PHP2Shell Vulnerability: Is Your WordPress Site at Risk?

Your WordPress website could be running the latest version of WordPress, every plugin could be updated, and your administrator password could be perfectly secure. Yet, your server could still be vulnerable to an attack that doesn't require an attacker to log in.

That's the problem with PHP2Shell, a pair of critical security vulnerabilities disclosed on October 21, 2026. Tracked as CVE-2026-109618 and CVE-2026-109619, these flaws affect the PHP runtime itself, the technology powering WordPress, Drupal, Joomla, and millions of other websites.

Security researchers demonstrated that the vulnerabilities could be exploited to execute code remotely on vulnerable servers without authentication. The flaws carry a reported CVSS v4.0 severity score of 9.2 out of 10.

If your website runs PHP, here's what you need to know, including which versions are affected, how to check your hosting environment, and what to do if your provider hasn't applied the security update.

What is the PHP2Shell vulnerability?

PHP2Shell is the name used for two critical vulnerabilities in the PHP programming language's underlying engine.

PHP is a server-side programming language. When somebody visits a dynamic website, the server can execute PHP code to generate pages, process forms, retrieve database records, and handle other requests.

The problem isn't limited to a particular WordPress plugin or an outdated theme. The flaws exist within PHP's own internal memory-handling mechanisms.

Wiz Research demonstrated remote code execution against WordPress, Drupal, and Joomla. In practical terms, successful exploitation could allow an attacker to execute malicious code with the privileges of the affected PHP process.

Depending on the server's permissions and configuration, the consequences could include stolen credentials, exposed customer information, malicious files, website defacement, or further compromise of the server.

The important distinction is that a vulnerable PHP runtime can put an application at risk even when the application itself isn't the source of the flaw.

Which PHP versions are affected?

The PHP project released security updates on October 21, 2026. The following upstream versions contain the fixes.

PHP branchFixed versionPHP 8.58.5.12PHP 8.48.4.27PHP 8.38.3.36PHP 8.28.2.35

Earlier releases in these branches are affected. PHP 8.1 and older branches are also affected, but many of these releases are no longer supported by the upstream PHP project.

Some hosting providers and enterprise vendors may supply security fixes through backported packages. This means a vendor-maintained build can contain a patch without displaying the same version number as the upstream release.

Don't rely on the version number alone when you're using a managed hosting platform. Ask your provider whether the specific PHP build serving your website includes the fixes for CVE-2026-109618 and CVE-2026-109619.

You can find the official releases on the PHP 2026 news archive and the technical details in the PHP security advisories on GitHub.

Why is this particularly concerning for WordPress websites?

WordPress is one of the most widely used content management systems, and PHP is a core part of its architecture.

Many website owners think about security in terms of their WordPress dashboard. They update WordPress core, install a security plugin, enable two-factor authentication, and assume their website is protected.

Those are useful security measures, but they don't replace updating the software that executes PHP code on the server.

Consider a typical WordPress website. It might have:

WordPress core and several plugins.
A commercial theme.
A database containing customer or business information.
An administrator account and hosting control panel.
PHP running through PHP-FPM, Apache, or another supported server configuration.

The WordPress application and the PHP runtime are separate components. Updating one doesn't necessarily update the other.

That's why a vulnerability in PHP can have implications across many different applications at once.

The same distinction applies to Drupal, Joomla, and custom PHP applications. The vulnerability is in the runtime, not just in one CMS.

How do the two PHP2Shell vulnerabilities work?

You don't need to understand PHP's internal source code to understand why these vulnerabilities matter. The underlying issue is how the runtime handles memory when something goes wrong.

1. CVE-2026-109618: Unsafe memory handling during errors

Modern software allocates memory while processing requests and releases it when that memory is no longer needed.

PHP can encounter an out-of-memory condition while processing a specially crafted request. The problem identified in this vulnerability involves internal state that can be left inconsistent when execution is interrupted.

Under certain conditions, subsequent processing can treat invalid or previously released memory as if it were still valid.

This creates an opportunity for memory corruption and, in demonstrated attack chains, remote code execution.

Wiz also reported a related memory-disclosure issue that could expose information held in a PHP worker's memory. Depending on the application and server, that information may include sensitive data from other requests.

