PHP2Shell: Update PHP Now If You Run WordPress
Two critical PHP flaws (CVSS 9.2) allow unauthenticated code execution, and attacks began before the patch. Safe versions and how to update WordPress.
On 21 October 2026 the PHP project shipped an emergency security release fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that let an unauthenticated attacker run code on the server. The pair is being called "PHP2Shell". If your website runs on PHP, and every WordPress site does, the fix is to update PHP on the server, whatever theme or plugins you use. The official advisory is blunt: "There are no complete mitigations, updating is the only safe choice."
Automated attacks sweeping the whole internet started almost immediately. In the last two days, servers operated by NQ Solution received more than 1,000 attack attempts, and so far every one of them has been blocked. This article reflects public information as of 23 October 2026.
The 30-second version: the thing to fix is PHP, not WordPress. Check that PHP is at least 8.2.35, 8.3.36, 8.4.27 or 8.5.12. PHP 8.1 and older get no patch, so those sites must move to a newer PHP, which usually means updating an old WordPress core, plugins and theme first. PHP 8.2 itself loses security support on 31 December 2026.
What is PHP2Shell?
Both vulnerabilities score 9.2 out of 10 on CVSS v4.0. A single unauthenticated request can be enough to execute arbitrary code on the server. The PHP team says the risk is highest under mod_php, with a demonstrated exploit that fires before any application code runs. That is why a WordPress security plugin cannot stop it. PHP security advisory
The reach is wide. KrebsOnSecurity reports that web servers running PHP 5.4 or later are affected, and Wiz, which found the bugs, says every PHP version released in the last decade is hit by at least one of them. Censys counted about 2.58 million internet-facing PHP hosts and 54.9 million web properties. KrebsOnSecurity
Attacks started before the patch
| Date | What happened | Source |
|---|---|---|
| 20 Oct | PHP announces a critical security release for the next day (two CVSS 9.2 flaws) | php.net |
| 21 Oct | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 released; Korea's KISA issues an update advisory the same day | php.net, Korea Economic Daily |
| 21 Oct | Cloudflare detects early attacks on the morning before the fix and adds firewall rules | Codeable, KrebsOnSecurity |
| 21–22 Oct | Some government agencies in the Netherlands and Finland take websites offline as a precaution | Korea Economic Daily |
There is no official count yet of how many attacks succeeded. Wiz expects attackers to use the flaws to plant web shells (backdoor files that give remote control of the server) and warns that patching will be slow because PHP is embedded so deeply in web applications. Korea Economic Daily on the KISA advisory (Korean)
It has happened before: a 2024 PHP flaw became ransomware in two days
In June 2024 another PHP flaw, CVE-2024-4577, was disclosed. Two days after the fix, on 8 June, the TellYouThePass ransomware gang began using public exploit code to install web shells and run ransomware, according to Imperva. That flaw only affected PHP-CGI on Windows, and attackers still moved that fast. Help Net Security, June 2024
Once a patch is public, attackers reverse it into an exploit and scan the internet for servers that have not updated. Attack tools look for version numbers, not company names. Being a small business or a low-traffic site does not take you off the list. The 1,000-plus attempts against NQ Solution's servers in two days were not aimed at us in particular. They are this kind of indiscriminate automated scanning.
What to check on your site today
- Find your PHP version in your hosting control panel, or in WordPress under Tools → Site Health → Info → Server.
- Compare it with the patched versions in the table below and update if you are behind.
- Ask your host. Some Linux distributions backport the fix without changing the visible version number, so the number alone may not tell you.
- If you run the server yourself, restart PHP-FPM or Apache after updating, or the fix will not load. If you cannot update right away, WordPress.org and the UK's National Cyber Security Centre suggest taking the site offline.
- Check for signs of compromise. Look for unfamiliar PHP files, admin accounts you did not create and changed files from before the update, and change admin passwords.
| PHP branch | Safe from this version | Security support until |
|---|---|---|
| 8.5 | 8.5.12 | 31 Dec 2029 |
| 8.4 | 8.4.27 | 31 Dec 2028 |
| 8.3 | 8.3.36 | 31 Dec 2027 |
| 8.2 | 8.2.35 | 31 Dec 2026 |
| 8.1 and older | No patch | Ended; move to a newer branch |
Why a WordPress update comes along with it
Updating WordPress alone does not close these holes, and WordPress.org has said no WordPress release is needed for them. The catch is that an old WordPress install blocks the PHP upgrade. Sites that have not been touched in years are often stuck on PHP 7.x or 8.1, and an old core, plugin or theme can break on a newer PHP. Codeable's guide for WordPress owners
The safe order:
- Back up files and the database.
- Update WordPress core, plugins and theme. Replace plugins that are no longer maintained.
- On a staging copy, switch to PHP 8.3 or newer (8.4 if you can) and test pages, forms and payments.
- Switch PHP on the live server, restart it and run the same checks again.
PHP 8.2 security support ends on 31 December 2026
Patching to 8.2.35 buys you about two months. According to the official schedule, PHP 8.2 receives no security fixes after 31 December 2026. If something like this happens in January, an 8.2 site will have no fix to install. If you have to move anyway, move to 8.4, which is supported until the end of 2028. PHP supported versions
If you are deciding whether to repair an old WordPress site or rebuild it on something easier to maintain, send us the address and the features you rely on through the project request form, or email dwkim@nqsolution.kr. We include security checks such as permissions, input validation and dependency updates when we build a site.
FAQs
Does updating WordPress fix PHP2Shell?
No. The flaws are in the PHP engine underneath WordPress, so PHP on the server must be updated. Old WordPress installs often need updating first so that they run on the newer PHP.
Is a security plugin or firewall enough?
The PHP team says there are no complete mitigations. The attack can run before WordPress code executes, so plugins are not a fix. Web application firewall rules, such as Cloudflare's, only buy time until you update.
I use a hosting company. Do I need to do anything?
Check your host's announcement or ask whether the patch is applied. Some hosts have already patched every PHP version and others are still rolling it out. If your control panel lets you choose a PHP version, avoid 8.1 and older.
What if my site is on PHP 8.1 or older?
Those branches no longer receive security releases, so there is no patch for them. Back up, update WordPress core, plugins and theme, test on staging, then switch to a supported PHP version.
My site is small with little traffic. Will anyone attack it?
Yes. Attack tools look for vulnerable versions automatically, not for big companies. The 2024 PHP flaw was used for ransomware within two days, and NQ Solution's own servers saw more than 1,000 indiscriminate attack attempts in two days this week.
Sources
- PHP security advisories, 20–21 October 2026 and PHP supported versions: vulnerabilities, patched versions, end-of-support dates.
- KrebsOnSecurity, 21 October 2026: scope, Cloudflare detection, Censys counts, Wiz warning.
- Korea Economic Daily, 22 October 2026 (Korean): KISA advisory, government agencies taking sites offline.
- Codeable: WordPress.org position, PHP 8.1 and older, host status.
- Help Net Security, 13 June 2024: CVE-2024-4577 and TellYouThePass ransomware.
- Attack attempts against NQ Solution servers: NQ Solution operating records, as of 23 October 2026.