PHP fixes two critical flaws that let hackers take over web servers. Update now
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 patch two remote code execution bugs rated 9.2 out of 10. WordPress, Drupal and Joomla sites are all affected.
The team behind PHP, the programming language that powers WordPress and a huge share of the world’s websites, has released emergency security updates for two critical vulnerabilities. Both could let an attacker take control of a web server without logging in.
The fixes arrived on October 21, 2026, a day earlier than planned, after details of the bugs leaked online. Security researchers have nicknamed the issue “php2shell”.
The two vulnerabilities
Both flaws are rated 9.2 out of 10 (critical) on the CVSS v4 scale.
- CVE-2026-109618: when PHP runs out of memory while handling a request, it can stop halfway, leaving internal data only partly set up. The clean-up process may then treat that broken data as valid. Specially crafted upload (multipart) requests can trigger this.
- CVE-2026-109619: some internal data from one web request can survive after its memory has been freed. A later request handled by the same PHP worker may then use this “stale” data. This is known as a use-after-free bug.
In both cases, the result can be remote code execution (RCE): an attacker can make the server run commands of their choice.
Who is affected?
According to the official PHP advisory, all PHP installations that serve web requests are at risk, including:
- PHP-FPM
- Apache with mod_php
- php-cgi
- FrankenPHP
- LiteSpeed
The risk is highest for Apache with mod_php, where PHP says a working exploit can attack before any website code even runs. Security firm Wiz demonstrated attacks against WordPress, Drupal and Joomla sites, according to Huntress.
Which versions fix it?
Update to at least:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35 (PHP 8.2 reaches end of life on December 31, 2026)
PHP 8.1 and older no longer receive regular updates. The PHP team published limited fixes for 7.4, 8.0 and 8.1, but the safest option is to move to a supported version.
Is it being exploited?
PHP’s advisory says a working exploit was created during research. Rapid7 reported signs that others have reproduced the bugs and expects a public exploit soon. As of the afternoon of October 21, Huntress had not seen attacks on its own customers’ systems, but said others were reporting early attempts. Because PHP is so widely used, experts expect attacks to grow quickly.
When a bug affects PHP itself, every website built on PHP shares the risk, no matter how well its own code is written.
What should you do?
If you run your own server
- Update PHP now to one of the fixed versions, ideally from your Linux distribution’s official packages.
- Restart all PHP workers (PHP-FPM, Apache) so the new version is actually used.
- Check every PHP install, including ones bundled with control panels and other software.
- If you can’t update immediately, PHP lists temporary mitigations, such as setting
session.upload_progress.enabled=0and limiting request sizes. PHP warns these reduce the risk but do not make a server safe.
If you use shared hosting (most WordPress sites)
- Your host must install the fix, not you. Watch for their notice, or ask support whether the October 21 PHP security release has been applied.
- Check your PHP version in WordPress under Tools → Site Health → Info → Server. Some hosts patch PHP without changing the version number, so ask if unsure.
- If your site runs PHP 8.1 or older, switch to a newer version in your hosting control panel. Take a full backup first and check your site afterwards.
- Updating WordPress or plugins does not fix this, because the flaw is in PHP itself.
Watch for signs of attack
Huntress advises looking for web server processes that start command shells or download tools, unexpected new files in your website folder, new cron jobs and unknown administrator accounts. If you suspect a break-in, take the site offline, keep the logs and restore from a clean backup.
Why it matters
PHP runs a huge share of websites, from personal blogs to online shops. A flaw that lets attackers in without a password is one of the most serious kinds of security problem. Hosting companies and site owners who update in the next few days will be far safer than those who wait.
