Security guidePHP2Shell26 October 2026

PHP2Shell (October 2026): check your PHP version and patch safely

Two serious PHP runtime vulnerabilities disclosed on 21 October 2026 can permit unauthenticated remote code execution under affected server conditions. The immediate task is to verify the actual web-serving PHP build—not simply the CMS version.

PHP2Shell is a runtime issue: a CMS update on its own cannot patch the PHP interpreter. Confirm the running build with your hosting provider before assuming you are covered.

Reviewed 26 October 2026 · Evidence-based guidance for site owners, not a remotely confirmed diagnosis.

What is affected, and what is not

CVE-2026-109618 and CVE-2026-109619 are runtime memory-handling flaws, not WordPress or Joomla plugin bugs. They can affect PHP web requests before application code runs. Exploitation may execute code with the permissions of the PHP worker; this does not automatically mean administrator-level access to the entire host.

Upstream fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older lack regular upstream security support; a hosting vendor may supply its own backport, so the displayed version string alone is not always decisive.

Do not infer the PHP runtime from a public website scan. VirusTotal can sometimes fingerprint the CMS and plugins, but not reliably the server's PHP build or vendor patch status.

Safe verification and update order

  1. Ask the host for the effective PHP version. For WordPress, open Tools → Site Health → Info → Server. For Joomla, use its administrator system information or the hosting panel. Confirm which PHP-FPM pool or server actually handles the site.
  2. Confirm the patch source. Compare your installed build with PHP's security release and your distribution/hosting vendor's advisory. Record any backported security fixes and applicable service restart requirements.
  3. Protect the live site. Save a tested backup and confirm compatibility with Joomla or WordPress extensions on staging. Apply the security-fixed runtime and restart/reload affected processes using the hosting provider's procedure.
  4. Recheck after deployment. Verify the active runtime, login, forms, checkout and error logs. A clean-looking website or ordinary HTTP 200 response is insufficient evidence of patch status.

When a patch cannot be applied immediately

Have the hosting provider assess temporary exposure reduction, including isolation of vulnerable internet-facing applications. WAF measures are supplementary and do not replace runtime fixes. Follow the relevant security authority's containment recommendations rather than testing exploit payloads on a production site.

If unusual PHP files, unknown users, unexpected outgoing requests or changed scheduled tasks are found, preserve the evidence and arrange a separate incident review. Patching alone cannot remove an existing web shell.

Primary sources and patch references

Verify the latest release and vendor-specific backports before taking action. This guide records information available as of 26 October 2026.

PHP2Shell — NHS England security alertWordPress.org — Critical PHP Security Release, 21 OctoberPlesk — affected and patched PHP builds

Related security guides

WordPress WP2Shell: July 2026 security update and incident checksWordPress September 2026 file-inclusion flaw: what to checkJoomla JCE 2026 vulnerability: version and compromise checklistEU 2026 cybersecurity rules: are CMS updates mandatory?

Need a second opinion?

Start with a free public website check or describe the concern. Do not send credentials, raw customer data or full private logs. Any technical work beyond the free enquiry requires an agreed scope.

Run free website check Request free scope enquiry