Two critical flaws in PHP, nicknamed php2shell, let an attacker run their own code on a website without logging in. If you host with us on shared hosting or a managed server, though, we have already handled the updates and there is nothing further you need to do.
This post covers what happened, what we did about it, and how to check if your own site is fixed. And if you run PHP on a server you manage yourself, this flaw is yours to handle, and a section further down shows how.
What happened?
Two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, let an attacker take over a website without even a login.
These two flaws affect PHP wherever it serves web pages, including plain PHP as well as popular content management systems and other scripts. Researchers have shown the attack working against WordPress, Drupal, and Joomla.
Because the flaws are in PHP itself, updating WordPress, themes or plugins does not fix them. Only a fixed version of PHP does.
Here are the key facts:
CVE IDs: CVE-2026-109618 and CVE-2026-109619
Severity: 9.2 out of 10 on the CVSS v4.0 scale, rated critical by the PHP security team
Impact: Unauthenticated remote code execution, meaning attackers can run commands on the site without prior authorization.
Disclosed: October 21, 2026, after details leaked on October 20.
Fixed in: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. See PHP's security advisory for more information.
Older versions: PHP 8.1 and earlier no longer get regular fixes from the PHP project, though some vendors supply backported builds. Because we use CloudLinux, these backported security fixes are already applied to earlier versions of PHP running on our systems.
The PHP team had planned a coordinated release for later that week. After the details leaked on October 20, it brought the release forward to October 21.
CISA, the US cybersecurity agency, is urging organizations to update immediately. When it published its alert, it had not seen the flaws exploited. Amazon Threat Intelligence reported an exploitation attempt on its honeypot network on October 17, four days before public disclosure.
What are the flaws specifically?
CVE-2026-109618 is a memory-handling flaw. When PHP runs out of memory part-way through setting up a request, it stops with some internal data only half-built. Then, during cleanup, it treats that leftover data as complete, which attackers can use to run code.
CVE-2026-109619 is a “use-after-free” flaw. When an error interrupts a request, PHP can free the memory it was using but leave a stale reference to it. The next request handled by the same PHP process can follow that reference to memory that now holds something else, which lets attackers read data or run code.
What we did about it
Our team began a PHP-related security update on October 21 and posted a maintenance notice on our status page, telling customers they might see brief interruptions while the security checks were completed.
The flaws became public a day before the official fixes, which meant anyone doing their own PHP updates had to wait for packages from their vendor so they can apply them by hand.
On a managed plan, that work was entirely handled by us. We posted updates on the status page as the work continued for those who wanted to follow along without contacting our support team.
Why nobody had to rush an upgrade
The usual advice for a site on an older, unsupported PHP version, is to upgrade to a current one. It's solid advice, keep your software up to date, but it can be a bigger job than it sounds.
Newer PHP versions can break themes and plugins that were written for older ones, so upgrading in a hurry, in the middle of a scare, is how sites can end up broken.
On our managed servers, CloudLinux gives us another route. It includes a feature called Hardened PHP, which takes the security fix and applies it to the version of PHP you are already running. Your site keeps its PHP version and should carry on working as before, with the flaws closed.
Managed sites on older PHP versions, such as PHP 8.1 and earlier, are automatically covered this way on hosting.com. For you, that means:
You needn't upgrade your PHP version in a hurry.
You don't have to test your theme and plugins against a new PHP version this week.
You shouldn't have to schedule downtime for a migration.
Because the version number, on those older PHP releases, stays the same, it cannot tell you whether the fix is in place. That's why the check later in this post asks you to confirm with your host if you are on an older version.
Being fixed and being supported are two different things. PHP 8.3.36, for example, is fully fixed. PHP 8.2 also has its fix, but its security support ends on 31 December 2026, so it's worth planning a move to a newer version.
Why you didn't have to think about it
Behind all of our managed hosting services is monitoring that runs around the clock. Automated systems handle reporting, patching and monitoring, and real people run them and step in at any hour. Managed servers also get daily backups, stored away from the server itself.
