php2shell and WordPress: Where the PHP Patch Stands and What to Check

What are CVE-2026-109618 and CVE-2026-109619?

PHP's security team released fixes on October 21, 2026 for two critical flaws, CVE-2026-109618 and CVE-2026-109619 ^[1]. The community calls them php2shell, and both are rated CVSS v4.0 9.2 ^[2]. MalCare describes the risk plainly: a critical vulnerability in PHP itself lets attackers take over a website without logging in ^[2].

The bug sits in the PHP interpreter that runs your site, not in WordPress code ^[2]. Vercel's bulletin says the vulnerabilities affect PHP 5.4 and later in default configurations ^[1]. MalCare puts the range the same way: every PHP version back to 5.4 is affected by at least one of the two flaws ^[2].

Vercel also names WordPress, Drupal, Laravel and Magento as frameworks and CMSs that are affected when they run on a vulnerable PHP version ^[1]. A WordPress site is in scope because of the PHP underneath it, whatever plugins and themes it runs.

Which PHP versions have the fix?

Vercel's bulletin lists one patched release for each supported PHP branch ^[1].

PHP branch	Patched release
8.2	8.2.35
8.3	8.3.36
8.4	8.4.27
8.5	8.5.12

PHP 8.1 and earlier have no regular fix. Vercel's bulletin says PHP 8.1 and earlier no longer receive regular updates ^[1]. MalCare adds that older branches get no official fix, so a site on those branches needs a move to a supported branch, not only a patch ^[2].

Some Linux distributions and long-term support vendors backport the fix into the PHP version they already ship. That helps servers on older branches, but it changes how you check for the fix, as the next sections explain.

Is a WordPress site exposed if WordPress is up to date?

Yes. MalCare notes that researchers have shown full takeovers of the latest WordPress, Drupal and Joomla ^[2]. A current WordPress core, plugin set and theme set does not close a PHP flaw, because the fix has to come from the PHP layer.

Security plugins and firewalls help less than a patch. Vercel says its WAF rules reduce exposure to known exploit patterns but do not replace patching ^[1]. MalCare, a WordPress security vendor, says its own firewall cannot block this attack ^[2]. Sites behind Cloudflare received an emergency rule, but MalCare still tells site owners to update ^[2].

Where do managed WordPress hosts stand?

Pasquale Pillitteri reports that sites on WordPress.com, WordPress VIP, WP Cloud, Pressable and Tumblr are already protected against the two flaws ^[3]. That covers Automattic's infrastructure. This is one report, so a site on a different provider still needs a direct check.

For self-hosted sites and most shared hosting, the host decides. MalCare puts it directly: the only fix is a PHP update that your web host has to install ^[2]. If the host has not confirmed the update, assume the site is still exposed.

How do you confirm a site is patched?

A version number alone can mislead. Pillitteri warns that an identical number is not enough for peace of mind ^[3], because a backported build can carry the fix under an older-looking version string.

Ask the host, in writing, three things: which PHP version is running or which build contains the fix, the date of the update, and whether the PHP workers were restarted afterward. Pillitteri recommends the same questions ^[3]. The restart matters because an updated package does not change a worker that is still running the old code.

If you manage several WordPress sites, sort them by host and PHP branch before you write to anyone. A host that answers with a version number closes one line of your list. A host that answers with a build, an update date and a restart confirmation closes the item.

What can you do before patching?

Pillitteri describes an interim measure that the PHP project lists: turn off session.upload_progress.enabled in php.ini, the PHP-FPM pool or the server configuration, then restart all workers ^[3]. Changing it with iniset() or .user.ini files is not enough. The setting blocks the confirmed paths for CVE-2026-109619 but not other variants, and Pillitteri stresses that only the update is a complete fix ^[3].

Treat that setting as a stopgap that buys time, not as protection. The patch is the fix.

Why did the fix arrive early?

The details got out before the release. The Hacker News reports that the release was originally scheduled for October 22, 2026, and that the CVE identifiers and a proof-of-concept exploit leaked ahead of time, prompting the PHP Foundation to move the release forward by one day ^[4]. MalCare dates the leak to October 20, a day before the fix ^[2].

The PHP team's own description, quoted by The Hacker News, says both issues sit in parts of PHP that nearly every request touches ^[4]. A shorter gap between public details and a patch leaves less time for sites that wait to update, and it puts more weight on the hosts that move first.

Is anyone exploiting it?

Amazon's Threat Intelligence team says it detected an attempt to exploit these flaws dating back to October 17, 2026, against its MadPot honeypot ^[4]. The Hacker News reports that the team also saw several proof-of-concept exploits on release day, with the earliest of those flagged around October 21, 2026, at 2 a.m. UTC ^[4]. Amazon's team says multiple threat actors are involved ^[4]. MalCare says attacks have already started ^[2]. A site that waits for its host to update stays open for as long as it waits.

The sources do not fully agree on the first date ^[5]. Check access logs from October 17 onward, not only from the release day.

What should you do this week?

1. Ask your host which PHP version runs your site, which build contains the fix, and whether the PHP workers were restarted after the update.
2. If your site runs PHP 8.1 or earlier, ask the host to move it to a supported branch. Do not stop at a patch on an unsupported branch.
3. Test the site on the new PHP version before you go live with it.
4. Search your access logs from October 17 onward for unusual requests to PHP files, and escalate any hit to your security contact.