On 21 October 2026 the PHP project shipped an emergency security release for two critical remote-code-execution bugs, CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell". A working exploit exists and, according to reports, a single unauthenticated request can trigger it before any application code runs. This is a plain checklist of what to do, collected from the public advisories listed at the end.
1. Know the fixed versions
| Branch | Fixed in |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 and older | no official release; source backports exist for 7.4, 8.0 and 8.1, otherwise ask your vendor or upgrade |
Every PHP installation that serves web requests is in scope (PHP-FPM, Apache with mod_php, CGI, FrankenPHP, LiteSpeed). Setups using mod_php are described as the most exposed.
2. Find out what you are running
- WordPress: Tools → Site Health → Info → Server.
-
Shell access:
php -v(and check the version your web server actually uses, which can differ from the CLI). - Caveat: Linux distributions often backport fixes without changing the version number. An older-looking number is not proof you are unpatched; check your distribution's or host's security notice.
3. Act according to how you host
- Managed WordPress hosting: look for your host's status page or e-mail confirming the patch. Usually nothing to do.
- Shared hosting: ask your host directly whether the 21 October release is applied. If your PHP selector shows 8.1 or older, move to 8.2+.
- VPS / self-managed: install your distribution's updated PHP packages now and restart PHP-FPM / the web server so every worker runs the fixed build. Remi repository users were advised that updates would not be available on release day.
- Behind Cloudflare: Cloudflare deployed WAF rules for known vectors. Check they are set to block, not log. Treat this as a stop-gap, not a fix.
- Stuck on 8.1 or older: take a full backup, test 8.2+ on a staging copy, then switch.
4. If you cannot patch today
Advisories mention disabling session.upload_progress.enabled as an interim measure against one vector of CVE-2026-109619, and the UK NCSC recommends taking systems offline if they cannot be fixed promptly. Only the update is a complete fix.
Sources
- Help Net Security: https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/
- Codeable (WordPress guidance): https://www.codeable.io/blog/php-vulnerability-cve-2026-109618/
- IPA (Japan) alert: https://www.ipa.go.jp/security/security-alert/2026/pre-alert20261021.html
Written by listingworks, a small data service in Yokohama. Facts as of 22 October 2026; check the advisories above for updates.
Top comments (0)