PHP2Shell: critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619
On October 21, 2026 the PHP project released emergency patches for two critical vulnerabilities in the PHP interpreter itself: CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Within hours, Cloudflare reported that attack attempts had grown from thousands to millions.
PHP runs about 69% of websites whose server-side language is known (W3Techs). That includes WordPress, Magento, Drupal, Joomla, Laravel, and a large number of custom online stores and corporate sites. If your business has a website, an online store or a client portal, this most likely concerns you.
What happened, in brief
How a PHP2Shell attack works: one malicious request takes over the server
- Two critical bugs in the PHP core. Both are rated 9.2 out of 10 (CVSS v4.0, Critical).
- No password needed. Anyone on the internet can attack. In some configurations the attack works before your site's code even runs, so your CMS, plugins and built-in protection don't stop it.
- The attacker gets control of the server. That means they can steal your customer database, plant malware, inject a card skimmer into the checkout page, or use your server to attack others.
- Secrets can leak too. One of the bugs exposes server memory, where passwords, session tokens and API keys for payment systems, CRMs and other integrations may be stored.
Researchers have already confirmed working attacks against specific versions of WordPress, Drupal, Joomla and Magento.
Timeline: attacks started before the patch
PHP2Shell attack timeline, October 17–22, 2026
| Date (2026) | Event |
|---|---|
| Oct 17 | Amazon detects the first attack attempt in its honeypot network, four days before the vulnerability was announced. |
| Oct 20 | Vulnerability IDs leak publicly, and the patch release is moved up. |
| Oct 21, ~02:00 UTC | Several groups are already using working exploits, about 12 hours before the fix. |
| Oct 21, 14:00 UTC | PHP releases patches. US cybersecurity agency CISA urges everyone to act immediately. |
| Oct 21–22 | Cloudflare logs millions of attempts. Attackers adapt their requests to get past its firewall. |
This means a site can be compromised even if it was updated on the day of the release. Amazon recommends checking for suspicious activity going back to at least October 17.
Is my business at risk?
Which PHP versions are vulnerable to PHP2Shell
Most likely, yes, if any of your systems run on PHP:
- every PHP branch from 5.4 to 8.5 is affected
- for PHP 8.1 and older there is no official fix at all
- every common way of running PHP on a web server is affected
And it's rarely just one site. A typical company also has:
- test and staging copies of the site
- old landing pages and promo sites nobody remembers
- admin panels, CRMs and internal tools built on PHP
- containers and servers set up years ago by a previous contractor
An attacker only needs one forgotten server.
What's at stake for the business
- Customer data leak: personal data, orders, payment details
- Stolen card payments through a skimmer on the checkout page
- Site downtime during peak sales
- Search engine and browser blacklisting if the site starts distributing malware
- Compromised integrations: payment systems, delivery services, CRM, ERP
- Reputation damage and loss of customer trust
Why "just update PHP" doesn't solve the problem
It sounds simple, but in practice:
- Attacks started before the patch. Updating closes the door, but doesn't tell you whether someone already got in.
- Older sites break after an update. Shops on PHP 7.x often need code changes, otherwise checkout, integrations or the admin panel stop working.
- Temporary workarounds don't fully protect you. Even the PHP developers say interim settings only reduce the risk.
- A firewall isn't a guarantee. Cloudflare calls its own rules a stopgap, and attackers are already learning to bypass them.
- Nobody has a complete list of servers. What you don't know about, you can't update.
Doing this without experience means risking downtime, broken payments, or a false sense of security.
Wezom PHP security audit in 3 hours
PHP security audit and patching by Wezom
Wezom has been building and supporting PHP projects for over 25 years: corporate sites, online stores, portals and web applications. For PHP2Shell we've put together a fast-response service.
What you get in 3 hours
- Inventory of your PHP environments: production, staging, internal services
- Vulnerability check against CVE-2026-109618 and CVE-2026-109619
- Express check for signs of compromise since October 17
- A clear report: what's at risk, how critical it is, and what to do first
- An action plan with timelines and cost
After the audit, we can take care of everything else
- Emergency fix without site downtime, or within a short planned window
- In-depth compromise investigation and cleanup if traces of an attack are found
- Migration from outdated PHP with code, module and integration fixes, plus testing by our QA team
- Ongoing support and security monitoring, so the next critical vulnerability doesn't catch you off guard
FAQ
My site is on WordPress / Magento / Laravel. Does this affect me?
Yes. The vulnerability is in PHP itself, not in the CMS. Updating WordPress or plugins doesn't close it.
My hosting provider manages the server. Am I safe?
Not necessarily. Many hosts don't update PHP on their own, especially on VPS and dedicated servers. And an update doesn't answer the question of whether you were attacked before it.
We use Cloudflare. Isn't that enough?
No. Cloudflare itself says its rules are no substitute for fixing the vulnerability.
We already updated PHP. Do we still need an audit?
Yes. Attacks began four days before the patch. An audit will show whether anyone got in before the update, and whether you have other environments that weren't updated.
How long does the audit take?
3 hours from the moment we get access. After that, you'll have a report and an action plan.
