headline flaws, but WordPress does use multipart requests, so keep watching for a fix for the third flaw too.
What I am doing differently after PHP2Shell
I build and maintain WordPress sites for a living, and this incident changed a few of my habits: PHP version is now part of every site health check I run, not a footnote; I watch PHP security news directly, not just WordPress security channels; and I am treating the gap between patch release and patch installation as a risk in itself.
Bottom line
Check your PHP version today. If it is below the fixed versions, open a ticket with your host today — updating WordPress will not fix it.
Read the full article, including the FAQs, on ConvertElementor: https://convertelementor.com/blog/php2shell-the-critical-php-flaw-that-lets-attackers-run-code-on-your-wordpress-server-and-updating-wordpress-won-t-fix-it-november-2026-20261106
Top comments (0)