On October 21, 2026, the PHP project shipped emergency patches for two critical vulnerabilities in PHP’s core, nicknamed PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both allow unauthenticated remote code execution, meaning an attacker doesn’t need a login, a vulnerable plugin, or a misconfigured form to take over a server. The flaw sits inside PHP itself, below WordPress, below Drupal, below whatever application you’re running.
Most of the coverage so far has come from security vendors writing for other security professionals. This is written for the people who actually run South Asian websites: agencies, small businesses, and the admins of government and university portals, many of which run on exactly the kind of shared cPanel hosting and unmanaged VPS setups this bug is worst for.
Key Takeaways
- CVE-2026-109618 and CVE-2026-109619 are critical flaws (CVSS v4.0 9.2) in PHP core itself, not in WordPress, a theme, or a plugin. They affect PHP 5.4 through 8.5.11, every version released in the last 14 years before the fix.
- Patches are out: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If you’re on PHP 8.1 or older, there is no official fix from the PHP project, you need a distribution-level backport from your Linux vendor.
- Updating WordPress core or your plugins does not fix this. The fix has to happen at the server level, in your PHP version, which most site owners never touch directly.
- As of the October 21 CISA alert, exploitation hadn’t been confirmed, though Cloudflare reported attack traffic. The Dutch government took DigiD and other sites offline the same day as a precaution, not because of a confirmed breach.
- South Asia’s exposure is structural: a very high share of regional businesses and government portals run on shared cPanel hosting or self-managed VPS instances where nobody is actively tracking PHP end-of-life dates.
What PHP2Shell actually is
PHP2Shell is the informal name for two separate bugs that were disclosed together because they’re both critical, both in PHP core, and both patched on the same day.
CVE-2026-109618 is a memory-corruption bug. When a crafted request pushes PHP to hit a memory limit at a specific point during execution, PHP’s cleanup routine ends up treating leftover, uninitialized memory as valid data. Beyond code execution, this bug can also leak memory from other requests, which means passwords, session tokens, API keys, and TLS private keys sitting in server memory at the wrong moment.
CVE-2026-109619 is a stale-state bug. In shared worker setups like PHP-FPM or Apache’s mod_php, where the same worker process handles many requests back to back, this bug lets memory state from one request bleed into the next one before it’s properly reset. Your application-level authentication can’t stop this, because PHP is processing the malformed request before your code ever runs.
Both are rated 9.2 (Critical) on CVSS v4.0 by PHP’s own security team. The independent research firm watchTowr rated it a full 10.0. Either way, this is about as serious as a web vulnerability gets: no login required, no specific plugin required, works against WordPress, Drupal, Joomla, and custom PHP applications equally.
How it was found: two teams, AI-assisted, in under a month
What makes this disclosure unusual is how fast it happened. These bugs trace back to code written in PHP 5.4, released in 2012, meaning they sat undiscovered in widely-used software for roughly 14 years.
Two independent teams found them within weeks of each other using AI-assisted security research. Calif, working under OpenAI’s “Patch the Planet” initiative, found the first bug on August 1, 2026 and reported it to the PHP team on August 11. Wiz Research, using its own “Wiz Atlas” tool alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, found a bug on August 19 and confirmed working unauthenticated remote code execution against both Drupal and WordPress within two days of that.
That’s the part worth sitting with if you work in SEO or AI visibility, which is our actual day job: the same class of reasoning models now writing content and answering search queries is also being pointed at finding decade-old bugs in infrastructure software, and it’s doing it in days, not months.
The patch, and the trap for South Asian hosting setups
The PHP project released fixed versions on October 21, 2026: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If your server is on any of those four branches, updating is straightforward.
The trap is PHP 8.1 and older. Those branches are past their official support window, so the PHP project isn’t shipping a fix for them at all. The only way to get patched on an old branch is a distribution-level security backport, the kind Debian, Ubuntu, or Red Hat sometimes ship for end-of-life software, and that depends entirely on whether your specific Linux distribution and hosting setup has one available.
This is exactly where a lot of South Asian infrastructure sits. Government portals, university exam systems, and municipal sites frequently stay on PHP 7.4 or 8.0 for years, because upgrading PHP risks breaking an older, undocumented codebase nobody wants to touch. Unlike a managed host that upgrades PHP versions on a schedule, a self-managed VPS or an old government server only gets patched if someone specifically goes and does it.
| Your situation | What actually happens |
|---|---|
| Managed shared hosting (cPanel, Hostinger-type) | Host usually patches supported PHP branches automatically, but only if your site is actually set to a supported version, not a legacy one you never changed |
| Self-managed VPS (AWS, DigitalOcean, Hetzner) | Nobody patches this for you. You or your agency has to update PHP manually |
| Legacy government/university portal on PHP 7.4 or 8.0 | No official fix exists from the PHP project. Needs a distro security backport or an actual version upgrade, which may break old code |
How to check your PHP version right now
Updating WordPress itself, or your plugins, does nothing for this bug. PHP runs underneath all of that. You have to check and fix it at the hosting level. Here’s where to look depending on your setup.
