If your website runs on PHP, I recommend treating this as an emergency update. On 21 October 2026, the PHP project released fixes for two critical vulnerabilities that can let an unauthenticated attacker execute code on an affected server. Both carry a CVSS v4.0 score of 9.2.
The vulnerabilities, also known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. watchTowr reports exploitation in the wild, and Cloudflare reports attack traffic targeting its customers. I would prioritise internet-facing PHP services immediately.
Who needs to act?
The PHP project’s advisory identifies all PHP installations serving web requests as at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project considers mod_php the highest-risk configuration: a demonstrated attack can reach the vulnerable path before application code starts running.
For WordPress owners, the important distinction is that updating WordPress, plugins or themes does not update the PHP runtime. PHP is part of the hosting environment. If your host manages it, ask the host to confirm that the PHP version serving your site has received the fix. If you manage a VPS or dedicated server yourself, check who is responsible for installing the packages and restarting the services.
What goes wrong inside PHP?
- CVE-2026-109618: out-of-memory corruption. A memory allocation failure can interrupt PHP while internal request data is only partly initialised. Request cleanup can then use that incomplete data as if it were valid, opening a path to remote code execution.
- CVE-2026-109619: stale global state. A worker can retain references to memory that belonged to an earlier request and has already been freed. A subsequent request handled by that worker can access the stale state before normal initialisation replaces it.
The exact attack conditions vary with the PHP build, configuration and request handling. Using PHP-FPM instead of mod_php is not a reason to skip the update.
Fixed PHP versions
Install the fixed release for your PHP branch, or a later security release:
- PHP 8.5: 8.5.12
- PHP 8.4: 8.4.27
- PHP 8.3: 8.3.36
- PHP 8.2: 8.2.35
PHP 8.2 reaches upstream end of life on 31 December 2026. Patch it now and plan the move to a supported branch.
PHP 8.1 and older no longer receive regular security releases from the PHP project. Upgrade to a supported branch or obtain a confirmed backported fix from your distribution or support vendor. The PHP security team has provided minimal source backports for PHP 7.4, 8.0 and 8.1 for people building from source; these are not ready-to-install packages or a return to normal upstream support.
Some Linux vendors backport security fixes without changing the upstream version shown by PHP. In that case, check the full package revision and the vendor’s advisory for these CVEs rather than judging the result from the version number alone.
My recommended update checklist
- Identify every PHP runtime. Check each server, container, site and PHP version selected in your hosting panel. Different sites on one server may use different handlers or versions.
- Take a current snapshot or backup. Confirm that you have a recovery path before making the update. Keep the backup separate from the live web directory.
- Install the patched packages. Use your distribution’s supported package manager, hosting panel or established deployment process. For containers, rebuild with a patched base image and redeploy.
- Restart the affected services. Restart PHP-FPM pools, Apache or the relevant PHP-serving processes so every worker loads the patched runtime. Replacing files on disk does not replace code already loaded in running workers.
- Verify the runtime serving each site. Check the CLI with
php -v, then check the web runtime separately. The CLI binary can differ from the version used by your website. In WordPress, review Tools → Site Health → Info → Server and confirm the handler and package details with your host. If you temporarily usephpinfo(), restrict access and delete the page immediately after checking it because it exposes configuration details. - Test the application. Check important pages, logins, forms and uploads, then review PHP and web-server error logs. Record which package and runtime you verified.
Where to get the update
For cPanel/WHM, check EasyApache 4 package updates and the cPanel documentation. For Plesk, use the panel’s update process and check the Plesk advisory. For CloudLinux Alt-PHP, check the CloudLinux update guidance and confirm coverage for every installed branch.
On Debian, Ubuntu, AlmaLinux, Rocky Linux, RHEL or another distribution, follow that vendor’s security advisory and package instructions. If you use a third-party repository, confirm that its packages include both fixes. I would avoid switching repositories on a production server without checking package compatibility and the rollback plan.
If you cannot patch immediately
The PHP project states that its interim measures only reduce exposure to specific attack paths. They do not make an unpatched installation safe. Follow the current official PHP guidance for your configuration while arranging the update.
I would avoid copying isolated PHP settings from social media. The advisory’s memory-limit changes have operational implications, and some settings must apply before request parsing to have any effect. Ask your administrator to apply the full guidance and restart all affected workers. If an exposed service cannot be patched or adequately restricted, consider temporarily taking it offline.
A web application firewall can provide an additional layer of protection against known attack patterns. It does not replace the PHP patch, and any route that reaches the origin directly also needs attention.
Check for compromise as well as patching
Review unexpected files in web directories, new scheduled tasks, unfamiliar processes, PHP worker crashes, unusual outbound connections and unexplained load spikes. These are investigation leads, not proof that either vulnerability was exploited.
If you find evidence of compromise, preserve relevant logs and isolate the affected workload while you investigate. Patching closes the vulnerability; it does not remove an existing web shell, undo data access or invalidate credentials an attacker may already have obtained.
After the immediate response, remove unused PHP versions and applications, review automatic security-update settings, and restrict administrative access. Keep your CMS, plugins and themes maintained alongside the underlying runtime.