In late October 2026, a critical security flaw was discovered in PHP, the programming language that powers nearly 70% of the web. This triggered a global race to patch systems as millions of automated attacks began almost immediately.
Two Flaws, One Massive Risk
The issue, nicknamed
'PHP2Shell', consists of two critical vulnerabilities officially tracked as CVE-2026-109618 and CVE-2026-109619. Both were rated 9.2 out of a possible 10 on the Common Vulnerability Scoring System (CVSS), signifying a critical threat. In simple terms, these flaws relate to how PHP handles memory when it is under stress, such as when it runs out of its allocated memory or encounters a fatal error. This mismanagement can be exploited by an attacker to run their own code on the web server without needing a password or any user interaction. A successful attack could allow a malicious actor to steal data, deface a website, access database credentials, or install a persistent backdoor for future access.
A Global Scramble and Widespread Attacks
The PHP project announced an emergency security release was coming on October 20, but some details leaked before the official patch was available on October 21. This gave attackers a head start. Cybersecurity firms reported that exploit attempts began even before the official patch was released. Amazon Threat Intelligence detected the first attempt on October 17, four days before the public disclosure. Once the vulnerabilities became public, the situation escalated rapidly, with reports of widespread, automated exploitation attempts targeting vulnerable websites around the globe. Security firm Palo Alto Networks identified over 22.6 million exposed instances that were potentially vulnerable. The urgency prompted government action, with the UK's National Cyber Security Centre (NCSC) sending out 50,000 alerts and the US Cybersecurity and Infrastructure Security Agency (CISA) adding the flaws to its Known Exploited Vulnerabilities catalog.
Who is at Risk? The WordPress Connection
The vulnerabilities affect the core PHP language, not a specific application, plugin, or theme. This means that any website using PHP was potentially at risk, regardless of how up-to-date its other software was. This is particularly concerning for the millions of websites built on content management systems like WordPress, Joomla, and Drupal, which all run on PHP. An estimated 70% of all websites use PHP, making the potential attack surface enormous. Because the flaw exists at the server level, simply updating your WordPress installation or its plugins does not fix the problem. The underlying PHP software on the web server itself must be updated by the hosting provider or server administrator.
The Essential Fix: What Website Owners Must Do
The only complete solution is to update to a patched version of PHP. The PHP project released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. A significant concern is that older, end-of-life versions of PHP, such as 8.1 and earlier, will not receive official security patches from the PHP project. Website owners on these older versions are strongly urged to upgrade to a supported branch immediately. If you run your own server, you must apply the update yourself. If you use a hosting provider, it is their responsibility, but it is crucial to verify with them that your site is running a patched version. You can often check your PHP version through your hosting control panel or within WordPress itself by navigating to 'Tools', then 'Site Health', and clicking the 'Info' tab to find the 'Server' section.
