Security
PHP vulnerability (PHP2Shell): what website owners need to do now
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, put most websites at risk, including every WordPress site. Which versions fix them, how to check yours, whether to take your site offline, and what CISA, the NSA and Canada's Cyber Centre advise.
· 11 min read · Dawood Cheema
Key takeaways
- Two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), can let an attacker run code on an unpatched web server without logging in.
- They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21, 2026. PHP 8.1 and older get no release from the PHP project.
- Updating WordPress or its plugins does not fix this: the PHP on your server has to be updated and restarted.