Critical PHP Security Vulnerability 2026: Risks, Fixed Versions and How to Protect Your Website

Update, October 26, 2026: Since this article was first published, security agencies and vendors have added more detail. The two flaws are now widely known as PHP2Shell. India's CERT-In and New Zealand's NCSC both refer to exploitation in the wild, PHP says no configuration change fully mitigates the issue, and the PHP security team also released source backports for some end-of-life branches. This version reflects those updates.

A critical PHP security vulnerability alert issued in October 2026 has put PHP-powered websites and applications on high alert. The PHP development team released security updates on October 21 to fix two serious vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow attackers to run malicious code on vulnerable web servers without logging in.

Security agencies, including the UK's National Cyber Security Centre (NCSC) and India's CERT-In, have urged organisations and website owners to update urgently. PHP powers a huge number of websites, content management systems and web applications, so this matters for WordPress site owners, hosting providers, developers and businesses.

The Alert at a Glance

What Is the Critical PHP Security Issue?

The two flaws are in the PHP runtime itself, not in a particular WordPress plugin or theme. According to the UK NCSC:

• CVE-2026-109618: an out-of-memory condition can interrupt PHP while internal request data is only partly set up, and the later cleanup may treat that invalid data as valid.
• CVE-2026-109619: internal request data can survive after the memory behind it has been freed, so a later request handled by the same worker may use stale data.

Under certain conditions, an attacker could use these memory problems to run commands on the server. Because the flaw is in PHP, updating WordPress plugins alone will not fix a vulnerable server.

Which PHP Versions Are Affected and Fixed?

Older PHP versions: PHP 8.1 and earlier no longer receive normal upstream updates. Because of the severity, the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build PHP from source, but vendors need time to test them. If your website uses PHP 8.1 or older, ask your host what fix they provide and plan an urgent migration to a supported version.

PHP 8.2 note: PHP 8.2.35 fixes this issue, but PHP 8.2 reaches end of life on December 31, 2026. Plan to move to a newer branch such as 8.3, 8.4 or 8.5 soon.

Why Is This Vulnerability So Serious?

1. Remote Code Execution

Remote code execution can let an attacker run commands on a server. Depending on the server's permissions, this could lead to website defacement, file changes, data theft or a wider compromise.

2. No Login Is Needed

The advisories say the flaws can be exploited without authentication under certain conditions. An attacker may not need a website account before trying an attack on an exposed, vulnerable service.

3. It Affects Most Ways PHP Runs

Agencies say every PHP installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

4. Exploitation Has Been Reported

CERT-In's vulnerability note says multiple reports confirm large-scale exploitation in the wild and advises urgent patching. New Zealand's NCSC also says it is aware of reports of active exploitation. Treat this as an urgent update, not a routine one.

5. WordPress Sites Are Exposed Too

WordPress runs on PHP, so a vulnerable PHP runtime can put a WordPress site at risk even if all its plugins are up to date.

How to Protect Your Website from the PHP Vulnerability

Step 1: Identify the PHP Version

Check the PHP version used by your website in your hosting control panel, or ask your host to confirm the version serving live requests. A command-line PHP version can differ from the web version. In WordPress, open Tools → Site Health → Info to see the PHP version.

Step 2: Back Up Your Website

Before changing PHP versions, create a full backup of your files and database, and store it separately. Test the upgrade on a staging site where possible, but do not let testing delay urgent security work.

Step 3: Update PHP to a Fixed Release

Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a later version in the same branch. PHP states there are no complete mitigations and that updating is the only safe choice. After the change, confirm the exact version that is serving public pages.

Many Linux distributions and hosting vendors ship their own patched packages, so the version number may look different. Ask your host to confirm that the fix for CVE-2026-109618 and CVE-2026-109619 has been applied.

Step 4: Contact Your Hosting Provider if You Cannot Update

Some hosts do not let customers install PHP security releases directly. Ask your host:

• Which PHP version is running on the live website?
• Have the fixes for CVE-2026-109618 and CVE-2026-109619 been applied?
• Is a fixed, supported PHP version available on my plan?
• Which runtime does my site use (PHP-FPM, mod_php, LiteSpeed or another)?
• What temporary protection is in place until the update is installed?