2. CVE-2026-109619: Stale internal state and memory reuse

The second vulnerability involves internal PHP state that can retain references to memory that has already been freed.

Think of it as a worker keeping an old reference to a storage location after the information at that location has been discarded and the space reused.

If the worker later treats that old reference as valid, it may access or manipulate data incorrectly.

The researchers demonstrated that this type of memory-safety failure could be developed into remote code execution. The research also describes a separate issue involving OPcache, PHP's bytecode caching system, where inconsistent shared state can contribute to type confusion and memory corruption.

These are different technical paths, but the broader lesson is the same: software must safely manage its internal state, especially when an error interrupts normal execution.

Both vulnerabilities are rated CVSS v4.0 9.2. That rating signals serious potential impact, but it doesn't mean every server is equally easy to exploit. The server configuration and conditions required for a successful attack matter.

Does using Cloudflare protect your website?

Cloudflare announced that it deployed PHP2Shell protections for customers using its web application firewall, including free-plan customers with the WAF deployed.

That's useful protection. A web application firewall can inspect traffic and block requests associated with known attack patterns.

But there's a distinction between blocking an attack and fixing the vulnerable software.

A WAF operates as an additional defensive layer. It doesn't automatically replace the vulnerable PHP runtime installed on your origin server.

Cloudflare itself recommends patching affected PHP installations even when its protections are in place.

You should also avoid assuming that simply pointing a domain's DNS through Cloudflare means every possible attack path is covered. Your configuration, enabled security features, origin exposure, and hosting environment all matter.

Read Cloudflare's PHP2Shell security update for details about its mitigation.

How to check whether your website is affected

The first step is to identify which PHP runtime actually serves your website.

Step 1: Check your PHP version

If you're using WordPress, open your dashboard and navigate to:

Tools → Site Health → Info → Server

Look for the PHP version listed in the server information.

You can also check the PHP version in your hosting control panel, depending on your provider.

If you manage the server yourself, run the following command in your terminal:

php -v

Be careful with this result. The command shows the PHP version used by your command-line environment, which may differ from the version serving your website.

For example, a server might use one PHP version for command-line scripts and a different version for PHP-FPM or Apache.

Verify the actual runtime serving web requests.

Step 2: Confirm whether the security fix is installed

For the standard upstream releases, check that your runtime is on PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or a later patched release in the same supported branch.

If you're using an older branch, check with your distribution or hosting vendor about the exact security fix and its support status.

Don't assume an older version is safe simply because your hosting dashboard says PHP is supported.

Step 3: Contact your hosting provider if you can't update PHP

Many website owners don't have direct access to the PHP runtime. Their hosting company manages it.

In that case, send your provider a direct question:

"Has the PHP runtime serving my website been patched for CVE-2026-109618 and CVE-2026-109619, also known as PHP2Shell? Please confirm the patched build or the mitigation applied to my hosting environment."

Get confirmation for the actual environment serving your website, including any staging sites or additional PHP applications you operate.

Step 4: Don't confuse WordPress updates with PHP updates

Updating WordPress, themes, and plugins remains good security practice. It simply doesn't establish that the PHP runtime has been patched.

Likewise, installing a new security plugin isn't a substitute for fixing a vulnerability in PHP itself.

If you operate multiple websites, audit all the PHP environments you control rather than checking only your primary WordPress installation.

What if you cannot patch immediately?

The PHP security team's guidance is clear: updating to a fixed release is the complete remediation.

If you're responsible for a vulnerable internet-facing server and cannot patch it immediately, don't treat a configuration change as proof that you're safe.

Work with your hosting provider or security team to assess whether the affected service should be isolated from public access until the fix is applied.

Some temporary mitigations can block specific demonstrated attack paths, but they don't eliminate every underlying vulnerability or variant. Changes to PHP settings must be applied at the correct configuration level, and workers may need to be restarted for the changes to take effect.

For example, Plesk documents temporary measures involving upload-progress handling and fatal-error backtraces. Those measures have specific limitations and should be used only with an understanding of the relevant environment.

See the Plesk PHP2Shell advisory for its platform-specific guidance.

Do not apply random settings copied from social media or disable unrelated security controls in an attempt to fix the problem.

