If your organization runs WordPress, Drupal, Magento or any homegrown PHP app, this is the week to drop everything else. On October 21 the PHP project shipped emergency fixes for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now nicknamed PHP2Shell. The PHP Foundation’s advisory says they affect every PHP installation that serves web requests, going back to PHP 5, and that there is no complete workaround: updating is the only safe option.
WIRED reported that both flaws carry a 9.2 CVSS score and that some governments took sites offline rather than wait. Wiz’s researchers say an unauthenticated attacker can run code on an affected server or read process memory that may hold passwords, tokens, API keys and certificates. Here’s a checklist you can work through in about half an hour per environment.
1. Build the list (5 minutes)
- Pull every host, container image and managed hosting account that runs PHP. Don’t forget staging sites, old marketing microsites and admin tools nobody has touched in years.
- On each server, run
php -vand note the version. Check your web server’s PHP handler too, because the CLI version and the FPM version can differ. - Prioritize anything reachable from the internet. The UK’s NCSC specifically recommends starting with internet-facing systems.
2. Update (10 minutes)
- Only PHP 8.2 and newer receive official fixes. If you’re on 8.2, 8.3 or later, install the latest point release from your distro or php.net.
- On managed WordPress or shared hosting, check your host’s status page or open a ticket to confirm which PHP build you’re on. Many hosts patch for you, but confirm it rather than assume.
- Still on PHP 7 or older? Some vendors ship legacy backports, but the cleaner fix is to move to a supported version. If you can’t do either today, the NCSC’s advice is blunt: consider taking the system offline until it can be fixed.
- Restart PHP-FPM or your web server so the new binary is actually loaded.
3. Verify (5 minutes)
- Re-run
php -vand load aphpinfo()page on a private URL (then delete it) to confirm the web-facing version changed. - Rebuild container images rather than patching running containers, so the fix survives the next deploy.
4. Watch for compromise (10 minutes)
- Security firm Sansec warned mass attacks would follow within minutes of release, so assume you were probed. Look for unexpected file uploads, new PHP files in upload directories, and strange POST requests in your access logs since October 17.
- Rotate secrets that lived in PHP process memory: database passwords, API keys and session signing keys.
- If you find signs of compromise, follow the FBI’s guidance quoted by WIRED: isolate the system, keep your web server and PHP logs, and report it.
The takeaway
PHP2Shell is the rare bug where “we’ll get to it next sprint” is genuinely dangerous. Inventory, update, verify and check your logs today, and keep watching for vendor updates to software that bundles PHP internally.
Based on reporting by WIRED and the primary advisories linked above.
