PHP2Shell: critical PHP vulnerabilities and what businesses must do
News date: 2026-10-21 · Last source review: 2026-10-23
On 21 October 2026, the PHP project released emergency security fixes for two critical vulnerabilities collectively called PHP2Shell. CVE-2026-109618 and CVE-2026-109619 can, under specific conditions, lead to unauthenticated remote code execution. These are vulnerabilities in the PHP runtime serving web requests, not flaws restricted to a particular WordPress plugin.
What are the vulnerabilities?
One issue involves abnormal out-of-memory handling, while the other involves internal request state that may remain accessible after memory is freed. Both can create memory-safety conditions potentially allowing execution with the PHP worker’s privileges. PHP-FPM, Apache mod_php and other PHP web-serving integrations must be assessed.
- Keeping WordPress core updated alone does not address a vulnerable PHP runtime
- Identify the exact PHP execution mode in production
Which releases contain fixes?
PHP published fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October, or later security-fixed builds within these branches. End-of-life branches need a supported migration path. Linux distributions and hosting vendors may backport security patches, so confirm security status using the vendor advisory and package build information, not only the upstream-looking version string.
- Check the PHP runtime used by the web server, not just the CLI binary
- Prioritize systems exposed to the internet
Immediate business response
Inventory PHP systems, determine exposure, take verified backups, deploy the relevant fixes, test critical workflows and monitor logs. If remediation cannot happen promptly, assess isolation or temporary withdrawal of vulnerable web-facing services. A WAF is a defense-in-depth control, not a replacement for patching the PHP runtime.
- Validate backups and restore capability
- Review web and application logs for anomalous activity
- Test forms, authentication and external integrations after patching
What about WordPress?
WordPress relies on PHP, so the fix belongs in hosting or server administration. The WordPress security announcement states that a separate WordPress core release is not required or planned for these particular vulnerabilities. Managed hosting customers should seek confirmation of applied security fixes. Self-hosted operators need to verify the installed runtime and deployment status.
- Do not upgrade a production major PHP branch without compatibility testing
- Continue monitoring vendor advisories and indicators of malicious activity
VALUE360 supports exposure reviews, safe maintenance windows and documented PHP patch workflows.
Explore the related VALUE360 service →
Technical references
- PHP.net — 2026 release announcements
- ENISA — PHP security advisory
- WordPress — PHP security notice
- NCSC — Critical PHP security advisory
Remediation prioritization
Prioritize by actual exposure, affected software versions, privileges and signs of compromise—not headline severity alone. Confirm affected releases and mitigations against the vendor advisory.
Implementation questions
Does this automatically affect our environment?
No. First verify whether the specific product, version and relevant configuration are deployed.
Is a security tool enough on its own?
No. Combine patching, restricted access, logging and tested backups.