Critical PHP Security Flaws: What to Do Now If You Run a WordPress or PHP-Powered Website

First, don't panic: Who is affected?

PHP is the programming language that powers popular platforms such as WordPress, Drupal, Joomla, and Magento. According to Wiz, one of the security companies that discovered the flaws, roughly 70% of websites worldwide use PHP. But that does not mean 70% of the internet has been compromised. The vulnerabilities threaten servers running unpatched versions of PHP; sites that have applied the fixes are protected against these flaws.

There are two important distinctions:

• If you're an ordinary internet user who only visits websites, there is no direct action you need to take. These flaws target the servers hosting websites, not visitors' computers.
• If you own or manage a website, you should check which PHP version your site is running today.

What happened?

On October 21, the PHP security team released emergency updates to fix two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. The team rated both flaws as critical, with a score of 9.2 out of 10 under CVSS 4.0.

The most dangerous aspect is that an attacker may be able to execute code remotely on a server without having an account on the website or signing in. Researchers demonstrated this against current versions of WordPress, Drupal, and Joomla. According to Wiz, even a simple "Hello World" application can be vulnerable. The flaws can also allow attackers to read server process memory, which may contain passwords, access tokens, and other sensitive information.

The PHP team says the risk is highest on Apache servers using mod_php, where an attack can be triggered before the website's own application code runs. But PHP-FPM, LiteSpeed, and other common deployments need updating too.

Security researchers from Calif, Wiz, and OpenAI discovered the flaws, with Wiz saying that AI models played a role in its research. The findings were reported to the PHP team over the summer, but some information leaked on October 20, before the patches were available. According to the PHP Foundation, the CVE identifiers, an incorrect severity score, and the planned disclosure date appeared first. A research video was then accidentally published; extensive technical details had not been leaked initially.

Cloudflare reported seeing attack traffic targeting the vulnerabilities hours before the patches were released. Not every observed attempt necessarily resulted in a successful compromise. As a precaution, some organizations temporarily shut down services; for example, a development tool used by Wikimedia was taken offline before the patches were available. The US Cybersecurity and Infrastructure Security Agency (CISA) also urged organizations to update immediately.

Which PHP versions are safe?

The PHP team released the following patched versions:

What about older versions? The underlying flaws have existed in PHP for many years. PHP 8.1 and earlier no longer receive standard security releases. Given the seriousness of this incident, however, the PHP team provided special source-level fixes for versions 7.4, 8.0, and 8.1. Some Linux distributions may also supply security backports for older versions.

Even so, moving to a supported PHP version is the safest long-term choice. PHP 8.2 will also reach end of life on December 31, 2026. If your site runs PHP 8.2, update to 8.2.35 immediately, then check compatibility and plan a move to PHP 8.3 or newer.

Website owners: What should you do, step by step?

First, an important distinction: Sites hosted on WordPress.com are in a different position. Automattic, the company behind WordPress.com, says sites hosted on WordPress.com, WordPress VIP, WP Cloud, and Pressable are protected. If you run a self-hosted WordPress site through another hosting provider, however, you need to verify the PHP update separately. And remember: Updating WordPress itself or its plugins does not fix these PHP vulnerabilities on its own.

1. Find out which PHP version your site uses.

• If you use WordPress: Open your admin dashboard, go to Tools > Site Health > Info, and expand the Server section. You'll find the PHP version there.
• If you use shared hosting: Look for a section such as Select PHP Version, MultiPHP Manager, or a similar PHP setting in cPanel or Plesk.

2. Compare your version with the table above. For example, if your website runs PHP 8.3, it needs version 8.3.36 or later from that branch. If you see a lower version such as 8.3.30, there is a good chance the security update has not yet been applied.

3. If you're unsure, contact your hosting provider. Many shared-hosting customers cannot update the underlying PHP installation themselves; the provider manages it. You can ask:

Have the PHP versions on your servers been patched against the PHP2Shell vulnerabilities CVE-2026-109618 and CVE-2026-109619?

One detail matters: Some Linux distributions and hosting companies backport security fixes without changing the upstream PHP version number to match the table exactly. If your version number differs, ask your provider to confirm explicitly that both vulnerabilities have been patched.

4. If you manage your own server, update it immediately. Check the latest packages for your Linux distribution. Patches may arrive later in some third-party repositories. After updating, restart the relevant PHP services, such as PHP-FPM or Apache, and verify that the website is actually running a patched build.

5. If you cannot update immediately, add temporary protection. Cloudflare has deployed web application firewall (WAF) protections against these vulnerabilities, including for customers on its free plan. If your site is behind Cloudflare, these rules may provide an additional layer of defense. However, as the PHP team emphasizes, a WAF is not a replacement for applying the security update.

6. Check for suspicious activity. If your site remained exposed before the update, review server logs with your hosting provider. On WordPress, look for unfamiliar administrator accounts, unexpected plugins, or suspicious files. If you suspect unauthorized access, secure the system first, then change database passwords, administrator credentials, and API keys. Revoke active sessions if necessary, and make sure you have an up-to-date, clean backup.

Why is this such a big deal?

What makes PHP2Shell particularly serious is that it is not a flaw in a specific plugin or application. It affects PHP itself, the underlying runtime on which those websites depend. For these vulnerabilities, your choice of theme or plugin is not the deciding factor: Even if WordPress and its plugins are up to date, your site may still be at risk if the PHP version on your server is vulnerable.

There is another striking aspect to the story: The vulnerabilities were discovered by researchers using AI models. Tools capable of uncovering deeply buried flaws in code that has supported millions of websites for years may also become available to attackers. That makes delaying security updates potentially riskier than ever. For website owners, the most important task this week may be a simple one: Check your PHP version.