On October 21, 2026, PHP released security updates for two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, associated with the PHP2Shell security issue. Both vulnerabilities have a CVSS v4.0 score of 9.2, indicating a high level of risk for affected PHP environments. These vulnerabilities can allow attackers to execute commands on a server through specially crafted HTTP requests. A key concern is that exploitation may occur before the website’s application code runs, meaning application-level authentication alone may not prevent an attack. For businesses running PHP-based websites, including WordPress sites, the priority is to identify affected PHP environments, apply the appropriate security patches, and investigate suspicious activity. Updating themes and plugins alone will not fix a vulnerability in the underlying PHP runtime. The alert followed the disclosure of two critical PHP vulnerabilities that affect request processing and internal memory management. Although both can lead to remote code execution, they exploit different weaknesses within the PHP runtime. CVE-2026-109618: A memory allocation failure can leave PHP’s internal data in an incomplete state. During request cleanup, PHP may process that invalid state in a way that allows an attacker to execute commands. CVE-2026-109619: PHP can retain stale internal state between requests. Under certain conditions, a later request can exploit this state to achieve command execution. The vulnerabilities are particularly concerning because the attack can occur before the application itself begins executing. According to the security research published by Datadog, exploitation attempts were reported as early as October 17, 2026, before the public disclosure and patch release. PHP released fixed versions for supported branches, including PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Organisations running older PHP branches should consult their hosting provider or vendor for applicable security updates and backported fixes. PHP powers server-side functionality across several websites, including form submissions, file uploads, session handling, and database interactions. When a vulnerability allows remote command execution, the risk extends beyond a malfunctioning webpage. Depending on the server configuration and the attacker’s success, exploitation may lead to: Unauthorised command execution: An attacker may run commands with the privileges of the affected web server process. Potential system compromise: Successful exploitation can provide a route to further investigate or compromise the server, depending on its permissions and security controls. Business disruption: Malicious activity or remediation work may affect website availability, customer enquiries, and online transactions. Incident response costs: Businesses may need technical investigation, system recovery, security reviews, and additional remediation if a compromise is confirmed. An essential detail is that successful exploitation doesn’t necessarily crash the PHP worker or produce an obvious error on the website. A request can even return an HTTP 200 response despite malicious command execution. For this reason, businesses should not rely on website availability or normal-looking responses as proof that their systems are safe. Applying the relevant PHP security patch is the primary remediation step, followed by reviewing logs and investigating suspicious activity wherever necessary. Website owners should prioritise patching affected PHP environments rather than relying solely on application-level security measures. The following steps can help reduce exposure and support a more effective response. Identify affected PHP environments: Check the PHP version used by each website, hosting environment, and container that processes HTTP requests. Apply the security fix: Upgrade to a listed fixed version or install a vendor-provided backported patch where applicable. Verify the deployment: Confirm that the updated runtime is serving requests and that affected workers or containers have been restarted or replaced as required. Investigate suspicious activity: Review server logs for unusual requests, unexpected processes, and unauthorised file or configuration changes. If compromise is suspected, patching alone may not be sufficient. Test backups: Maintain recent backups and verify that your website and database can be restored if an incident disrupts operations. Monitor security advisories: Follow official PHP announcements and hosting-provider notifications for additional fixes and relevant support updates. If a system shows signs of compromise, investigate the incident, contain the threat, and verify the system’s integrity before returning it to normal operation. Yes. A WordPress website may be vulnerable if its server runs an affected version of PHP. WordPress relies on PHP for application logic, request processing, and database interactions, so a vulnerability in the PHP runtime can expose the underlying environment even when WordPress itself is up to date. Keeping WordPress core, themes, and plugins updated remains essential, but these updates do not necessarily patch PHP itself. Website owners should confirm their PHP version with their hosting provider, apply the relevant security updates, and check that their WordPress installation and extensions are compatible with the target PHP version before upgrading. Website security is an ongoing responsibility because vulnerabilities can emerge in the server environment, application code, and third-party dependencies. A maintenance plan helps identify these issues before they become expensive operational problems. Software Updates: Keep the CMS, themes, plugins, frameworks, and server components updated to receive security fixes and maintain compatibility. Dependency Management: Review third-party libraries and remove outdated, unsupported, or unnecessary components that could introduce security risks. Security Testing: Periodically review access permissions, server configurations, and website functionality to identify weaknesses before they cause serious problems. Continuous Monitoring: Monitor website availability, server logs, and unusual changes to help identify potential security issues early. Recovery Planning: Maintain a documented recovery process, assign responsibilities, and periodically test backup restoration to minimise disruption if an incident occurs. A consistent maintenance schedule makes security easier to manage than relying on emergency fixes after a vulnerability becomes public. The PHP2Shell vulnerabilities highlight the importance of securing the PHP runtime alongside website applications, themes, and plugins. Businesses should apply the appropriate security patches, investigate suspicious server activity, and confirm that their environments are running fixed versions. Regular security maintenance can help reduce exposure and support a faster response to emerging threats. Need help securing your PHP-based website? Contact Mypcot Infotech to discuss your website security and maintenance requirements.Understanding the PHP2Shell Vulnerabilities: CVE-2026-109618 and CVE-2026-109619
How PHP2Shell Threatens Website and Server Security
What Website Owners Should Do to Reduce Risk
Is Your WordPress Website Also at Risk?
Why Regular Website Maintenance Matters
Conclusion
