Introduction
I have patched a lot of WordPress sites in my career, and the routine is always the same: update the core, update the plugins, update the theme, run a backup, move on. It feels complete. This week I learned — again, the hard way — that the routine has a blind spot, and this time the blind spot has a name: PHP2Shell.
I spent the last two days reading the advisories, the CISA listing, and the post-patch reports. The picture is worse than the headlines suggested: exploitation is already confirmed, and millions of servers are still exposed.
If you run a WordPress site — your own, a client's, a store — this one is yours to fix, and the fix is not in your WordPress dashboard. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10, in the language that runs roughly 70 percent of the websites on the internet. Here is what happened, and the checklist I would run on every site I touch this week.
What PHP2Shell Actually Is
PHP2Shell is the nickname researchers gave to a pair of memory-safety failures in PHP's core request handling. They are not the same bug, but they rhyme: both let an attacker turn a normal web request into code execution on the server.
CVE-2026-109618 is the first. When PHP runs out of memory while handling a request, some internal request data is left only half set up, and the clean-up code that runs afterwards treats the half-built data as valid — a confusion that can be steered into running attacker-controlled code. PHP's own advisory describes a demonstrated exploit for this one, which is security-speak for "we watched it work."
CVE-2026-109619 is the second: a use-after-free bug where internal state belonging to one request survives after its memory has been freed, and the next request handled by the same PHP worker process can pick that state up and use it before PHP resets it. One visitor's request leaves a loaded gun on the table; the next request pulls the trigger. Both flaws were disclosed together, patched together, and added to CISA's Known Exploited Vulnerabilities catalog together on October 26, 2026.
The Timeline: Three Weeks of Bad News
The dates matter, because they show how quickly "patch available" turned into "actively exploited."
On October 21, 2026, PHP released the emergency fixes: versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If you run a supported PHP branch, one of those four numbers is your target. The same day, researchers started calling the pair PHP2Shell, and the name stuck.
On October 23, the PHP team warned about a third vulnerability, CVE-2026-115560, which can also be used for remote code execution. This one did not get an emergency release — it will be fixed in the next regular release, and until then the only defence is a settings change. I will come back to that.
On October 25, PHP published a second round of builds — 8.2.35-1, 8.3.36-1, 8.4.27-1, and 8.5.12-1 — because the first emergency releases did not cover CVE-2026-111497, a vulnerability in the Brotli compression library bundled with PHP. The "-1" builds are the ones you actually want.
On October 26, CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog, and the first recorded attack exploiting the flaw happened the same day. That is five days from patch to confirmed exploitation in the wild.
And yet, nearly two weeks after the patches shipped, Censys counted roughly 29 million servers still running a vulnerable PHP version. Kaspersky noted on November 3 that there were still no reports of mass breaches of ordinary websites — but the exposure is enormous. The gap between "patch exists" and "patch installed" is where attacks live.
Which Servers Are at Risk (Probably Yours)
PHP's advisory lists every setup that serves web requests as at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. In plain language, that is nearly every way PHP gets served on the modern web.
PHP singles out Apache with mod_php as the highest-risk deployment, with a demonstrated exploit that fires before your application code even executes. That detail matters for WordPress owners: if your host runs Apache with mod_php — and a huge number of shared hosts still do — the attacker does not need to find a weakness in WordPress at all. The request never reaches WordPress. It detonates in the PHP layer underneath it. PHP-FPM, the setup most managed WordPress hosts use, is not safe either: the advisories document application-dependent exploitation paths for FPM, and a public research toolkit published an FPM exploit chain on October 30.
Here is the part I keep repeating to clients: updating WordPress, your plugins, and your themes does not fix PHP2Shell. WordPress.org has said plainly that no WordPress update is required or planned for this, because the flaw is not in WordPress. Your WordPress dashboard can show every green tick in the world while the PHP underneath it is still vulnerable. The fix lives on the server, in the PHP version, and only your host — or you, if you manage the server — can apply it.
How to Check Your Site in Two Minutes
You do not need to be a sysadmin to find out whether you are exposed. Here is the check I run, in order.
First, find your PHP version. In the WordPress dashboard, go to Tools, then Site Health, then the Info tab, and expand the Server section. If you do not have dashboard access, ask your host — a one-line support ticket, "What PHP version is my site running, and has it been patched for CVE-2026-109618?" — gets a straight answer from any competent host.
Second, compare it against the fixed versions. You are safe from these two CVEs if you are on PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (preferably the "-1" rebuilds). Anything lower on those branches is vulnerable. And if you are on PHP 8.1 or older, there is no official release for you at all — the PHP project published patches for the unsupported 7.4, 8.0, and 8.1 branches, but applying them is your host's job. PHP 8.2's security support ends on December 31, 2026, so even the 8.2 branch is on a countdown.
Third, do not stop at the version number. Ask your host whether they applied the October 25 "-1" rebuilds and the settings mitigations for the still-unfixed CVE-2026-115560. A host that answers those two questions precisely is a host that is on top of this.
