PHP2Shell: Two Critical PHP Vulnerabilities. Is Your Website Affected?

October 22, 2026 · Daily Radar

9.2. That's the CVSS v4.0 score of two separate security vulnerabilities, and both sit in the same place: in PHP itself. Not in WordPress, not in a plugin, not in code you wrote. In the core of the PHP running on the web server. On October 21, the PHP team set its release schedule aside and shipped an emergency update, and some organizations took their websites offline for a while.

This post is about everyone whose website runs on PHP, which most likely includes you. That's because WordPress, Drupal, Joomla and Magento all run on PHP [C]. What's known right now about these vulnerabilities, dubbed "PHP2Shell," is short: they allow remote code execution without authentication, and the fix is applied on the server, not on the website itself.

Quick answer: On October 21, 2026, PHP released emergency versions (8.5.12, 8.4.27, 8.3.36, 8.2.35) that close two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Every website running on PHP is affected; updating WordPress does not update PHP. The thing to do today is ask your hosting provider in writing whether your PHP version has actually been upgraded, and get an answer.

What happened?

The PHP team released the emergency security versions on October 21 at 14:00 UTC (5:00 p.m. Turkey time) [C]. The two vulnerabilities fixed are:

• CVE-2026-109618: When memory runs out, PHP can treat half-prepared request data as valid.
• CVE-2026-109619: Some internal state belonging to a request stays in memory after it's freed, and the next request in the same worker process can use it.

Both are scored 9.2. According to Help Net Security, a single unauthenticated request can trigger the vulnerability before any application code even runs [C]. So having strong passwords, up-to-date plugins or a locked-down admin panel on your site doesn't count for much against this vulnerability.

The timeline is a bit unsettling. The same source reports that Amazon's MadPot honeypot system logged an exploitation attempt on October 17, four days before the public announcement; the source IP belonged to a commercial anonymization service, and it's unclear where the attacker got the details [C]. This comes from a single source and hasn't been independently confirmed. Cloudflare's CTO, meanwhile, said early attacks had begun on October 21, and Cloudflare turned on temporary firewall rules for all its customers, including those on the free plan [C].

The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Version 8.1 and earlier are no longer officially supported; the PHP team released minimal patches for 7.4, 8.0 and 8.1 aimed only at people who compile from source [C]. The UK's NCSC recommends taking systems that can't be patched right away offline; CERT-EU also issued advisory 2026-018 [C].

According to the October 22 update, the problem isn't limited to websites: Palo Alto Networks says all PAN-OS and Panorama versions are affected and no patch is available yet; Fortinet and Cisco are still assessing [C]. Devices with PHP-based admin screens may end up on this list too.

Why does it matter?

Because this isn't an "update your plugin" level problem. Malwarebytes puts it plainly: updating WordPress or its plugins is not the same as updating PHP [C]. If you're on shared hosting, it's your provider, not you, who has to apply the patch. If you have your own server, the responsibility is yours, and you also need to restart PHP-FPM or Apache; otherwise the running processes keep going on the old code [C].

The second issue is the ones that will stay quiet. Help Net Security calls it "the long tail": old sites nobody looks at, abandoned applications, admin panels that no longer get updated [C]. This is very common at small businesses. A campaign page set up three years ago and never opened again, a demo site left behind by a former agency, a subdomain nobody remembers. These are the first places an attacker will look.

In Turkey: the official sources don't make clear where hosting providers in Turkey and USOM (Turkey's national cyber incident response center) stand on this vulnerability; you need to check your provider's own announcement.

There's also the Google side. That same day, John Mueller told those taking their sites down to patch: instead of timing out or returning 404 and 500 errors, return HTTP 503; you can do this from outside PHP, through DNS or a CDN [C]. The report gives no length of downtime that's considered safe, and I won't guess. In my view, the most realistic route is to get the patch applied quickly so the site never needs to go down at all.

What changes for your brand?

• If you have a WordPress or PHP-based e-commerce site: Within this week, ask your hosting provider in writing which PHP version you're on and whether the patch has been applied. "We'll do it soon" isn't a good enough answer.
• Shared hosting: If your control panel lets you choose a PHP version, check that it's 8.2.35 or higher, 8.3.36 or higher, or 8.4.27 or higher. The newest supported version you can choose is 8.5.x.
• If you've left behind an old site or a demo: Shut down sites and subdomains you don't use. A site that won't be updated carries the risk if it sits on the same server as an unpatched PHP.
• Static sites, or sites that don't use PHP: This vulnerability doesn't affect you directly. But if you've connected a separate PHP service for forms, a newsletter or a blog, that's still on the list.

The one thing to do today

Send your hosting provider this one sentence: "Which PHP version is running on my site, and have the PHP2Shell patches released on October 21 been applied?" You don't need to buy anything. Until you hear back, you can also check your site's PHP version yourself in the control panel.

Today's Radar

Frequently asked questions

How does PHP2Shell affect my WordPress site?

Because WordPress runs on PHP, it can be affected. Having WordPress or your plugins up to date doesn't close this vulnerability; the patch has to be in your PHP version. Until your hosting provider upgrades the version, the risk remains.

Which PHP version am I safe on?

The PHP team released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 as fixed. Version 8.1 and earlier are out of official support; only minimal patches were provided for people who compile from source.

If I take my site down to patch it, will my Google rankings drop?

Mueller's advice is to return HTTP 503 during the downtime, not 404 or 500. You can do this from outside PHP, through DNS or a CDN. The sources don't say clearly how many hours or days of downtime are safe.

Our services and the next step

If you'd like to review your site's PHP infrastructure, speed and conversion path together, take a look at our web design and CRO service. A site you drive ad traffic to that's down or slow also eats into your budget; for the paid side, there's our Google Ads page. To check your site's overall health:

START YOUR FREE ANALYSIS

Sources

• Help Net Security: PHP2Shell: Critical PHP vulnerabilities patched, update now! (October 21, 2026) [C]
• Malwarebytes: PHP2Shell: why websites are going offline for emergency security updates [C]
• BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws [C]
• Search Engine Roundtable: Google On Taking Sites Down When Fixing The Emergency PHP Exploit - PHP2Shell (October 21, 2026) [C]
• Techzine: PHP shuts the internet: why PHP2Shell affects every company [C]
• Search Engine Roundtable: Daily Search Forum Recap, October 21, 2026 [C]
• Search Engine Roundtable: Google Search Ranking Volatility & Chatter Heats Up October 20 & 21 [C]
• CNBC: OpenAI expands ChatGPT Ads to 26 countries (October 21, 2026) [C]
• PPC News Feed: Performance Max sourced videos become opt-out [C]