PHP has released emergency security updates for two critical vulnerabilities that could allow attackers to run malicious code on a web server without logging in.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and jointly nicknamed PHP2Shell, sit in PHP itself — the programming language behind websites and applications such as WordPress, Drupal and Joomla. Each scores 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS), placing both in the critical range.

What Is PHP2Shell?

PHP runs on a web server, where it handles visitor requests, pulls information from databases, processes forms and builds pages. According to security firm Qualys, PHP2Shell comprises two bugs in how the language handles memory and the state of a web request. The vulnerabilities are in PHP itself, not in WordPress, Drupal or Joomla.

WordPress said in a post on X that the flaws affect any server hosting a PHP application and that no WordPress update is required or planned. Because every application on a server leans on the same runtime, one patched PHP closes the gap for all of them — and a single unpatched runtime leaves them all exposed, however current their applications and plugins are.

The first flaw, CVE-2026-109618, appears when PHP runs out of memory mid-request and leaves data half set up. The second, CVE-2026-109619, occurs when PHP keeps pointing to request data after the memory behind it has been freed.

Wiz, one of the firms that reported the bugs, said it demonstrated attacks that run code on WordPress and Drupal sites before login. The company added that one flaw can also leak the memory of a running PHP process. An attacker needs no account, and what follows depends on the server's setup and the permissions the compromised PHP process holds.

Who Is Exposed?

PHP said in its announcement that any installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project said the risk is highest for Apache's mod_php, noting that a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs — meaning the trigger does not depend on any weakness in the hosted site's own code.\nWiz said affected versions go back to PHP 5.4 — a span that takes in long-lived legacy servers. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive updates from the project, though PHP provides minimal source backports for 7.4, 8.0 and 8.1 to those who build from source or have no vendor support.

PHP also said 8.2 stops receiving security fixes at the end of the year, so users on that branch should plan an upgrade. Some Linux distributions and vendors may backport the fixes to older versions; administrators should check their advisories and, where none exist, plan a move to a supported version. Products, containers and hosting panels that bundle their own PHP need separate updates.

According to security firm Huntress, details of the flaws leaked online a day before the planned disclosure. PHP brought the release forward and published the fixes on October 21.

Sansec, another security firm, said it expects mass exploitation now that the patches and technical write-ups are public. It noted that Cloudflare has already reported early attacks. With the technical details out and attacks already logged, exploitation attempts against servers that have not yet updated are the immediate thing for defenders to watch.

How to Respond

Updating WordPress, Drupal, Joomla or a plugin will not fix a flaw in PHP itself. Administrators can take the following steps:

Update PHP. Install a fixed version through the package manager, then confirm the web server is using it. WordPress users can see their version under Tools > Site Health > Info > Server, and many hosts show it in their control panel.

Check every installation. Look at containers, control panels and any application that bundles its own PHP.

Ask your host. On shared hosting, PHP may be outside the operator's control. Ask the provider whether it has patched, and do not assume it has. WordPress said hosts may already be patching and adding firewall rules, but still advises checking with the host.

Watch your repository. Sansec warned that Remi's repository, common on PHP servers, did not have the fix on release day, and advised using the distribution's packages or building from source.

Use mitigations only as a stopgap. PHP said there are no complete mitigations and that updating is the only safe choice. Measures such as capping request sizes and switching off upload tracking do not make an installation safe.

Check for compromise. Look for unexpected processes launched by PHP, unfamiliar files and odd outbound connections. A patch will not remove malware already planted.

Ordinary visitors cannot fix the flaws, because they sit on servers rather than phones or laptops. That does not mean every PHP website has been hacked, but updating to a fixed version is the only complete fix.