← All news
Security advisory

PHP2Shell: what to check on your website this week

Updated October 26, 2026

Two critical flaws in PHP let an attacker run code on a web server without logging in. Any site built on WordPress, WooCommerce or other PHP software should confirm its PHP version has been updated.

At a glance

WalterSignal
Not affected. No WalterSignal system or WalterSignal-hosted client site runs PHP. Checked October 26, 2026.
Flaws
CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell")
Severity
9.2 of 10 (CVSS v4.0), both
Fixed in
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21, 2026
Highest risk
Apache with mod_php
Status
Attack traffic and public exploit code observed

What happened

On October 21, 2026, the PHP project released emergency updates for two flaws in how PHP handles incoming web requests. Under the right conditions, an attacker who can reach the site over the internet can run their own code on the server. No login is needed.

The demonstrated attack on Apache mod_php triggers before any of the website's own code runs, so a login page, a security plugin or a strong password does not stop it. Cloudflare reported attack traffic within days, and proof-of-concept exploit code is public.

Who is affected

Any website where PHP answers web requests. That includes WordPress, WooCommerce, Drupal, Joomla and Magento sites, and most shared hosting plans. PHP's advisory names PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.

Sites whose servers do not run PHP are not affected. If you do not know what your site runs on, the steps below start there.

PHP 8.1 and older no longer receive updates from the PHP project. The project released source patches for 7.4, 8.0 and 8.1, and some hosts ship their own patched builds, but a site on those versions should plan a move to a supported version. PHP 8.2 reaches end of life on December 31, 2026.

What to do this week

  1. Find out whether your site runs PHP. If it is built on WordPress or WooCommerce, it does. Otherwise, ask your host or developer.
  2. Ask your host which PHP version serves your website, and confirm it is 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a host build that includes the fix. The version shown by php -v on the command line can differ from the version serving web pages.
  3. On shared or managed WordPress hosting, the host applies the update. Ask for written confirmation of the date it was applied.
  4. On a server you manage yourself, update PHP, restart every PHP worker and service, then confirm the version that serves web requests.
  5. If you cannot update today, apply PHP's interim settings: set session.upload_progress.enabled=0, enforce memory_limit=-1 through the server or pool configuration, set a low post_max_size, then restart every worker. These reduce the risk. They do not remove it.
  6. Put a web application firewall in front of the site. Cloudflare states that its free and paid WAF plans have blocked PHP2Shell by default since October 21.
  7. Do not run the public exploit scripts against your live site to test it. They can tie up the server and write data to disk.

Signs of an attack

Look in the server error logs for bursts of "Allowed memory size exhausted" errors that end in "Unknown on line 0", for Apache segmentation fault messages, and for the web server starting command shells or download tools.

Researchers also showed that the flaws can leak server memory, which can contain passwords, tokens and API keys. If you find signs of an attack, treat the server as compromised and change every password and key it stores.

A related, lower-risk issue

On October 23, PHP issued an informational advisory for a third issue, CVE-2026-115560. It affects only sites that change PHP's session serializer at runtime, which is unusual. The same session.upload_progress.enabled=0 setting covers it until the next PHP release.

How WalterSignal can help

Patching closes this flaw. It does not close the next one. A site that runs PHP has to be patched again every time PHP ships a security fix, and someone has to be watching when that happens.

  1. Check the current site. A short call establishes what the site runs on, who is responsible for patching it, and what to ask the host this week.
  2. Move off PHP. WalterSignal builds business websites that run with no PHP at all, served from a hosting platform that does not execute it. PHP2Shell does not apply to them, and neither will the next PHP flaw. You own the site and can update its content yourself.
  3. Or harden what stays. When a store or catalog has to remain on WordPress or WooCommerce, the check sets out the patch level to confirm with the host and how to put a web application firewall in front of the site.

Sources

Not sure what your site runs on?

Get a straight answer on your site's exposure.

A short call covers what your site runs on, who is responsible for patching it, and what to ask your host.

Book a call