php2shell (CVE-2026-109618, CVE-2026-109619): Is Your Website Affected?

A website that runs on PHP is affected by php2shell until PHP itself is updated to a fixed release (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or to a patched package from your Linux distribution, and that includes WordPress, WooCommerce, Drupal and Laravel sites. The one thing to do now is get PHP updated on your server, or ask your host to confirm in writing that they have done it.

On 21 October 2026, security advisories were published for two critical vulnerabilities in the core PHP runtime: CVE-2026-109618 and CVE-2026-109619. The pair has been nicknamed "php2shell". Both flaws carry a CVSS 4.0 critical severity rating of 9.2 (assigned by security@php.net), and the National Vulnerability Database (NVD) lists a CVSS 3.1 rating of 9.8 for CVE-2026-109618.

The official vulnerability description for CVE-2026-109618 states: "PHP uses longjmp() for out-of-memory (OOM) errors ... Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE)." The companion vulnerability, CVE-2026-109619, enables remote code execution via stale global state.

According to the official announcement on php.net: "Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs." Both advisories add that "Updating to a PHP release containing the patch ... is the only complete mitigation."

Checked on 26 October 2026 against php.net Security Advisory and GitHub Advisory GHSA-w8hw-w9fx-j79w.

If your website runs on PHP, treat it as affected until your host or server administrator confirms PHP has been updated to one of the patched releases. On Linux distributions such as Ubuntu and Debian the fix can arrive as a patched package that keeps an older version number, so ask whoever manages the server rather than relying on the number alone. This includes popular content management systems and e-commerce platforms such as WordPress, WooCommerce, Drupal and Magento, as well as bespoke web applications written in PHP.

Sites on PHP 8.1 or older have no normal patched release. The PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build PHP from source, but for most businesses the safe path is moving to a supported PHP branch (8.2 or newer).

By contrast, a site that does not run PHP does not run the affected code. For example, a modern static or server-rendered site built on Next.js, Node.js, Python, or Go, or an e-commerce storefront hosted directly on Shopify, does not use the PHP runtime and is not affected by php2shell. If such a site pulls its content from a separate WordPress or other PHP backend, that backend still needs updating.

Crucially, updating your WordPress core software, themes, or plugins does not fix php2shell. The vulnerability lives inside the underlying PHP interpreter, entirely outside your website application files. As Vercel stated in its security bulletin on 21 October 2026: "Upgrade the PHP runtime to a patched release immediately, regardless of WAF protections or hosting provider. Updating your application code or plugins does not fix these vulnerabilities." It added: "Frameworks and CMSs built on PHP, including WordPress, Drupal, Laravel, and Magento, are affected when they run on a vulnerable PHP runtime."

Checked on 26 October 2026 against Vercel's php2shell security bulletin and php.net.

Take the following practical steps in order:

1. Update PHP to a fixed release immediately: Update your server or hosting environment to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If you manage your own virtual private server (VPS) or dedicated server, install the updated packages from your Linux distribution repository or package maintainer and restart your PHP-FPM or Apache service.
2. Contact your shared hosting provider: If your website runs on shared hosting or a managed platform where you do not have root server access, contact your hosting provider immediately. Ask them which exact PHP version your account runs on, whether their servers have applied the security updates for CVE-2026-109618 and CVE-2026-109619, and when the patch was completed.
3. Check for signs of prior compromise: In New Zealand, the National Cyber Security Centre (NCSC NZ) issued an alert on 22 October 2026 noting: "The NCSC is aware of reports of active exploitation." In its published guidance, NCSC NZ warns: "Patching the exposed services will not remove already exploited systems." It also urges: "We also urge affected organisations to investigate unauthorised access or compromise of the affected products." Because attackers began attempting exploitation around disclosure, applying the patch closes the door to future attacks through these flaws, but does not undo an intrusion that occurred before the fix was applied.

Checked on 26 October 2026 against the NCSC NZ alert and the NCSC NZ news item.

You can check which PHP version your website runs without editing server code:

• WordPress Admin: Log in to your WordPress dashboard, navigate to Tools > Site Health, click the "Info" tab, and expand the "Server" section. The active PHP version is listed there.
• Hosting Control Panel: If you use cPanel, Plesk, or Cloudways, look for the "PHP Version", "PHP Selector", or "Server Information" widget in your dashboard.
• SSH Command Line: On a VPS or dedicated Linux server, log in via SSH and run php -v to see the CLI version, and check your web server configuration or PHP-FPM pool status to verify the active runtime version.

Do not create or leave a public phpinfo.php file in your web root. Public diagnostic files expose sensitive environment variables and server paths to automated scanners.

We provide practical, fixed-price assistance for New Zealand and Australian business websites:

• Free outside-in security check: We look at your public response headers, SSL certificate and DNS records to see whether your server shows a PHP version number or is missing basic protections. A passive check cannot prove a site is or is not vulnerable, so the report says "may be" where that is the honest answer. Delivered as a one-page report within 1 business day.
• php2shell check and PHP update (NZ$295): For websites running on servers or VPS hosting where we can access the environment, we update PHP to an official patched release, verify site functionality, and check for obvious indicators of compromise. For shared hosting, we verify your public version markers and draft a specific request for your host.
• Hacked WordPress cleanup (NZ$495 / same-day NZ$795): If your website shows signs of compromise, unwanted redirects, or suspicious administrator accounts, we remove malicious files, reinstall clean core code, rotate credentials, and harden the site, including a free re-clean within 30 days if it is reinfected through the same hole.

If your business email domain has no DMARC policy yet, see email domain protection. NullGlitch is a sole trader and not GST-registered, so no GST is added. All work is scoped in writing with no sales calls and no lock-in.

• php.net Security Advisory (21 October 2026): "Security advisory: Critical remote code execution vulnerabilities, update now" (CVE-2026-109618, CVE-2026-109619). Checked on 26 October 2026 against php.net.
• PHP security advisories GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619). Checked on 26 October 2026.
• NCSC NZ Alert (22 October 2026): "UPDATED: CVE-2026-109618 and CVE-2026-109619 affecting PHP". Checked on 26 October 2026 against ncsc.govt.nz.
• Vercel php2shell security bulletin (21 October 2026). Checked on 26 October 2026 against vercel.com.
• BBC News (23 October 2026): "What is PHP and why did it spark a global cyber-security scramble?". Checked on 26 October 2026 against bbc.com.
• PHP Supported Versions: Checked on 26 October 2026 against php.net Supported Versions.