On cPanel hosting
Go to cPanel → Software → MultiPHP Manager. It lists every domain on your account next to its current PHP version.
On Hostinger
Go to hPanel → Websites → Manage → Advanced → PHP Configuration. The dropdown shows your current version and lets you change it.
From inside WordPress
Go to Tools → Site Health → Info → Server. This tells you what version WordPress is actually running on, which is useful for confirming the problem, but you still have to go fix it through your host’s control panel, not through wp-admin.
If what you see is 8.5.12, 8.4.27, 8.3.36, or 8.2.35, you’re on a patched version. Anything older needs attention today, not this week.
What’s actually confirmed, and what isn’t
A lot of breathless detail is circulating about this story, so it’s worth being precise about what’s independently confirmed versus what’s still unverified.
Confirmed: CISA issued a public alert on October 21 urging immediate patching. Cloudflare reported observing attack traffic and attempts to bypass its own protections. The Dutch government took DigiD, MijnOverheid, and Overheid.nl offline the same day, and the Dutch National Cyber Security Centre said explicitly this was a precaution, with no signs of actual misuse at the time.
Not yet confirmed: As of CISA’s October 21 alert, no confirmed exploitation had been observed, and neither CVE was in CISA’s Known Exploited Vulnerabilities catalog at that point. Treat any claim of large-scale active breaches with some skepticism until that changes, attempted attack traffic is not the same thing as a successful compromise.
Roughly 70% of server-side web installations run PHP, according to Wiz’s own figures. That’s the scale of what’s theoretically exposed, not a claim about how many sites have actually been breached.
Who handles this in South Asia
Each country in the region has its own incident response body that tracks and responds to exactly this kind of infrastructure vulnerability: CERT-In in India, PakCERT in Pakistan, and BGD e-GOV CIRT in Bangladesh. If you manage a government, university, or large institutional site, checking whether your national CERT has issued specific guidance on PHP2Shell is a reasonable next step alongside patching directly.
What to actually do this week
- Check your PHP version using whichever method above matches your hosting setup.
- If you’re on a supported branch (8.2, 8.3, 8.4, or 8.5) but not yet on the patched point release, update to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 as soon as possible.
- If you’re on PHP 8.1 or older, you have no official fix available. Ask your host or your Linux distribution whether a security backport exists, or plan an actual version upgrade. This is the scenario that needs the most urgency, since you’re not one update away from being safe.
- If you can’t patch immediately, the PHP team has been explicit that there’s no complete workaround, partial mitigations exist (like disabling session.upload_progress for the CVE-2026-109619 path) but updating is the only full fix. A web application firewall with updated rules reduces risk but doesn’t eliminate it.
- If you manage a public-sector or institutional site, check for guidance from your national CERT and treat this with the same urgency the Dutch government did, even without a confirmed breach.
A vulnerability like this is also a reminder that technical health and search visibility are the same problem wearing different hats. A site that gets flagged by Google as compromised loses rankings and traffic regardless of how good its content is, which is part of why recovering from a security-related penalty is harder and slower than preventing one in the first place.
FAQ
How do I check my PHP version?
On cPanel hosting, go to Software → MultiPHP Manager. On Hostinger, go to hPanel → Websites → Manage → Advanced → PHP Configuration. From inside WordPress, go to Tools → Site Health → Info → Server, though you’ll still need to fix the version through your host, not through wp-admin.
Am I affected by PHP2Shell?
If your server is running any PHP version from 5.4 through 8.5.11, yes. The fix is specific to four point releases: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Anything older than those four exact versions is unpatched.
Does updating WordPress or my plugins fix this?
No. This bug lives in PHP itself, below WordPress entirely. Updating WordPress core, your theme, or your plugins has no effect on it. The fix has to happen at the server’s PHP version.
What if my host hasn’t patched PHP 8.1 or older yet?
The PHP project itself isn’t releasing a fix for PHP 8.1 or older, those branches are past their support window. Ask your host directly whether they’re applying a distribution-level security backport, or plan to upgrade to a supported PHP branch.
Has PHP2Shell actually been exploited?
As of CISA’s October 21, 2026 alert, confirmed exploitation hadn’t been observed, and the vulnerability wasn’t yet in CISA’s Known Exploited Vulnerabilities catalog. Cloudflare reported seeing attack traffic, which shows attempted exploitation, not confirmed breaches. Patch regardless of exploitation status, since the vulnerability itself is confirmed and critical.