Temporary measures are not a replacement for the update. If an exposed site that handles sensitive data cannot be patched or protected quickly, consider limiting access to it or taking it offline until it is fixed.

Step 5: Check Containers and Bundled Software

If you use Docker or other containers, the PHP version is inside the image, so pulling a fixed image tag and rebuilding is necessary. Check the image documentation for the fixed tag. Other products that bundle PHP, such as some firewalls, control panels and embedded devices, may need separate updates from their vendors. The Dutch NCSC has published a list of software products with a PHP dependency that you can check.

Step 6: Update WordPress and Its Components

Update WordPress core, themes and plugins to their latest compatible releases. This protects against other vulnerabilities but does not replace patching PHP itself.

Step 7: Check for Signs of Compromise

Because exploitation has been reported, review your server and application logs. Look for unexpected PHP files, new administrator accounts, suspicious scheduled tasks, modified files, unusual outbound connections and unexplained processes. If you suspect an intrusion, keep the logs, contact your host or an incident-response specialist, and investigate before assuming an upgrade solved everything.

An Extra Precaution Mentioned by PHP

According to recent reports on the PHP advisory, PHP developers also suggested, as an additional precaution against an unlikely scenario, temporarily disabling the session.upload_progress.enabled setting until the next regular bug-fix release. Check the official PHP advisory for the current guidance, and ask your host if you are unsure how to change the setting. It is not a substitute for installing the October 21 fixes.

What Should WordPress Website Owners Do?

• Confirm the PHP version used by the live website.
• Ask your host whether the PHP2Shell fixes are installed.
• Move away from unsupported PHP versions.
• Back up files and databases before upgrades.
• Update WordPress core, themes and plugins.
• Review administrator accounts and recent file changes.
• Keep monitoring notices from PHP, WordPress and your host.

Avoid publishing detailed server configuration publicly. Share technical details only with your hosting provider or a trusted security professional.

Frequently Asked Questions

What are the PHP vulnerabilities announced in October 2026?

They are CVE-2026-109618 and CVE-2026-109619, also called PHP2Shell. Official notices say they can allow unauthenticated remote code execution under certain conditions.

Which PHP versions contain the fixes?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on October 21, 2026. Check the official PHP advisory for later releases and vendor-specific instructions.

Is PHP 7.4 safe to keep using?

No. PHP 7.4 is end of life and has no official fixed release for this issue. The PHP team published source backports for people who build from source, but most site owners should move to a supported PHP version and ask their host what protection is in place.

Will updating WordPress plugins fix the PHP vulnerability?

No. The flaw is in the PHP runtime, so the server's PHP installation must be updated.

Can I fix this with a setting instead of updating?

PHP says no configuration change fully mitigates these vulnerabilities, and updating is the only safe choice. Some extra settings may reduce specific risks, but they do not replace the update.

Should I take my website offline?

Most sites can be fixed by updating PHP. If you cannot update quickly and the site is exposed or handles sensitive data, ask your host about protection, and consider limiting access or taking the site offline until it is fixed.

Conclusion

The critical PHP security alert of October 2026 is a reminder that website security depends on the server software as well as the application on top of it. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or ask your host to confirm the fix, move away from end-of-life versions, and check for signs of compromise.

For wider advice on online security, read our guides on how AI is changing online security and how to spot festive sale scams in India.

Official Sources

• UK National Cyber Security Centre: Critical security issue affecting PHP
• Official PHP security advisory and fixed releases
• CERT-In: Critical remote code execution vulnerabilities in PHP (CIVN-2026-0510)
• NCSC New Zealand: CVE-2026-109618 and CVE-2026-109619 affecting PHP
• Official PHP end-of-life information

Disclaimer: This article is for general information and is not a substitute for professional security advice. Details are based on official and media reports published between October 20 and 26, 2026, and may change. Always check the official PHP advisory and your hosting provider for the latest guidance.