Published October 21, 2026 · Security Advisory
PHP has released security fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, referred to in public reporting as PHP2Shell. The PHP project and public security advisories identify web-serving PHP environments as an area that requires urgent attention.
This is not a WordPress-only issue. Public-facing sites and applications using PHP deserve review, including WordPress, Magento, Laravel applications, custom PHP sites, and products that bundle PHP internally.
The immediate action
If your server runs an affected PHP branch, apply the vendor patch as soon as possible.
The PHP project released fixes in these versions:
• PHP 8.2.35
• PHP 8.3.36
• PHP 8.4.27
• PHP 8.5.12
PHP 8.1 and older no longer receive normal updates from the PHP project. Some operating-system and hosting vendors may provide a backported patch while retaining an older-looking version number. Do not assume that a version string alone confirms protection: ask the hosting or infrastructure provider whether the package serving your public site includes the fixes for CVE-2026-109618 and CVE-2026-109619.
A practical checklist for website owners
- Identify the PHP runtime actually serving the website. The PHP version displayed in a control panel, CLI session, cron job, or another domain is not always the runtime handling public traffic. Check the relevant PHP-FPM pool, Apache configuration, LiteSpeed configuration, container, or ask the host to confirm it.
2. Take a restorable backup, then patch promptly. Keep a current backup of files and database, confirm that it can be restored, and avoid turning a short security patch into a long uncontrolled maintenance project.
3. Apply the PHP package supplied by your OS, hosting panel, or managed host. A patched distribution package can retain an older-looking version number when the vendor backports the fix. Ask for written confirmation that the package includes the relevant CVE fixes.
4. Restart the relevant PHP workers and verify the deployed runtime. A package update is not enough if old PHP-FPM, Apache, LiteSpeed, or container workers remain in memory. Re-check the public environment after restart.
5. Test business-critical paths. Check login, contact forms, checkout, uploads, payments, scheduled tasks, and integrations. For WordPress, update active plugins and themes too, and remove anything unused.
6. Review signals that deserve investigation. These can include unexpected administrator accounts, unfamiliar PHP files, changes in writable directories, unexplained redirects, repeated PHP errors, unknown scheduled tasks, or unusual outbound traffic. These signals do not prove PHP2Shell was used, but they merit review.
What if patching cannot happen immediately?
Patching is the complete fix. PHP has published temporary configuration measures that can reduce exposure in particular paths, but they do not make an affected installation safe. The NSA also advises organizations to consider taking unpatchable internet-facing PHP services offline until they can be fully mitigated.
If your business cannot update immediately, treat this as a short-term containment decision. Work with your host or infrastructure team to assess the public service, apply official temporary mitigations at server level, restart workers, and schedule the supported upgrade. Do not rely on a WordPress plugin, a .user.ini tweak, or disabled error display as a complete solution.
Where SolidScripts can help
A PHP update can be straightforward. It can also expose an unsupported application, a panel-managed configuration, a legacy plugin conflict, or signs that a deeper review is needed.
SolidScripts provides practical support for public-facing PHP and WordPress environments:
- PHP runtime and hosting configuration review
- Patch planning and post-update validation
- WordPress and Magento file-integrity review
- Investigation of suspicious PHP files, redirects, database payloads, and persistence
- Server hardening after a compromise or high-risk exposure
Not sure which PHP version your public site is running, whether the patch reached production, or whether the environment needs a deeper review?
Request a PHP Exposure Review →
For your security, do not send passwords or server credentials by email.
You can also book a strategic consultation.
Sources
NSA advisory: Critical patches recommended for PHP vulnerabilities