PHP2Shell Security Patches
The PHP2Shell Security patches (CVE-2026-109618 and CVE-2026-109619) have been fully deployed across our hosting platforms. The relevant fixes have also been backported to all PHP versions available on the platform, so older versions are also protected. Please upgrade all plugins on self managed/hosted only websites, make sure you have the latest version of your theme installed and the latest version of WordPress.
What is PHP2Shell?
PHP2Shell refers to two critical remote code execution vulnerabilities in the PHP engine itself (CVE-2026-109618 and CVE-2026-109619), both rated CVSS 9.2. They affect virtually every PHP version released since 5.4 (2012), which means the vast majority of websites on the internet were exposed — including sites running WordPress, Drupal, Joomla, Magento and WooCommerce, even where the application code itself was secure.
The flaws are memory-safety bugs triggered by fatal errors (typically out-of-memory conditions) during request processing. A failed request can leave corrupted state behind in a PHP worker, which a later request can then abuse to execute code without authentication or to read sensitive memory — potentially exposing passwords, session tokens and API keys belonging to other requests. Notably, one of the disclosure paths works even on sites that never call session_start(), and exploitation happens below the application layer, so no plugin or theme change can fully address it on its own.
The bugs were disclosed in a coordinated release on 21 October 2026, with fixed PHP versions published the same day. Cloudflare reported early exploitation attempts even before the patches were officially released, so rapid patching was essential.
What we did
Because the vulnerability lives in the PHP engine, the only complete fix is a patched PHP binary — it cannot be resolved from within WordPress, a plugin, or a theme. Our engineering team applied the official patches across all hosting platforms within hours of release, and backported the fixes to every PHP version we offer, including legacy versions that no longer receive official upstream support. No action is required on your part for sites we host and manage.
What you need to do (self-managed sites only)
If you host your own website elsewhere, you are responsible for patching PHP at the server level. Contact your hosting provider or system administrator and confirm they have deployed the 21 October PHP security release. If you run PHP from a third-party repository, verify the patched packages are actually available to you.
Once the server itself is protected, harden the application layer: update all plugins to their latest versions, ensure your theme is current, and upgrade to the latest release of WordPress. Keeping components up to date remains best practice, and doing so now removes any ambiguity about your overall security posture.
If you are unsure whether your site is hosted with us or self-managed, or you would like us to review a self-managed installation, please contact our support team and we will be happy to assist.