Critical PHP Security Release

The PHP project's October 21, 2026 emergency release fixes two critical vulnerabilities — nicknamed 'PHP2Shell' by researchers — that allow unauthenticated remote code execution before application code even runs. This is not a WordPress-specific flaw, and active exploitation is confirmed: Amazon Threat Intelligence recorded exploitation attempts starting October 17, four days before public disclosure, and multiple public exploits now exist. Update PHP immediately: fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and on EasyApache 4 servers the fix ships in EasyApache 4 25.91 or later.

Critical 2026-10-21

WordPress

What this means under a SharedLicense license

Because the flaws live in the PHP engine itself, any PHP application on an unpatched server — regardless of how well-built it is — can be taken over by an unauthenticated attacker. Broad real-world exploitation makes every unpatched host a target, not a hypothetical.

The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP.

Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application firewall (WAF) rules in place to mitigate the vulnerabilities, but you should still check for updates from your web host and, if necessary, update PHP as soon as possible.

Within WordPress, you can see which version of PHP your site runs under Tools > Site Health > Info > Server. Many web hosts provide this information in your web hosting administration panel too.

These vulnerabilities are not specific to WordPress and affect any server that hosts a PHP application. No WordPress update is required or planned for these issues.

Versions of PHP prior to 8.2 no longer receive security updates from the PHP project.

If your site runs a version prior to this and you manage your own web hosting, you should consider taking your server offline while you prepare to update to a newer version of PHP. This advice is being published by several national cyber security agencies. To quote the UK National Cyber Security Centre:

Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.

Further information on wordpress.org:

Frequently Asked Questions

What is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?

PHP2Shell is the researchers' nickname for two critical PHP engine vulnerabilities disclosed on October 21, 2026. CVE-2026-109618 is memory corruption during out-of-memory handling; CVE-2026-109619 involves stale global state. Both lead to unauthenticated remote code execution before application code runs. They are rated CVSS v4.0 9.2 — the PHP Foundation notes an earlier circulating score of 10.0 was incorrect.

Is PHP2Shell being exploited?

Yes. Amazon Threat Intelligence reported exploitation attempts beginning October 17, 2026 — four days before the coordinated public disclosure — and security vendors including Rapid7 and CERT-EU confirm multiple public exploits are available. Patch immediately; assume internet-facing PHP servers are being actively targeted.

Which PHP versions fix PHP2Shell?

The October 21, 2026 release: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. End-of-life branches (8.1 and older) receive no official releases, but the PHP security team published minimal source backports covering PHP 7.4 through 8.1 — which is how distribution and panel vendors (including cPanel's EasyApache 4) ship fixes for legacy branches.

Is there a mitigation if I cannot patch yet?

Partial ones only: PHP suggests making memory_limit=-1 non-overridable (for CVE-2026-109618), disabling session.upload_progress and, on PHP 8.5, fatal_error_backtraces (for CVE-2026-109619), plus cgroup/container memory caps — and restarting every PHP worker after the changes. Vendors are explicit that these do NOT make an installation safe; patching is the only real fix.

How do I check and update my PHP version?

In WordPress, open Tools → Site Health → Info → Server; hosting panels show the same. Then update to a fixed release — via your host, or on EasyApache 4 servers via WHM → EasyApache 4 → Update (25.91+), and confirm the running PHP version matches a fixed release above.

References

Security Advisories

Related Advisories

WordPress 7.1.3 Maintenance and Security Release

2026-10-06

WordPress 7.1.2 Release

2026-09-22

LiteSpeed Cache for WordPress CVE-2026-76579: Reflected Cross-Site Scripting (XSS)

2026-09-19

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System