WordPress, Drupal, Joomla, most e-commerce stacks: all built on PHP, and all potentially exposed. On October 21, 2026, PHP developers released emergency patches for two unauthenticated remote-code-execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively dubbed “PHP2Shell” by researchers. Both scored 9.2 out of 10 under CVSS 4.0, and neither requires a login or prior access to exploit. Any PHP installation serving web requests is potentially in scope, depending on deployment and runtime conditions.
What PHP2Shell Actually Does
Two distinct memory flaws share one consequence: unauthenticated code execution on your server.
CVE-2026-109618 involves out-of-memory or partially initialized request-data corruption in PHP worker memory. Attackers can exploit this to trigger remote code execution or force PHP to leak process memory to an outside party, according to Wiz researchers.
CVE-2026-109619 targets fatal-error backtrace handling and stale global state. A stale global state condition opens a path to memory disclosure, memory corruption, and viable code execution. Exposed memory can contain password vaults, authentication tokens, API keys, TLS certificates, and data from other users sharing the same server worker, though the specific contents depend on what the affected process had handled.
Wiz confirmed pre-authentication remote code execution against current container images for WordPress, Drupal, and Joomla. Patch now. Here is where to start:
- Identify every PHP installation across your environment, prioritizing internet-facing systems and services that process file uploads, including deployments running PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, or LiteSpeed.
- Apply the fixed release for your branch: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
- Running PHP 8.1 or older? The main PHP project no longer issues updates for those versions; check your OS distributor or long-term-support vendor for a backported fix, or begin a migration plan.
- WAF rules and configuration changes buy time; they do not replace patching.
- If you suspect compromise: isolate the system, preserve logs, rotate exposed credentials and tokens, and report to the appropriate authorities.
How Bad Is the Exposure Right Now?
Early attack traffic has been reported, but confirmed mass exploitation has not been established across all agencies.
Cloudflare reported observing attack traffic before the public patch release, according to BleepingComputer. Australia’s Cyber Security Centre stated it was not aware of confirmed active exploitation at the time of its advisory, so the picture across agencies is not uniform. Do not treat that gap as breathing room.
Iran-Linked Hackers and other threat actors have demonstrated how quickly critical vulnerabilities are weaponized. CERT-EU and the UK National Cyber Security Centre both issued emergency guidance urging organizations to act immediately. Reuters reported that government websites went offline while organizations prepared to apply the fixes.
PHP 8.1 and every older branch sit outside the PHP project’s current support window. If your infrastructure runs on any of those versions, options include a distributor backport, temporary isolation, or a full migration to a supported branch. Organizations that wait for evidence of mass exploitation before acting are, effectively, making the next attacker’s job easier.
