PHP2Shell: what Australian business websites should check this week

What happened

The PHP project's advisory says the releases "fix two critical vulnerabilities that can allow unauthenticated remote code execution", that "All PHP users are strongly encouraged to update immediately", and that "There are no complete mitigations, updating is the only safe choice." [1][1] PHP project, homepage news "Security advisory: Critical remote code execution vulnerabilities, update now" and the per-version release notes, https://www.php.net/, dated 21 Oct 2026. Opened 23 Oct 2026.

The two flaws are CVE-2026-109618 (advisory GHSA-w8hw-w9fx-j79w, "RCE via OOM corruption") and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp, "RCE via stale global state"), both rated critical. [2][2] php-src security advisories GHSA-w8hw-w9fx-j79w ("RCE via OOM corruption", CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp ("RCE via stale global state", CVE-2026-109619), https://github.com/php/php-src/security/advisories, published 21 Oct 2026. Opened 23 Oct 2026. The PHP project says those at risk are "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed". [1]

"PHP2Shell" is the name Wiz Research gave the pair; the PHP project doesn't use it. [3][3] Wiz Research, "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", https://www.wiz.io/blog/php2shell-php-rce, 21 Oct 2026. Opened 23 Oct 2026. Wiz's headline mentions "70% of the Internet": that is how much of the web uses PHP, not a count of sites shown to be vulnerable. [3]

Which versions are fixed

• Fixed: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or anything newer in the same branch. [1]
• PHP 8.1 and older: "no longer receive updates from the PHP project". [1] If your site is on one of these, the real fix is moving to a supported version.
• PHP 8.2: fixed in 8.2.35, but it "reaches end of life on 31 December 2026". [1]

As of 23 Oct 2026, neither CVE was in CISA's catalogue of vulnerabilities known to be exploited (catalogue version 2026.10.21). [6][6] CISA Known Exploited Vulnerabilities catalogue, JSON feed, catalogue version 2026.10.21, https://www.cisa.gov/known-exploited-vulnerabilities-catalog. Checked 23 Oct 2026. That can change quickly; don't wait for it.

What to check this week

1. Find your PHP version. In WordPress, go to Tools > Site Health > Info and open the Server section. [4][4] WordPress.org, "Site Health Screen", https://wordpress.org/documentation/article/site-health-screen/ (last updated 12 Jul 2026), and "Requirements", https://wordpress.org/about/requirements/. Opened 23 Oct 2026. On cPanel hosting, MultiPHP Manager lists "The PHP version that the domain currently uses". [5][5] cPanel, "MultiPHP Manager for cPanel", https://docs.cpanel.net/cpanel/software/multiphp-manager-for-cpanel/ (last modified 8 Jul 2026). Opened 23 Oct 2026.
2. Compare it with the fixed versions above. WordPress itself recommends PHP 8.3 or greater. [4]
3. Back up first, and check the backup actually restores.
4. Update, or ask your host to. On managed hosting, email support and ask which PHP version your site is on and when it moves to a fixed one. Ask for the version number in writing.
5. Check your plugins and theme still work after the update, especially old ones that haven't been updated in a while.

Plugins and themes bring their own flaws every month: this month's WordPress vulnerability counts.

If your site doesn't run PHP

A static site (plain pages, no PHP or database on a server) isn't exposed to this particular pair of bugs. That doesn't make it maintenance-free: what static sites on Cloudflare still need watched.