CISA confirms PHP2Shell flaws are being exploited: update PHP now

Updated 28 Oct 2026. Attackers are now using the two critical PHP flaws known as PHP2Shell, the US Cybersecurity and Infrastructure Security Agency (CISA) says. The flaws, in the language that runs a large share of the world’s websites (WordPress included), can let an attacker take over a web server without logging in. Fixes are out: if you run a website, or pay someone to host one, update now. This page explains the problem and exactly what to do.

At a glance

What: two flaws in PHP itself, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619).
Risk: an attacker can run their own code on your server without a password. CISA says the flaws are now being exploited.
Severity: Critical. PHP rates both 9.2 out of 10 (CVSS v4.0).
Fix: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your host’s or Linux distribution’s patched package.
Who has to act: whoever runs the server. On most hosting plans that is your host, but it is worth checking.

1. The problem

On 21 October 2026 the PHP project released emergency updates for two critical vulnerabilities in the PHP engine. Both allow unauthenticated remote code execution: someone on the internet can send a specially crafted request and make the server run their commands, without logging in first.

PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP Foundation says code execution was shown on mod_php with default settings before a website’s own code even runs, and through application code paths on PHP-FPM. Security firm Wiz says it demonstrated attacks against WordPress, Drupal and Joomla.

The US National Security Agency, FBI and CISA urged organisations to update straight away. The NSA said the flaws often give a direct path to a server’s files or database, and that systems which cannot be updated immediately should be taken offline until they can be fixed. Agencies in the UK, the EU, Canada, Australia and Japan issued similar warnings, and some government websites in Europe went offline as a precaution.

CISA said it had not seen the flaws exploited at the time of its alert on 21 October. On 26 October it added both to its Known Exploited Vulnerabilities catalogue, which means it has evidence that attackers are using them. Trade press reports say US federal civilian agencies were given until 29 October to fix them, and that a researcher confirmed a successful attack on a test server (a honeypot) running Apache with mod_php on 24 October. Cloudflare has since reported attack traffic aimed at its customers, though that does not mean the attempts succeeded.

2. What it means, in plain words

What is PHP?

PHP is the software on a web server that builds pages before they reach your browser: it handles logins, contact forms, shopping carts and blog posts. You never see it, but WordPress and many other site builders depend on it. Because the bugs are in PHP itself, updating your theme or plugins will not fix them.

What does “remote code execution” mean?

It means an outsider can make your server do whatever they want, as if they were sitting at it. In practice that could mean stealing customer data, changing your pages, adding malware, or using your server to attack others.

The two bugs, simply

CVE-2026-109618 (out-of-memory corruption): if a request runs out of memory at the wrong moment, PHP can leave its internal data half set up, then treat that broken data as valid while cleaning up. An attacker can trigger this on purpose with a crafted request.
CVE-2026-109619 (stale global state): data from one request can be left behind after its memory is freed and then reused by a later request on the same worker. PHP’s session upload progress feature, switched on by default, is one confirmed way in, but PHP warns there are others.

Who is affected, and who is not

Affected: any website or web app running an unpatched version of PHP, on any branch. That includes most WordPress sites until their host updates.
Hardest hit: sites on PHP 8.1 or older. These branches no longer get updates from the PHP project. Its security team has published minimal fixes for PHP 7.4, 8.0 and 8.1 for people who build PHP from source, and some Linux vendors offer patched packages, but the safest route is a supported version.
Not directly affected: people who simply visit websites. Available reports do not suggest that visiting an affected site infects your device. A site that has gone offline may just be taking precautions.

Where AI comes in

AI tools helped find both bugs. According to the PHP Foundation, security firm Calif reported code execution on 11 August 2026, and OpenAI independently reported the same root cause the same day; OpenAI says Calif used its GPT-5.6 Sol model. Wiz separately found and reported both flaws using its own security agent with models from Google and OpenAI. Reports differ on how old the underlying weakness is: TechCrunch traced it to PHP 5, while researchers say exploit code works back to PHP 5.4.

The PHP Foundation says early signs of the memory problem surfaced in 2024, but limited resources, compatibility worries and slow agreement on a fix delayed the work. It says AI tools are now finding bugs faster for defenders and attackers alike, and that it is changing how it makes decisions so similar problems are fixed sooner. Details of the flaws leaked online on 20 October, so PHP brought the release forward by a day.

3. What to do

PHP says updating is the only complete fix; there is no setting that fully protects you. Start with step 1, then follow the path that matches how your site is run.

Step 1: find your PHP version

WordPress: go to Tools → Site Health → Info, open the Server section and look at PHP version.
Other sites: look in your hosting control panel (often under “PHP settings” or “PHP configuration”), or ask your host.

Step 2: compare it with the fixed versions

If your PHP is on	You are safe from
8.5	8.5.12 or newer
8.4	8.4.27 or newer
8.3	8.3.36 or newer
8.2	8.2.35 or newer
8.1 or older	No regular update: ask your vendor, or move to a supported version (see below)

A lower number does not always mean you are exposed. Linux distributions such as Ubuntu, Debian and AlmaLinux patch their own PHP packages and keep older-looking version numbers. If your number is below the table, ask your host whether their PHP package includes the fixes for CVE-2026-109618 and CVE-2026-109619.

Step 3a: if a host runs your site

This covers most WordPress sites on shared or managed hosting. Your host updates PHP, not you. Check their status page or blog for a PHP2Shell notice, and if you cannot find one, send them a message like this:

Hello, my site is [your site address]. Can you confirm that the PHP version serving it includes the fixes for the PHP2Shell flaws, CVE-2026-109618 and CVE-2026-109619 (PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a patched package), and that PHP has been restarted since the update? If my site is on PHP 8.1 or older, please tell me how to move it to a supported version. Thank you.

Many hosting panels also let you switch the PHP version yourself. If yours does and the site is on 8.1 or older, test a supported version (8.3 or newer is supported for longer) on a staging copy first if you can, because old plugins sometimes break.

Step 3b: if you run your own server

List every system running PHP, starting with anything reachable from the internet. Do not forget appliances, containers and third-party products that bundle PHP.
Install the fixed release for your branch, or your distribution’s security update (Ubuntu, Debian, AlmaLinux and Amazon Linux have all published patched packages).
Restart everything that runs PHP: PHP-FPM, Apache, web server worker pools and application workers. Running workers keep the old, vulnerable code until they restart.
Rebuild container images from patched base images and replace running containers. Patching a running container leaves the image exposed.
Confirm the result by checking the PHP version actually served by the website, not just the one installed on the command line.

If you cannot update today

The NSA’s advice is to take the system offline until it can be fixed. If that is not possible, these stopgaps reduce some risk but are not a fix:

Set session.upload_progress.enabled = 0 in the server-level PHP configuration (php.ini or the FPM pool config, not per-site files), then restart every PHP worker. This blocks the confirmed session attack paths only.
On PHP 8.5, also set fatal_error_backtraces = 0 and restart.
Limit request size and complexity at the web server or proxy, and use a web application firewall if you have one. Cloudflare says it has deployed protection rules for these flaws, including on free plans.

If you think you were attacked

Ask your host or a security professional to check the server before you patch and restart. Security researchers note that restarting PHP clears memory that may hold evidence of an attack. Then update, change passwords and keys stored on the server, and keep watching for unusual activity.