Security Alert · Actively Exploited

PHP2Shell: Critical PHP Flaws Are Under Attack: Is Your Website Patched?

If your business website runs on WordPress, WooCommerce, or any other PHP-based platform, this one matters. Two critical vulnerabilities in PHP itself, nicknamed PHP2Shell, let attackers run their own code on an unpatched web server without logging in. Attacks are already happening.

What happened?

On October 21, 2026, the PHP project shipped emergency security releases fixing two critical remote code execution (RCE) flaws in the PHP core interpreter:

• CVE-2026-109618: “RCE via out-of-memory corruption.” When PHP runs out of memory at the wrong moment, it can leave request data half-initialized, and the cleanup step may then treat that broken data as valid.
• CVE-2026-109619: “RCE via stale global state.” Internal state from one request can survive after its memory is freed, so a later request handled by the same PHP worker may use that leftover data.

Because the bug lives in PHP itself (not in a plugin or theme), your WordPress version, plugins, and security plugins make no difference. What matters is the PHP version running on your server. The PHP project rates the risk highest for Apache mod_php setups, where an unauthenticated request can trigger the attack before any of your site’s code even runs, and code execution was also validated against PHP-FPM, the most common setup on modern hosting.

Why the urgency

Details of the flaws leaked before the fixes were ready, and public proof-of-concept exploits followed. Amazon reported exploit attempts against its honeypots as early as October 17, four days before patches existed. Cloudflare saw attempts climb from tens of thousands to millions within roughly a day of disclosure. On October 26, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both CVEs to its Known Exploited Vulnerabilities catalog, giving U.S. federal agencies until October 29 to patch.

And a third one: CVE-2026-115560

Two days later, on October 23, PHP published an informational advisory for a separate code execution issue, CVE-2026-115560, involving session upload progress. It only affects an unusual setup: an app that configures the session serializer as php_binary or php_serialize, then switches it to php at runtime before starting the session, while upload progress is still enabled.

Which PHP versions are fixed?

One catch: if your PHP comes from a Linux distribution (Ubuntu, Debian, RHEL, AlmaLinux, cPanel/CloudLinux, etc.), the vendor may backport the fix without changing the PHP version number. In that case, check your vendor’s security notice and the installed package version, not just what php -v reports.

What to do right now

1. Find out which PHP version your site uses. In WordPress, go to Tools → Site Health → Info → Server. On a server, run php -v (and check the package version if PHP came from your OS).
2. Update to a patched release. On shared or managed hosting, confirm with your host that they’ve applied the October 21 fixes. On your own server, install your vendor’s updated packages or the fixed upstream release, then restart PHP-FPM / Apache.
3. Disable session upload progress. Set it at the server level so applications can’t override it, and keep it off until PHP’s next regular release.
4. Move off end-of-life PHP. If you’re on 8.1 or older, plan an upgrade to 8.3 or 8.4 now. PHP 8.2 loses security support at the end of this year.
5. Check for signs of compromise. Look for unexpected processes spawned by PHP workers, unfamiliar files in your web root, new admin users, and outbound connections from the web server.

; php.ini: temporary mitigation (CVE-2026-109619 / CVE-2026-115560)
session.upload_progress.enabled = 0

; PHP 8.5 only, until updated to 8.5.12
fatal_error_backtraces = 0

; PHP-FPM pool config (e.g. www.conf): enforce it admin-side
php_admin_flag[session.upload_progress.enabled] = off

Why this matters for small businesses

PHP runs roughly 70% of websites, so attackers are scanning the internet broadly rather than picking targets. A small Red Deer business site is just as likely to be probed as a large retailer. A compromised server can be used to steal customer data, inject spam or malware, send phishing email, or serve as a launching point into the rest of your network, and cleaning that up costs far more than patching.

Information current as of October 30, 2026. This is a developing situation; check the official PHP advisories above for the latest guidance, including the upcoming fix for CVE-2026-115560.