Two critical PHP vulnerabilities could enable unauthenticated remote code execution. Learn which versions are affected, the security fixes and how WordPress website owners can protect their servers.
Critical PHP Security Flaws Put Millions of Websites at Risk; Experts Urge Immediate Updates
Two vulnerabilities could allow attackers to execute malicious code without authentication
News National | Technology & Cybersecurity | 24 October 2026
Two critical security vulnerabilities discovered in PHP, one of the world's widely used web programming languages, have triggered urgent warnings from cybersecurity agencies. The flaws could allow attackers to execute malicious code on vulnerable servers without logging in, potentially putting websites, applications and sensitive data at risk.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have received a severity score of 9.2 out of 10 under the Common Vulnerability Scoring System (CVSS) version 4.0. Security researchers refer to the vulnerabilities collectively as “PHP2Shell.” The PHP development team released security fixes on 21 October 2026. https://www.php.net/archive/2026.php
The US Cybersecurity and Infrastructure Security Agency (CISA), European cybersecurity authorities and other security organisations have urged administrators to identify affected systems and apply the available updates without delay. https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42ff5ac
What Are the PHP Vulnerabilities?
PHP is used to build dynamic websites, content management systems, online services and business applications. It often operates behind the scenes, processing requests and interacting with databases and other server components.
The newly disclosed vulnerabilities involve flaws in PHP's internal memory management and request-handling processes.
According to the official PHP advisory:
Under certain conditions, these weaknesses can allow an attacker to execute code on a vulnerable server without authentication. This could potentially lead to server compromise, unauthorised access to information or further attacks against connected systems. https://www.php.net/archive/2026.php
Which PHP Versions Need Updating?
The PHP project released the following security versions to address both vulnerabilities:
| PHP branch |
Security-fixed version |
| PHP 8.5 |
8.5.12 |
| PHP 8.4 |
8.4.27 |
| PHP 8.3 |
8.3.36 |
| PHP 8.2 |
8.2.35 |
Administrators should confirm the applicable security fix with their operating-system vendor or hosting provider, particularly when PHP updates are delivered through managed hosting or enterprise support channels.
PHP 8.1 and earlier branches are no longer supported by the main PHP project. Some vendors may provide backported fixes, but users should verify that protection is in place rather than assuming their older installation is secure. https://www.php.net/archive/2026.php
Why WordPress Websites Should Pay Attention
The security warning is particularly relevant to WordPress users because PHP powers much of the platform's server-side functionality.
The WordPress project has clarified that these vulnerabilities affect PHP itself, rather than WordPress core specifically. Consequently, updating WordPress, installing new themes or updating plugins does not by itself resolve an unpatched PHP vulnerability.
Website owners should check their hosting environment and confirm that the underlying PHP runtime has received the necessary security updates. https://wordpress.org/news/2026/10/critical-php-security-release/
News websites, e-commerce platforms, business portals and other services that process public internet requests should prioritise their checks.
What Could Happen if a Server Remains Vulnerable?
If an attacker successfully exploits a vulnerable PHP installation, the consequences may extend beyond a temporary website outage.
Potential risks include:
-
Unauthorised execution of commands or code on the server.
-
Exposure of sensitive application data or credentials, depending on the circumstances.
-
Installation of malicious files or other unauthorised modifications.
-
Attempts to compromise connected databases, applications or infrastructure.
-
Disruption to website availability and damage to organisational reputation.
These are potential consequences of successful exploitation, not evidence that every affected website has already been compromised.
Cybersecurity teams should investigate suspicious server activity and treat unexplained changes to files, processes or application behaviour as possible indicators requiring further examination.
What Website Owners Should Do Immediately
Security experts recommend a coordinated response rather than relying on a single protective measure.
1. Identify the PHP version. Check the hosting control panel, server configuration or WordPress Site Health information to determine which PHP runtime the website uses.
2. Install the appropriate security update. Update to a fixed release or confirm that the hosting provider has applied an equivalent vendor-supported security patch.
3. Contact the hosting provider. Managed hosting customers should request written confirmation of the PHP version, patch status and any additional mitigation measures.
4. Review server logs. Look for unusual PHP worker activity, unexpected command execution, suspicious downloads and unauthorised file changes.
5. Strengthen access controls. Review administrator accounts, authentication settings, backup availability and access to server management tools.
6. Investigate suspected compromise. If there are indications of an intrusion, preserve relevant logs, isolate affected systems where necessary and engage qualified incident-response specialists.
CISA advises organisations that cannot update affected systems immediately to consider taking vulnerable PHP-based systems offline until they can be patched. A web application firewall may provide an additional layer of protection, but it should not be treated as a substitute for installing the security fix. https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42ff5ac
An Additional PHP Security Advisory
A separate advisory published on 23 October 2026 identified another potential PHP security issue, tracked as CVE-2026-115560, involving session upload-progress functionality.
According to Cloudflare's technical update, the issue also affects otherwise patched PHP releases, including PHP 8.5.12. Website operators should consult the latest official PHP guidance for appropriate configuration changes and subsequent fixes. https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
Administrators should therefore review the latest advisories rather than assuming that installing the first security release resolves every PHP-related risk.
Conclusion: Patch First, Investigate and Verify
The PHP2Shell vulnerabilities highlight the importance of securing the software components that operate behind websites and online services.
For website owners, the immediate priority is to identify affected installations, apply the appropriate fixes and verify that the updates are effective. Organisations should also examine suspicious activity and maintain reliable backups and incident-response procedures.
For WordPress publishers and businesses that depend on uninterrupted online services, checking PHP security should be treated as a server-level responsibility, separate from routine content-management-system maintenance.
News National | Technology | Cybersecurity | Website Security
Sources and references
-
PHP project — Official security releases: https://www.php.net/archive/2026.php
-
US Cybersecurity and Infrastructure Security Agency — Critical PHP vulnerabilities require immediate patching: https://content.govdelivery.com/accounts/USDHSCISA/bulletins/42ff5ac
-
WordPress.org — Critical PHP Security Release: https://wordpress.org/news/2026/10/critical-php-security-release/
-
CERT-EU — Critical Vulnerabilities in PHP: https://cert.europa.eu/publications/security-advisories/2026-018/
-
Cloudflare — PHP vulnerability protections and related advisory: https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
Editorial disclaimer: This article is based on published security advisories available as of 24 October 2026. Vulnerability status and remediation guidance may change. Website operators should consult the official PHP advisory and their hosting or software vendors for current instructions.
