On 21 October 2026 the PHP team released fixes for two critical vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). They let an attacker run their own code on a server without any login or password. A huge share of the web runs on PHP, including WordPress, WooCommerce, Drupal and Joomla.
Why 14 years?
The affected code arrived with PHP 5.4 in 2012. One of the bugs was found in a PHP audit back in 2024, but it was considered unexploitable and never fixed. In 2026 security researchers used AI to find a way to exploit it. Attack attempts were seen even before the official disclosure.
Who is affected?
- Any site running PHP 5.4 to 8.5 that has not been updated yet.
- Especially sites on old PHP versions (7.4, 8.0, 8.1) that no longer receive official updates.
What to do right now
- Check your PHP version. The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. You can see the version in your hosting panel or in WordPress under Tools → Site Health.
- Contact your host. Ask whether the server has been patched. Most large hosts have already installed the fixes.
- On old PHP, plan an upgrade. A site on PHP 7.x is now a serious risk. Moving to a newer version means checking your theme and plugins.
- Review your logs. Researchers advise looking for suspicious activity from 17 October onwards.
The lesson for business owners
A website is not a one-off purchase. The software it runs on needs ongoing maintenance, and someone has to be responsible for applying updates on time. AI now speeds up both finding bugs and attacking them, so the window between disclosure and attacks keeps getting shorter.
We checked and patched the servers of all clients on our maintenance plan as soon as the fixes were out. If you don’t know which PHP version your site runs on, see our maintenance services or ask for a free check.