PHP Under Attack: Two Critical Vulnerabilities and How to Protect Your Website

On 21 October 2026, the PHP security team issued an extraordinary update to address two critical vulnerabilities that may allow unauthenticated remote code execution. The issue potentially affects a vast number of applications, from WordPress websites and online stores to bespoke business systems.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as PHP2Shell, both received a CVSS 4.0 score of 9.2 out of 10. This is not a flaw in a plugin or framework: it affects the PHP engine itself—the component that executes application code on the server.

The consequence is significant: even a correctly developed website may be exposed if it runs on a vulnerable PHP version. Let us examine what happened, which installations require attention, and how to carry out the update without jeopardising existing services.

Two vulnerabilities at the heart of the PHP interpreter

PHP processes requests received from the web server and manages data, variables, and internal memory structures during execution. The two vulnerabilities disclosed on 21 October concern this memory management.

CVE-2026-109618 is connected to out-of-memory handling. Under certain circumstances, execution can be interrupted before some internal request data has been fully initialised. Subsequent cleanup operations may then treat invalid information as though it were valid.

CVE-2026-109619 concerns an internal state that may survive after the memory to which it referred has been released. A later request handled by the same PHP process may encounter that invalid reference before the normal initial state has been restored.

Under exploitable conditions, both issues can lead to remote code execution (RCE). This does not mean that every vulnerable installation has already been compromised, nor that exploitation succeeds automatically in every configuration. It does mean that the risk is severe enough to require urgent action.

The official PHP Security Team advisory identifies web-facing installations as potentially affected, including those based on PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The risk is considered particularly high with mod_php, for which an exploitation scenario triggered before application code executes has been demonstrated.

Which versions are affected?

The PHP project released four security updates. Anyone using one of the branches below should verify that at least the corresponding patched version is installed.

The situation is more delicate for PHP 8.1 and earlier, which no longer receive security updates from the PHP project. Some operating-system vendors may backport fixes to their own packages while retaining an apparently older version number. In these cases, check the vendor’s security advisories and the actual packages distributed rather than relying solely on the version number reported by the server.

The release life cycle also matters: official support for PHP 8.2 ends on 31 December 2026. Patch 8.2.35 resolves the current emergency, but organisations still using this branch should already be planning a move to a newer version. The dates are listed on the official supported PHP versions page.

How to check the PHP version used by a website

The first check is straightforward, but one detail is important: multiple PHP installations can coexist on the same server. The command-line version is not necessarily the one executing the website.

With SSH access, the following command shows the PHP version available in the shell:

php -v

This is a useful starting point, not a definitive check. An application may use PHP-FPM with a different version. To identify running PHP-FPM processes, use:

ps -eo pid,ppid,args | grep '[p]hp-fpm'

Next, inspect the virtual-host configuration, PHP-FPM pool, or hosting control panel to identify the interpreter actually assigned to the site. In a provider-managed environment, confirmation may be required that security fixes have been applied, particularly when packages contain backported patches.

In WordPress, the PHP version used by the application is normally available under Tools → Site Health → Info → Server. This is also useful for people without SSH access.

CERT-AGID has also highlighted tools for checking exposure to PHP2Shell. Their results must be interpreted carefully: remote checks based on HTTP headers may not identify the running version accurately, while an older version number alone does not prove that vendor-provided patches are absent.

How to secure the server

The PHP Security Team’s guidance is unequivocal: there is no complete mitigation, and updating is the only secure solution. A web application firewall, stricter rules, and monitoring systems may reduce exposure, but they do not correct the flaw in the interpreter.

On a production website, however, updating should not mean making changes blindly. The correct process begins with an environment assessment and ends with functional application testing.

Before updating

Prepare and verify backups of files and databases, identify the PHP version actually in use, check extensions and dependencies, and reproduce the environment in staging whenever possible. Applications that handle business data or critical processes also need a rollback plan in case incompatibilities emerge.

Installing the fixes

On Debian and Ubuntu systems where PHP is managed through APT, begin by checking which updates are available:

sudo apt update
apt list --upgradable

These commands do not install the fix automatically; they only show packages available from the configured repositories. Before proceeding, verify that the vendor has released a corrected package for the distribution and PHP version in use.

After installation, the processes executing PHP must load the updated components. In an environment using PHP-FPM 8.3, for example, the service might be restarted with:

sudo systemctl restart php8.3-fpm

This is only an example: the service name and procedure depend on the installation. Apache servers using mod_php, managed hosting, and containerised infrastructure require different steps. The final check must confirm that the process serving web requests is actually using the corrected version.

The most delicate case: legacy PHP applications and business systems

So far, we have considered updating the environment. But what happens when a business still depends on a system originally developed for PHP 5.6 or PHP 7.4?

This is more common than it may seem. Many bespoke applications continue to perform their job effectively for years without receiving structural updates. The problem emerges when an infrastructure change becomes unavoidable: the application still works, but its underlying technology is no longer supported.

Moving to a modern PHP version may expose removed functions, incompatible libraries, changes in type handling, previously hidden errors, or issues with database extensions. A classic example is the old mysql_* API, removed in PHP 7: an application that depends on it must be adapted to MySQLi or PDO.

This does not necessarily mean rewriting everything. A well-planned migration can preserve existing business logic while updating incompatible components and progressively introducing checks and tests that may previously have been absent.

The process should begin with an analysis of the source code and dependencies, continue with the selection of a target version and the necessary changes, and conclude with regression testing of the most important operations: authentication, permissions, data creation and editing, document generation, external integrations, and administrative procedures.

For a business application, success is not measured merely by the absence of PHP errors. What matters most is that operational processes continue to work correctly. This is why security and business continuity must be addressed together.

WordPress and WooCommerce: updating the CMS is not enough

An up-to-date WordPress installation, with current plugins and themes, is not automatically protected from a vulnerability in the PHP engine. The same applies to WooCommerce: the application layer and server environment are distinct components of security.

WordPress and its extensions must therefore be maintained alongside PHP and the operating-system packages. On shared hosting, the provider is normally responsible for updating the interpreter. Before changing the PHP version through a control panel, it is still advisable to check the compatibility of the theme, plugins, and custom code.

After patching: verify functionality and possible signs of compromise

Installing the patch is the essential step, but it does not complete every check. Afterwards, verify the version actually loaded by the web server, test the application’s main functions, and inspect logs for errors or anomalous behaviour.

It is also important to distinguish fixing the vulnerability from responding to an earlier compromise. Updating PHP prevents exploitation of the corrected flaws, but it does not automatically remove malicious files, unauthorised accounts, or changes made by an attacker. Suspicious indicators require a dedicated system investigation.

Security should not depend on an emergency

PHP2Shell highlights an often-overlooked principle: software that continues to work is not necessarily secure software. This is especially true for bespoke applications that may remain operational for many years without an evolutionary maintenance plan.

The immediate priority is to identify exposed installations and apply the available fixes. For older projects, however, this intervention can also become an opportunity to address incompatibilities, obsolete dependencies, and accumulated technical debt.

Updating does not always mean starting again. It means protecting the work already completed and creating the conditions for it to remain reliable.

Sources and further reading

• PHP Security Team — Official advisory of 21 October 2026
• PHP.net — Corrective release changelog
• PHP.net — Supported versions and end-of-support dates
• CERT-AGID — Tools for checking PHP2Shell exposure

Does an outdated PHP application need to be upgraded? Before changing a business system or bespoke website, it is important to assess compatibility, dependencies, and operational risks. At matcode.dev, I develop, maintain, and modernise web applications with particular attention to the continuity of existing systems.