How can you tell if someone has already exploited your website?

A patched server isn't necessarily a server that was never compromised.

If your environment was exposed before remediation, your security team should consider whether an investigation is needed, especially if the site handles sensitive information or has privileged access to other systems.

Look for unusual activity such as:

Unexpected processes spawned by PHP or web-server services.
New or modified files that cannot be explained by legitimate deployments.
Unexpected administrator accounts or changes to authentication settings.
Suspicious outbound network connections.
Unexplained changes to scheduled tasks, application code, or server configuration.
Unusual HTTP request patterns, repeated HTTP 500 responses, or PHP worker errors around suspicious requests.

Wiz has highlighted unusual multipart requests, memory-limit failures, malformed session cookies, and unexpected PHP worker behavior as potential investigation signals.

These are clues, not proof of exploitation. Some can also appear during ordinary application failures.

Review web-server logs, operating-system process activity, authentication records, file integrity information, and outbound connections together. If you confirm a compromise, patching alone may not be sufficient. Follow an incident-response process to establish the scope, remove persistence, rotate potentially exposed credentials, and restore systems from trusted sources where necessary.

The other story behind PHP2Shell: AI helped uncover the flaws

There's another reason this disclosure deserves attention.

Wiz's research describes how frontier AI models helped researchers discover and develop exploit chains involving vulnerabilities that had remained hidden in PHP's codebase for years.

The difficulty wasn't merely spotting a suspicious line of code. The researchers had to understand complex memory-management behavior, identify exploitable conditions, and connect multiple technical issues into working attack chains.

AI assistance helped reduce some of that research burden.

This is an important development for cybersecurity, but it needs context. AI did not magically make every PHP server vulnerable, and the disclosure doesn't establish that every model can independently discover comparable vulnerabilities. Human expertise, testing, and coordination with the PHP security team remained part of the process.

The defensive implications are significant. AI-assisted research may help security teams find flaws faster, but the same advances can also reduce the effort needed to investigate potential attack paths.

For website owners, the practical response remains straightforward: maintain supported software, apply security updates promptly, and make sure the underlying infrastructure is included in your security process.

PHP2Shell FAQ

Is WordPress itself vulnerable to PHP2Shell?

The issue is in the PHP runtime rather than exclusively in WordPress core. Wiz demonstrated remote code execution against WordPress running on vulnerable PHP builds. Whether a particular website is exposed depends on its actual hosting environment and the protections applied there.

Can an attacker exploit PHP2Shell without logging in?

Yes. The demonstrated vulnerabilities can allow unauthenticated remote code execution under the relevant conditions. An attacker does not necessarily need a WordPress administrator account to exploit a vulnerable PHP runtime.

Does updating WordPress or its plugins fix PHP2Shell?

No. Those updates do not automatically patch the PHP runtime. The underlying PHP installation needs the appropriate security fix.

Is PHP2Shell fixed in PHP 8.5.12?

Yes. PHP 8.5.12 is one of the upstream releases that fixes the vulnerabilities. The corresponding fixed releases are PHP 8.4.27, 8.3.36, and 8.2.35.

Is a website behind Cloudflare safe?

Cloudflare announced WAF protections against PHP2Shell, but a WAF should be treated as an additional layer of defense. Confirm the coverage for your configuration and patch the origin PHP runtime.

Should I take my website offline?

That depends on your hosting environment and whether the vulnerability has been fixed. If an internet-facing server remains vulnerable and cannot be patched promptly, assess isolation with your hosting provider or security team. Don't assume that every managed hosting platform requires the same response.

What should I do first?

Identify the PHP runtime serving your website, confirm the applicable security fix with your hosting provider, and apply the update. If you suspect prior exploitation, investigate the server rather than assuming that patching alone resolves the incident.

Final thoughts

PHP2Shell is a reminder that website security extends beyond the application you can see in your dashboard.

WordPress updates matter. Strong passwords matter. Security plugins and firewalls matter. But none of them automatically fixes a vulnerability in the runtime executing your website's code.

If you manage a PHP website, verify the underlying PHP build and get confirmation that the security updates have been applied.

Don't wait for an error message, a compromised website, or a warning from your hosting provider to start checking.

Sources and further reading