Security · IHS Blog

PHP2Shell (CVE-2026-109618 and CVE-2026-109619): what WordPress site owners need to know

By the Intelligent Hospitality Systems Team · Published October 23, 2026

Updated October 23, 2026 · We update this page as the story changes. See the changelog at the end.

The short version

  • PHP2Shell is the name for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2.
  • They can allow an attacker with no login to run code on a server through specially crafted web requests. Whether that works on a given server depends on its PHP version, setup and configuration.
  • Affected: PHP 5.4 through 8.5.11. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21, 2026.
  • Attackers started trying immediately. As of October 23, security firms report mass scanning and failed attempts, and no confirmed successful compromise.
  • What to do: ask your host which PHP version your site runs, and make sure it is one of the fixed versions or newer.

What PHP2Shell is

PHP is the server-side language behind WordPress, most shared hosting and a large share of small-business websites. According to Google Cloud, CVE-2026-109618 involves out-of-memory handling that can interrupt PHP while request data is only partly set up, and CVE-2026-109619 lets request data survive after its memory has been freed, so a later request can reuse stale state. SecurityWeek reports remote code execution was confirmed on Apache with mod_php.

Why this is not a WordPress bug, and why it still matters to WordPress sites

The flaws are in PHP, not in WordPress code. That is the confusing part: updating WordPress, your theme or your plugins does not fix PHP2Shell. The fix happens at the server level, usually by your hosting company. Because WordPress needs PHP, every self-hosted WordPress site sits on top of a PHP install that has to be patched.

Timeline

  • October 17, 2026: Amazon Threat Intelligence observed an exploit attempt in its honeypots, four days before public disclosure.
  • October 20: PHP announced an upcoming security release.
  • October 21, 14:00 UTC (10:00 a.m. Eastern): embargo lifted; patched versions released. Proof-of-concept exploits appeared within hours.
  • October 21 to 22: Cloudflare reported tens of thousands of attempts within 45 minutes of the announcement, rising to millions by early October 22.
  • October 22: Sophos first reported one successful exploitation, then corrected it the same day: its telemetry showed scanning and failed attempts only. Some payloads tried to install a Mirai botnet variant called Potassium.

Is it being exploited?

Attempts, yes, at very large scale. Successful compromise: none confirmed as of October 23. Cisco Talos, quoted by The Hacker News, describes most activity as scanning plus uncoordinated payload attempts. Researchers note reliable code execution may be harder than first thought, while watchTowr told SecurityWeek it does not expect that to last. Treat it as urgent to patch, not as proof that any particular site was hacked.

What to do now

  1. Find your PHP version. See our 5-minute guide, or ask your host directly.
  2. If it is below 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on its branch, ask your host to update it today.
  3. If it is 8.1 or older, plan a move to a supported version. Read what end of life means.
  4. Keep WordPress, themes and plugins updated anyway; this month also saw several plugin attacks (see our October roundup).
  5. If you would rather not run PHP at all, a static HTML site has no PHP to patch. Compare the two.

What we are not saying

We are not saying your site has been hacked, or that it will be. We have not scanned anyone's site, and we never do without the owner's permission. Static HTML removes the PHP and database layer; it does not make a site unhackable, and your domain, hosting and email accounts still need strong passwords and two-factor sign-in.

Changelog

  • October 23, 2026: first published.

Questions

Is PHP2Shell a WordPress bug?

No. PHP2Shell is a pair of flaws in PHP itself, the language WordPress runs on. Any site served by an unpatched PHP install can be exposed, whatever plugins or theme it uses.

Does updating WordPress fix PHP2Shell?

No. Updating WordPress core and plugins is still good practice, but the fix is a PHP update on the server: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer.

Have sites been hacked with PHP2Shell?

As of October 23, 2026, security firms report mass scanning and exploit attempts but no confirmed successful compromise. Sophos corrected an earlier report of one successful case. We will update this page if that changes.

What if my site runs PHP 8.1 or older?

Those versions are end of life. Google Cloud reports the PHP project is not releasing official fixed builds for them. Ask your host to move you to a supported, patched version.

Want off WordPress? We convert WordPress sites to fast, secure static HTML on our platform for free, and keep your URLs and Google rankings intact.

See how free conversion works

Sources