Fourth, if you manage your own server, the patch itself is the easy part — update the PHP packages, restart the PHP process or the web server, and re-check the version. The harder part is the hunting: check logs back to October 17 for signs of exploitation attempts, because the flaw was being probed before the patch landed. Look for unusual POST requests, unexpected processes, and files you do not recognise in your web directories. If you find something you cannot explain, treat it as a compromise until proven otherwise.
The Third Flaw Nobody Is Talking About
The two CVEs in the headlines are patched. The third one, CVE-2026-115560, is not, and it deserves more attention than it is getting.
Announced on October 23, two days after the main fixes, it can also be used for remote code execution. There will be no emergency release for it — PHP will fix it in its next regular release, and until then the only protection is configuration. On November 3, PHP revised its mitigation advice: lower the max_input_nesting_level setting, put limits on input variables, multipart parts, headers per part, and uploads, and block multipart requests at the front end entirely where your application does not use them.
That last recommendation is the important one for WordPress owners. WordPress does use multipart requests — every media upload is one — so you cannot block them outright. But you can tighten the limits, and if your site sits behind a firewall or a CDN such as Cloudflare, which pushed updated rules for this on November 3, those rules are worth enabling.
The honest summary is this: a fully patched server is protected against the two headline flaws, but the PHP stack is not fully clean, and it will not be until the next regular PHP release.
What I Am Doing Differently After PHP2Shell
I build and maintain WordPress sites for a living, and this incident changed a few of my habits in ways I intend to keep.
The first change is that PHP version is now part of every site health check I run, not a footnote. WordPress Site Health already shows it, and I had been glancing past it for years because the number rarely mattered. It matters now.
The second change is about where I look for security news. I used to watch WordPress security channels — plugin vulnerability mailing lists, Wordfence alerts, the WordPress core blog. Those are still essential, but PHP2Shell did not come through any of them first. It came through the PHP project, CISA, and the server security world. If you only watch your application's security news, you will miss the vulnerabilities in the layers underneath it.
The third change is about hosting. I have always chosen hosts for speed and support response times. I am now also asking, before I recommend a host, how fast they roll out emergency PHP patches. The hosts that patched within 24 hours of October 21 earned real trust this month.
And the last change is the simplest: I am treating the gap between patch release and patch installation as a risk in itself. Five days passed between the PHP2Shell patches and the first recorded attack. The window for "I'll get to it next week" is not a week long. It is about five days.
Conclusion
PHP2Shell is the kind of vulnerability that should recalibrate how every WordPress site owner thinks about security. It was not a bad plugin or a weak password. It was a flaw in the language itself, rated 9.2 out of 10, exploited within five days of the patch, and still present on tens of millions of servers two weeks later — including, in all likelihood, servers running sites whose owners believe they are fully up to date because their WordPress dashboard says so.
I have written a lot of WordPress security articles over the years, and most of them end with the same advice: keep everything updated. This one ends differently, because the lesson is different. Keep everything updated — and know what "everything" actually includes. Your plugins are not your stack. Your stack is the server, the language, and the libraries underneath the application you see, and this month, that is where the danger was.
Check your PHP version today. If it is below the fixed versions, open a ticket with your host today, not next week. If you manage the server yourself, patch it, restart PHP, and spend an hour hunting through your logs back to October 17.
Frequently Asked Questions
Does updating WordPress fix PHP2Shell?
No. The flaws are in PHP itself, not in WordPress. WordPress.org has said no WordPress update is required or planned. Updating WordPress, plugins, and themes is still good practice, but it does nothing about these two CVEs — the fix is a PHP version update on the server.
Which PHP versions are safe from PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released on October 21, 2026, fix both CVEs. Prefer the October 25 "-1" rebuilds, which also fix a Brotli library flaw, CVE-2026-111497. PHP 8.1 and older have no official fixed release, though the PHP project published patches for the unsupported 7.4, 8.0, and 8.1 branches.
Is my WordPress site at risk if my host uses PHP-FPM instead of mod_php?
Yes. PHP identifies Apache with mod_php as the highest-risk setup, with a demonstrated exploit, but PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed are all listed as at risk, and FPM exploit chains have been published. Every setup that serves web requests through PHP needs the patched version.
How do I check which PHP version my WordPress site runs?
In your WordPress dashboard, go to Tools, then Site Health, then the Info tab, and expand the Server section — the PHP version is listed there. Alternatively, ask your hosting provider directly, and confirm they have applied the October 21 patches and the October 25 rebuilds.
Is PHP2Shell actually being exploited, or is it theoretical?
It is being actively exploited. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 26, 2026. Honeypot researchers recorded more than 1,200 successful exploitations, attackers chained the flaw with a Linux kernel vulnerability to take root control of 25 servers, and Mirai botnet payloads have been delivered through it. Censys data from early November showed around 29 million servers still running vulnerable PHP.
