PHP2Shell is the name used for a critical PHP vulnerability disclosure involving CVE-2026-109618 and CVE-2026-109619. Website operators should prioritize confirming that their hosting environment has the fixes, rather than treating this solely as another application or plugin update.
The PHP project’s October 21, 2026 security advisory identifies unauthenticated remote code execution risks and urges immediate updates. The upstream fixed releases are listed below.
Illustrative infrastructure photo by Taylor Vick on Unsplash.
PHP2Shell: which PHP versions contain the fixes?
| PHP branch | Fixed upstream release |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
PHP says installations serving web requests are at risk, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. It identifies mod_php as the highest-risk configuration, with an attack demonstrated before application code runs.
Distributions and long-term-support vendors may provide backported fixes. For those packages, verify the vendor’s advisory and complete package revision rather than relying only on the upstream-looking version number. PHP 8.1 and older are outside normal upstream support; consult the vendor or move to a supported branch.
What are the vulnerabilities?
At a high level, PHP’s advisory describes corrupted state after out-of-memory handling and stale request state that survives after its backing memory is freed. The two CVEs cover flaws in the runtime itself. PHP states that updating is the only complete solution; its temporary measures address individual attack paths without making an installation safe.
Wiz’s research report describes demonstrations of remote code execution on WordPress, Drupal and Joomla deployments. It separately reports disclosure of PHP worker memory, potentially exposing secrets without requiring full code execution. Those applications illustrate impact; the underlying issue is not limited to those CMS products.
Does PHP2Shell affect 70% of the Internet?
Wiz’s headline connects the issue to PHP’s broad use across websites. However, technology adoption is not a count of systems confirmed vulnerable, reachable through a particular exploit path or already compromised. “70% of the Internet” should not be read as a measured infection rate.
For an individual site, determine the actual PHP package, configuration and patch status. A market-share headline cannot answer those questions. Conversely, a small or obscure website should not assume that it is outside the risk simply because it has little traffic.
How AI contributed to the discovery
Wiz credits AI-assisted research with helping researchers analyze and adapt complex memory-safety findings. Its report names Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and describes coordination with the PHP team, Calif and OpenAI. This was a coordinated research and remediation effort, not evidence that an autonomous system compromised most websites.
The practical lesson for defenders is to shorten the interval between a verified advisory and a deployed fix. An impressive discovery narrative matters less operationally than knowing who owns each affected service and who can update it.
What WordPress website owners should do
Ask your host about the PHP runtime. A WordPress core or plugin update does not itself replace the server’s PHP installation. Request confirmation covering both CVE identifiers, the installed package revision and the time the fix became active.
Confirm the running service, not just an installed package. Ask whether all serving workers, containers and replicas have been restarted or replaced as required. A command-line PHP version can differ from the version handling browser requests.
Check the site after deployment. Test login, forms, uploads and other important functions. Keep the checks focused on the application features that matter to your users.
Keep an incident-response path available. Installing a fix does not establish that no earlier compromise occurred. If there are suspicious changes or alerts, preserve evidence and ask the hosting or security team to investigate.
A concrete request to send your hosting provider
Use this original template to obtain a useful answer instead of a vague assurance that the server is “up to date”:
Please confirm whether the PHP service handling my domain has fixes for CVE-2026-109618 and CVE-2026-109619. Provide the PHP branch, full package revision, applicable vendor advisory and activation time. Please confirm that every serving worker or instance uses the fixed build, and identify any remaining affected services or required actions.
Do not send passwords or API keys with that request. The provider should be able to establish package and service status through its normal administrative records.
PHP2Shell FAQ
Will a firewall rule replace patching?
Do not treat filtering as proof that the underlying runtime is safe. Follow the PHP advisory and your provider’s current remediation guidance.
Should I run a public exploit to check my site?
Use package verification and vendor confirmation first. An exploit attempt against production can disrupt the service and is unnecessary for establishing whether the documented fixes were installed.
Has this article verified The AI FlowHub’s server?
No. This report covers the public advisory and defensive guidance. It does not certify the patch status of this website or its hosting infrastructure.
Sources checked October 22, 2026. Follow the linked PHP advisory and your operating-system or hosting vendor for updates. No exploit testing was performed for this article.