Last week the PHP project shipped an emergency fix for two critical flaws in PHP itself, nicknamed PHP2Shell. If your website runs on PHP (and around 70% of websites do, including every WordPress site), your server was exposed until its PHP version was patched.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 (CVSS v4.0), and both can let an attacker run code on your web server without logging in. Details leaked online a day before the planned announcement, so attackers had a head start, and attack attempts climbed from tens of thousands to millions within hours of the fix going public.
Here is what broke, whether WordPress was affected, and what you need to do about it.
How the week unfolded
The flaws were found by Wiz Research in August with the help of AI models and reported privately to PHP. The public part of the story played out over seven days in October.
| Date (2026) | What happened |
|---|---|
| 17 October | Amazon’s honeypots log an exploit attempt, four days before public disclosure |
| 20 October | Details leak on social media; PHP posts an advance notice of two critical flaws |
| 21 October | PHP releases fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35; full details published |
| 21–22 October | Cloudflare sees attack attempts jump from tens of thousands to millions; government and university sites in Europe go offline to patch |
| 23 October | US cybersecurity agency CISA urges immediate patching; PHP flags a third, lower-risk issue (CVE-2026-115560) |
Sources: Datadog Security Labs, watchTowr, The Hacker News, Search Engine Journal, CISA
What exactly broke
No network protocol failed. HTTP, TLS and SSL all worked as designed. The fault sits inside the PHP engine, in how it cleans up after a request crashes with an out-of-memory error. A crash at the wrong moment leaves stale data behind, and the next request handled by the same PHP worker trusts that data as if it were valid.
The main entry point is PHP’s handling of file uploads over HTTP (multipart/form-data, defined in RFC 1867). PHP parses these uploads very early, before the rest of the engine has finished starting up. Its session “upload progress” feature can kick in at that early stage, and that is where the trouble starts.
| CVE | Where it breaks | What an attacker gets |
|---|---|---|
| CVE-2026-109618 | Session upload-progress handling during multipart file uploads | Reads server memory (passwords, API keys, tokens) via the PHPSESSID cookie, and runs code |
| CVE-2026-109619 | Fatal-error backtrace memory and the OPcache shared cache | Corrupts shared PHP state and runs code |
Two details make this unusually serious. The attack works even if your site never uses sessions or file uploads itself, because PHP processes the request before your application code runs. And the faulty code has been in PHP since version 5.4, more than a decade.
PHP says every installation that serves web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Apache with mod_php carries the highest risk. (CISA, Google Cloud)
Was WordPress affected?
Yes, but not because of a WordPress bug. WordPress runs on PHP, so any WordPress site on an unpatched PHP version is exposed. WordPress core, themes and plugins are not at fault, and WordPress.org has said no WordPress update is required or planned. (Codeable)
The risk is real, not theoretical. The researchers who found the flaws built a working, no-login attack against the latest WordPress install and showed the same against Drupal and Joomla. (Wiz Research)
Three things WordPress owners should know:
- Updating WordPress does not fix this. The fix lives on the server, in PHP.
- Maintenance mode does not help. PHP processes the attack before WordPress checks whether the site is in maintenance mode. (MIS Services)
- Old staging sites and forgotten subdomains count. Any PHP install facing the internet is a way in.
Which PHP versions are affected
Every PHP version from 5.4 up to 8.5.11 is vulnerable. You are safe only on one of the fixed releases below, or on an older version your host has explicitly patched.
| Your PHP branch | Safe from version | Notes |
|---|---|---|
| 8.5 | 8.5.12 | Official fix |
| 8.4 | 8.4.27 | Official fix |
| 8.3 | 8.3.36 | Official fix |
| 8.2 | 8.2.35 | Official fix |
| 8.1, 8.0, 7.4 | No official release | End of life; PHP offered source-code fixes only for those who build PHP themselves |
| 7.3 and older | No fix | Upgrade urgently |
Sources: SiteGround, Search Engine Journal, Google Cloud
If your site is still on PHP 8.1 or older, treat this incident as your reason to move to 8.3 or newer.
What to do now
Patching PHP is the only complete fix. Workarounds circulating online, such as switching off session upload progress, do not fully protect you. (Datadog)
- Check your PHP version. In WordPress, go to Tools → Site Health → Info and expand the Server section.
- Compare it with the table above. Anything below the fixed release for your branch needs attention.
- Ask your host to confirm the patch. Many large hosts patched within a day, but get it in writing for your specific server.
- Find the forgotten installs. Staging sites, old subdomains, hosting control panels like cPanel and Plesk, and office appliances can all bundle PHP.
- Look for signs of a break-in. Watch for repeated HTTP 500 errors after file uploads, oddly large PHPSESSID cookies, or the web server launching unexpected programs.
- Rotate secrets if in doubt. If a site was unpatched and exposed, change database passwords, API keys and admin logins, since the memory leak could have exposed them.
A third flaw, lower risk
On 23 October PHP flagged a further issue, CVE-2026-115560, which may allow code to run on servers with an unusual session setup. PHP considers it unlikely to affect most sites and will fix it in its next regular release, not as an emergency. No attacks on it have been reported. Until then, PHP’s advice is to disable session upload progress where you can. (The Hacker News)
Need a hand?
PHP2Shell is a reminder that keeping WordPress and its plugins up to date is only half the job. The server underneath matters just as much. If you are not sure which PHP version your site runs, or whether your host has patched it, CompFix can check your site, confirm the fix with your host and help you upgrade from an end-of-life PHP version safely. Get in touch and we will take a look.
FAQs
What caused the PHP failure?
The PHP failure was primarily caused by a critical update that introduced a bug due to inadequate testing and communication among development teams.
How did the incident affect WordPress sites?
Many WordPress sites experienced outages and functionality issues, as WordPress relies heavily on PHP for its operations.
Was WordPress itself compromised by the incident?
No, the core platform of WordPress was not compromised, but many users experienced issues due to the PHP-related disruptions.
What steps can website owners take to recover?
Website owners should back up their sites, assess any damage, and implement updates or rollbacks as needed, while also ensuring that all plugins and themes are up to date.
What can be done to prevent similar incidents in the future?
Implementing rigorous testing protocols, fostering better communication among teams, and prioritizing ongoing education for developers can help mitigate risks in future updates.
