Two critical PHP vulnerabilities have been discovered that could allow attackers to compromise websites without needing login credentials. Here’s what you need to know and how to protect your website.

On October 21, 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities in the PHP programming language. Collectively known as PHP2Shell, these vulnerabilities could allow attackers to execute malicious code on vulnerable web servers, access sensitive information, and potentially take control of affected websites.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, each received a critical severity rating of 9.2 out of 10 under the CVSS v4.0 scoring system.

The discovery is particularly concerning because PHP powers a significant portion of the internet, including popular content management systems such as WordPress, Joomla, and Drupal.

Unlike typical security vulnerabilities involving outdated plugins, themes, or website software, PHP2Shell affects the PHP engine itself. This means even a fully updated website could potentially be vulnerable if the underlying PHP version has not been patched.

Understanding the Two Critical PHP Vulnerabilities

Although PHP2Shell is commonly discussed as a single security issue, it includes two separately tracked vulnerabilities.

CVE-2026-109618: Remote Code Execution Through Memory Errors

The first vulnerability relates to how PHP handles out-of-memory conditions.

When a PHP application consumes more memory than permitted, PHP normally stops the operation and performs cleanup.

However, researchers discovered that certain memory failures could interrupt PHP before some internal information had been properly initialized.

This could leave PHP working with corrupted information during cleanup, potentially allowing an attacker to execute malicious code.

In practical terms, a specially crafted web request could trigger the vulnerability without requiring the attacker to log in.

CVE-2026-109619: Remote Code Execution Through Leftover Memory

The second vulnerability involves PHP retaining references to memory that should no longer be accessible.

Under specific circumstances, information associated with one request may remain accessible to a PHP worker even after its original memory has been released.

When another request arrives, PHP may attempt to use this outdated information.

Attackers could exploit this behavior to manipulate the PHP process, potentially execute unauthorized code, or expose sensitive information.

Both vulnerabilities are classified as critical.

Importantly, their exploitation depends on the PHP version, server configuration, and other technical conditions. Not every vulnerable installation will be exploitable in exactly the same way.

Nevertheless, the potential consequences make updating essential.

For additional technical details, see the official advisories for CVE-2026-109618 and CVE-2026-109619.

Which Websites Are Affected by PHP2Shell?

One of the most important things website owners should understand is that PHP2Shell does not specifically target WordPress or any other content management system.

Instead, it affects the PHP environment responsible for running these applications.

This means potentially affected websites include:

• WordPress blogs and business websites
• WooCommerce online stores
• Joomla and Drupal websites
• Laravel-based applications
• Custom-built PHP websites
• Other PHP-powered platforms and services

Security researchers demonstrated unauthenticated remote code execution against WordPress, Joomla, and Drupal environments.

However, these demonstrations do not mean that the applications themselves contain the vulnerabilities.

The weakness exists at a lower level, within PHP.

Consequently, updating WordPress, installing the latest plugins, or changing an administrator password will not resolve PHP2Shell if the underlying PHP runtime remains vulnerable.

The essential protection is ensuring that the web server is running a patched PHP version.

Which PHP Versions Are Vulnerable?

On October 21, 2026, the PHP development team released four security updates addressing the vulnerabilities.

The following table summarizes the affected and patched versions in the maintained release branches:

Older PHP releases, including PHP 8.1, 8.0, and 7.x, may also be vulnerable.

The PHP project no longer provides regular security support for PHP 8.1 and earlier versions. However, some operating system vendors and extended-support providers offer security fixes for these older releases.

If your website runs an older PHP version, contact your hosting provider to determine whether a security backport is available or whether upgrading to a maintained PHP version is necessary.

You can review the official updates on the PHP release announcements page.

Important: A vendor-maintained PHP installation may already contain the security fix through a backported patch, even if its displayed version number differs from the versions listed above.

What Could Happen If PHP2Shell Is Exploited?

The potential impact depends on the server environment and the permissions available to the affected PHP process.

Successful exploitation could allow attackers to perform several malicious actions.

Unauthorized Code Execution

Attackers could execute commands within the permissions of the compromised PHP worker.

Depending on the server configuration, this might allow them to modify website files, install malicious scripts, or create persistent unauthorized access.

Exposure of Sensitive Information

Researchers also demonstrated the possibility of extracting information from PHP process memory.

This information could include authentication tokens, API keys, passwords, and other sensitive data.

For websites handling customer information or online transactions, the consequences could be particularly serious.

Website Defacement and Malicious Redirects

Attackers gaining access to website files might replace legitimate content, inject malicious JavaScript, or redirect visitors to fraudulent websites.

Such incidents can damage customer trust and negatively affect a website’s reputation.

Service Disruption

Exploitation attempts could cause PHP processes to crash or become unstable, potentially interrupting website availability.

