What happened on October 21
On October 21, 2026, the PHP project published security releases that fix two critical vulnerabilities. Security researchers group them under one name, PHP2Shell. Their catalogue numbers are CVE-2026-109618 and CVE-2026-109619. PHP is the software runtime underneath a large share of the world's websites, including most WordPress, Joomla and Drupal sites, and very likely yours.
The first flaw allows unauthenticated remote code execution. In plain terms, a stranger with no account on your site, and no password, could attempt to run their own code on your server. The second flaw allows memory disclosure: a server can be pushed into revealing pieces of data held in its memory. Each flaw carries a CVSS severity score of 9.2 out of 10, near the top of the scale. The vulnerable code path is not new; it has been documented in PHP since version 5.4, released in 2012. This is a flaw in PHP itself, not a bug in WordPress or any other application that runs on it, so updating your website's plugins and themes does not close it.
The fix, and the versions that do not get one
The patched releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The only complete fix is to update PHP to a patched release for your branch and then restart the server, so the running software is the fixed version. An update that is installed but never loaded by a restart changes nothing.
Older branches, from PHP 7.4 to 8.1, received no official patched release from the PHP project, because those branches are past their supported life. A site still running one of them cannot patch its way out; its durable fix is a planned move to a supported branch.
One complication deserves honesty. Hosting companies and Linux vendors sometimes backport a security fix into an older PHP package without changing the version number the server announces. So a version check alone cannot settle every case. An announced version below the patched release is a strong reason to look closer and ask for patch evidence. It is not, by itself, proof that a specific site can be broken into, and a server that announces no version at all has not proven anything either way.
Is anyone actually attacking this?
The evidence is mixed, and it should be reported that way. Cloudflare, which operates a large network edge, reported attack traffic aimed at these flaws. Huntress, a security firm that monitors many small and mid-sized business systems, said it had not observed exploitation in the wild on its partner systems as of October 21. Both can be true at once: probing and scanning begin quickly after a disclosure like this, while confirmed break-ins are harder to count. The practical reading for a site owner is simple. Your window of highest risk is the time between the flaw becoming public and your site running the fix.
Check where your site stands
You do not need to guess, and you do not need to take our word for it. The free checks on our homepage read the PHP version your server announces and compare it with the patched releases above. If your version is in the clear, the check says so. If it falls short, or your server stays silent, our PHP exposure page explains what the finding means and what the fix involves, before you spend anything.
Technical references
This article is based on the PHP project's own advisory and on two independent technical summaries. They are cited as references, not as endorsements of this service.