Is Your Site on WordPress or PHP? PHP2Shell Opens Your Server Without a Password, and Attacks Have Started

If your company's website or online store runs on WordPress, Magento, Laravel or any other PHP-based system, ask your host or tech team today to update PHP to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart the server. The PHP project released these versions on October 21, 2026 to close two critical flaws known as PHP2Shell, each rated 9.2 out of 10, that let an attacker run commands on your server without any password. Saudi Arabia's National Cybersecurity Authority issued a «critical» alert the same day recommending the update, and security firms saw exploit attempts hours before the fix went public.

What exactly happened?

The two flaws are CVE-2026-109618 and CVE-2026-109619, and they sit in the PHP language itself, not in a plugin or theme. That is the key difference: in our earlier article on WordPress fixes that became the attackers' map, the bug was in software running on top of PHP. Here the bug is in the foundation all of that software stands on. So an up-to-date WordPress, or a short plugin list, does not protect you.

According to PHP's first security advisory, the first flaw appears when a request runs out of memory while it is being set up, leaving half-initialised data that PHP later treats as valid. According to the second advisory, the other flaw leaves data from an earlier request hanging after it has been freed, so the next request on the same worker uses it. The result is the same in both cases: one carefully crafted web request is enough to run commands on the server.

Wiz Research found the flaws with help from AI models. Its report says the team discovered them on August 19, 2026, reported them to the PHP team on August 24, and that every PHP version since 5.4 is affected by at least one of them. Wiz estimates PHP runs about 70% of websites.

Is my site affected?

Most likely yes, if it runs on PHP and its version is older than the numbers above. Wiz demonstrated unauthenticated remote code execution on WordPress, Drupal and Joomla in their default setups. Sansec extended the list in its analysis to 11 platforms, including Magento 2.4.9, WordPress 7.1.2, Laravel 13.11, Symfony 8.1, phpMyAdmin, Nextcloud and WHMCS.

To find your PHP version, open your hosting panel (cPanel, Plesk or similar) and look for «PHP Version», or ask your team. Watch two points:

• Version 8.1 and older are out of support and will get no fix. According to PHP's supported versions table, the only supported branches now are 8.2, 8.3, 8.4 and 8.5.
• The 8.2 branch itself loses security support on December 31, 2026, two and a half months away. If you are updating now, move to 8.4 or 8.5 and spare yourself a second upgrade soon.

What to do today: five steps

1. Find everywhere PHP runs. The website, the store, the admin panel, and any internal system or customer portal. Many companies forget an old site that is still online.
2. Update to a patched version. 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On shared hosting, ask your host in writing: have you applied the October 21 update?
3. Restart PHP after updating. PHP's advisory notes that a worker that has not been restarted stays on the old code, so downloading the update is not enough.
4. If your site is on 8.1 or older, plan the upgrade this week, and test it on a staging copy first because some old plugins may break.
5. Check the logs. Wiz recommends looking for unusual upload requests followed by out-of-memory errors, repeated HTTP 500 errors, or oversized or malformed session cookies (PHPSESSID).

If you cannot update today

PHP's advisories suggest temporary measures that reduce the risk but do not replace the update: turn off session.upload_progress.enabled by setting it to 0 and restart every worker, and on version 8.5 set fatal_error_backtraces to 0. If your site never accepts file uploads, you can also block multipart requests at the front-end server.

If your site sits behind Cloudflare, the company says on its blog that it deployed firewall rules for these flaws from 3:02 am UTC on October 21, about 9 hours before disclosure, on every plan including Free. But Cloudflare itself advises patching PHP even with this protection, because attackers keep changing their payloads.

The Origami view

This flaw is a reminder that website security does not stop at updating WordPress and its plugins. Under every site there is a programming language, a server and settings, and all of them need someone watching. What we often see in companies is a site built years ago, after which nobody knows which PHP version it runs or who has the access to update it. If that is your situation, the question is no longer «should we update?» but «who updates it today?». At Origami we build websites and systems and keep their updates monitored from day one. If you want your site checked, or PHP upgraded without downtime, contact us.

Sources

• Saudi National Cybersecurity Authority (NCA): PHP alert no. 2026-7949
• PHP: release announcement for 8.5.12, 8.4.27, 8.3.36 and 8.2.35, October 21, 2026
• PHP on GitHub: advisory for CVE-2026-109618
• PHP on GitHub: advisory for CVE-2026-109619
• PHP: supported versions table
• Wiz Research: PHP2Shell report
• Cloudflare: WAF protection against PHP2Shell
• Sansec: PHP2Shell analysis and affected platforms