While these are possible outcomes, the existence of a vulnerable PHP version does not automatically mean your website has been compromised.

The immediate priority is to confirm that appropriate security updates have been applied.

How to Protect Your Website From PHP2Shell

The good news is that official security patches are available.

Website owners and server administrators should prioritize the following actions.

1. Check Your PHP Version

Start by identifying the PHP version used by your website.

Depending on your hosting environment, you may be able to find this information through your hosting control panel.

For WordPress websites, PHP information can also typically be viewed under:

WordPress Dashboard > Tools > Site Health > Info > Server

Remember that a PHP version number alone may not reveal whether your hosting provider has applied backported security patches.

When in doubt, request confirmation from your hosting provider.

2. Ensure the Necessary Security Updates Are Applied

The most important step is to ensure your website uses a PHP build containing the official security fixes.

The appropriate action depends on your hosting environment.

• On managed or shared hosting services, PHP updates may be handled by the hosting provider.
• On self-managed VPS or dedicated servers, the server administrator is generally responsible for installing the necessary updates.

If your website uses an outdated PHP branch, upgrading to a supported release is strongly recommended whenever application compatibility permits.

Before changing PHP versions, create a backup and confirm that your website’s themes, plugins, and custom code are compatible.

3. Keep Your Website Software Updated

Although PHP2Shell originates in the PHP engine, maintaining updated website software remains essential.

Continue installing security updates for WordPress, Joomla, Drupal, plugins, themes, and other dependencies.

These updates protect against separate vulnerabilities that attackers might exploit alongside PHP2Shell.

4. Maintain Reliable Website Backups

Regular backups are an important part of any website security strategy.

Make sure you have access to recent backups of your website files and databases.

Ideally, backups should be stored separately from the website’s primary environment and periodically tested for successful restoration.

Backups do not prevent exploitation, but they can significantly simplify recovery following a security incident.

5. Monitor Your Website for Unusual Activity

Pay attention to unexpected changes in website behavior.

Examples include unexplained PHP errors, unusual server activity, unfamiliar files, unexpected redirects, or changes to administrator accounts.

Security researchers also identified unusual upload requests, repeated server errors, and unexpected PHP worker restarts as possible indicators worth investigating.

These signs do not necessarily prove an attack has occurred, but they should not be ignored.

If you suspect your website has been compromised, contact your hosting provider or a qualified security professional.

Can PHP2Shell Be Prevented Without Updating PHP?

Some temporary configuration changes can reduce exposure to particular exploitation methods.

For example, the PHP security team has published recommendations involving memory settings, request-size limits, and session upload-progress functionality.

However, these measures do not provide complete protection.

In fact, certain configuration changes may affect application performance or functionality if applied incorrectly.

The PHP development team explicitly states that updating to a patched PHP release is the only complete remediation for the two disclosed vulnerabilities.

Website owners should therefore avoid treating firewall rules, security plugins, or temporary workarounds as substitutes for applying the necessary patches.

An additional PHP advisory published on October 23, 2026 also recommends temporarily setting session.upload_progress.enabled=0 for a separate, uncommon configuration-dependent scenario, pending a future fix. Administrators should review that advisory and apply its guidance where appropriate.

How Does This Affect HostArmada Customers?

Vulnerabilities such as PHP2Shell highlight why keeping the underlying hosting environment updated matters just as much as maintaining the website itself.

For HostArmada customers, the recommended first step is to verify which PHP version your website uses and whether the necessary security fixes have been applied.

Because security patching procedures can differ between hosting environments, customers should avoid making unnecessary configuration changes without understanding their potential impact.

If you are uncertain about your PHP version, need assistance checking compatibility, or have questions about the security of your hosting environment, our support team is available to help you identify the appropriate next steps.

Customers managing their own server environments should also verify that the relevant operating system and PHP packages have been updated.

Remember that websites using older PHP versions may require additional attention, particularly when legacy applications cannot be immediately migrated to a newer PHP branch.

Final Thoughts: Stay Updated, Stay Protected

PHP2Shell is an important reminder that even widely used and well-maintained technologies can contain serious security vulnerabilities.

What makes this discovery particularly significant is that it affects the PHP engine itself rather than a specific website application.

With two critical vulnerabilities capable of enabling unauthenticated remote code execution, timely security updates are essential.

Fortunately, the PHP development team and security researchers coordinated the release of patches to help website owners and hosting providers protect their environments.

For website owners, the most important actions are straightforward: verify your PHP security patch status, keep your website software updated, maintain reliable backups, and contact your hosting provider whenever you need assistance.

At HostArmada, we’re committed to helping our customers navigate security challenges and make informed decisions about protecting their websites.

Stay vigilant, keep your software updated, and don’t hesitate to reach out to our support team if you need help.

FAQs