A situation like this is precisely what a managed hosting plan for WordPress is for: the update happens whether or not you were even aware of what had occurred. And if you'd like to learn more about what goes on behind the scenes, you can always read our page on maintenance for WordPress.
How to check your own website
In order to see if your site is using a fixed version of PHP, find the version your web server uses, then compare it with the fixed versions from above.
On WordPress, go to Tools > Site Health > Info > Server. It shows the PHP version your site is using.
Compare the version you see with the fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or anything newer on those branches.
If you have shell access, be careful when using php -v as PHP served by the command line can report a different version from the one serving your site. We recommend you rely on the checks above.
If you manage your own server
On a plan where you have root access (for example an unmanaged VPS or dedicated server), it is important to do software updates yourself, because we do not have access to apply this patch for you.
Depending on the type of server and access you have, implementing the fix can be as simple as running one command or as involved as compiling PHP from source. If you need a hand, our support team is available for advice 24/7 through live chat.
Update to a fixed version
Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to your vendor’s equivalent package, then restart all PHP workers and services. Without the restart, the fix won’t take effect.
If you are running an older version, ask your vendor for a backported build or move to a supported version.
If you can't update right away
For those who are unable to apply the fix immediately, PHP's interim measure is to turn off session upload progress.
Set session.upload_progress.enabled = Off inside your php.ini file, then restart PHP. It closes one route to CVE-2026-109619, so treat it as a stopgap rather than a fix. CISA advises taking PHP-based systems offline until they are updated if you cannot update right away, and watching for PHP launching shells or downloading tools.
The PHP advisory lists a second setting for the flaw, too. Set fatal_error_backtraces=0 in the php.ini file or your server's configuration, then restart PHP. The advisory describes a confirmed attack on PHP 8.5 that depends on this setting being enabled. Like the previous mitigation above, this is not a permanent solution.
Set memory_limit=-1, preferably in a way applications can't override, such as php_admin_value in the FPM pool or Apache configuration, and check that no pool, directory or application setting puts a finite limit back. This removes the controllable PHP memory limit failure, but an underlying allocation failure can still reach the vulnerable path.
Set a low post_max_size. For applications that don't require file uploads, set post_max_size = 8M. If file uploads are necessary, set post_max_size = 32M. Keep upload_max_filesize below post_max_size. Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits must also cover requests without a usable Content-Length.
If you are a customer on a managed plan, you needn't worry about any of this.
Was your site targeted before the fix?
Updating PHP stops new attacks, but it can't tell you if someone got in earlier. For example, earlier we mentioned Amazon's threat team recorded an attempt to exploit these flaws four days before disclosure. They say it's not clear if the attempt would have worked against a real website, so this is not a reason to panic.
Nonetheless, if your site was using an unpatched version of PHP during that window, a quick look is worth your time. Here's what to do:
If you have access to your server, start from October 17, not the day of the disclosure, and check for:
POST requests in your web server logs that contain PHP_SESSION_UPLOAD_PROGRESS
PHP processes starting shells or download tools, such as sh, bash, curl, or wget
Files you didn't create, especially in your site's root folder
New scheduled cron jobs or user accounts you don't recognize
If you have only the WordPress dashboard, ask your host for your access logs and a malware scan. Check your Users page (and the database) for administrator accounts that shouldn't exist.
If you find something
Take the site offline and keep your web server and PHP logs rather than deleting them.
Then, change any passwords and API keys the site could reach, since researchers have shown these flaws can expose data held in memory. Then ask your host or a security professional for further help.
If you'd rather not do this alone, Fixed.net maintenance plans can take it from there. Every plan includes managed hosting, staged plugin and theme updates, twice-daily backups and malware protection. All of that is backed up by 24/7 support and we'll deal with a broken site as part of the onboarding.
Managed hosts are built for this
A week like this is the reason managed hosting exists.
If you’re not an experienced server admin, a flaw like this can easily go unnoticed. Instead, managed hosting keeps an eye on the software your site uses, so you can rest easy.
If you would rather not handle another such vulnerability yourself, moving to any of our plans is free and our team does all the work.
