Today, the PHP project released emergency security updates for two critical vulnerabilities that security researchers are calling PHP2Shell (CVE-2026-109618 and CVE-2026-109619). If your website runs on WordPress, Drupal, Joomla, WooCommerce, or almost any other popular content management system, it runs on PHP, which means this one matters to you.
Here’s what you need to know, in plain English, and what we’re doing about it.
What Is PHP2Shell?
PHP is the programming language that powers a huge share of the web, including every WordPress site. PHP2Shell is a pair of memory-handling flaws inside PHP itself. Under the right conditions, an attacker can send specially crafted requests to a website and run their own code on the web server, without needing a username or password. Both flaws are rated Critical (CVSS 9.2).
If an attacker succeeds, they could plant malware, steal customer information, inject spam or redirects into your pages, or use your server to attack others. Researchers have also shown the flaws can leak data from server memory, which can include passwords and API keys.
Is Anyone Actually Using It?
Yes, attackers are already paying attention. Amazon’s threat intelligence team reported an exploitation attempt on October 17, four days before today’s public disclosure, and security firms began seeing scanning activity as soon as details became public. With proof-of-concept code circulating, we expect automated attacks against unpatched servers to ramp up quickly.
Who Is Affected?
Any website whose server is running an unpatched version of PHP may be at risk. That includes the most common setups: Apache with mod_php (considered the highest risk), PHP-FPM, php-cgi, LiteSpeed and FrankenPHP. Because the problem is in PHP, updating WordPress or your plugins alone does not fix it. The PHP software on the server has to be updated.
The fixed versions released today are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Sites still running older, end-of-life versions of PHP are in the toughest spot. Some hosting companies and Linux vendors will backport fixes, but many older setups won’t get one at all, which makes this a good moment to move to a supported version.
What Should You Do?
- Find out what version of PHP your site runs on. Your hosting control panel or your web developer can tell you.
- Make sure your host has applied the update. On many shared hosting plans the provider handles PHP. On a VPS or dedicated server, it’s usually up to you or your developer.
- Plan an upgrade if you’re on an old PHP version. Running PHP 7.x or early 8.x leaves you exposed to this and future vulnerabilities.
- Keep everything else updated too. WordPress core, themes and plugins should all be current, and you should have a recent, working backup.
- Don’t rely on a firewall alone. Services like Cloudflare have added protective rules, which help as a stopgap, but patching PHP is the real fix.
Solnet Contract Customers Are Protected
If you’re a Solnet hosting or website maintenance contract customer, you’re covered. Keeping the servers and software behind your website secure is exactly what those contracts are for. We monitor security advisories like this one and handle the updates for you, so there’s nothing you need to do.
Not a Contract Customer? We Can Still Help.
We repair and update all websites, not just the ones we built or host. If you’re unsure whether your site is protected, if your hosting company hasn’t patched yet, or if you think your site may already have been compromised, we can help. Our team can:
- Check which version of PHP your site is running and whether it’s vulnerable
- Update PHP, WordPress, themes and plugins safely, with a backup taken first
- Upgrade sites stuck on outdated PHP versions without breaking them
- Scan for and clean up malware, spam injections and unwanted redirects
- Move you to secure, managed hosting with ongoing updates and backups
Vulnerabilities like PHP2Shell are a reminder that a website isn’t a one-time project. It’s software that needs regular care. Contact Solnet or call (301) 939-0273 today, and we’ll make sure your site is patched and protected.
For more technical background, see Help Net Security’s coverage of the PHP2Shell vulnerabilities.
