PHP2Shell (CVE-2026-109618 & 109619): What Happened and How to Check If You're Affected

In October 2026, government portals, hospital sites, and online services across Europe and beyond went dark almost overnight. The cause wasn't an attack — it was a precaution. Two critical vulnerabilities had been found in PHP, the language that quietly runs a large share of the web, and administrators scrambled to patch or pull sites offline before attackers could strike. The flaws were nicknamed PHP2Shell. Here's what actually happened, who's affected, and exactly how to check your own site.

What happened

On October 21, 2026, the PHP project released emergency security updates for two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both were rated 9.2 out of 10 on the CVSS v4.0 severity scale — about as serious as a web vulnerability gets. Under certain conditions they allow unauthenticated remote code execution: an attacker could run their own code on a vulnerable server without ever logging in.

The release was actually pulled forward by a day. Proof-of-concept exploit details had leaked early, so the PHP security team shipped the fixes ahead of schedule to get ahead of attackers. Government agencies in the Netherlands, Finland, Germany, France, and Belgium temporarily took public websites offline while they patched — not because they'd been hacked, but to avoid being hacked in the window before the fix was applied.

The two flaws, in plain terms

• CVE-2026-109618 — an out-of-memory handling flaw. When PHP runs out of memory partway through handling a request, it can later treat that half-built internal data as if it were complete, leading to memory corruption.
• CVE-2026-109619 — a use-after-free error. Internal state tied to one request can remain accessible after the memory behind it has been released, so a later request can trip over that stale data.

One widely reported detail: these bugs sat undiscovered for over a decade. They surfaced now partly because AI-assisted security research was able to map out the complex sequences needed to exploit them — a sign of how vulnerability discovery is changing.

Who is affected

PHP powers a huge portion of the web — by some estimates it runs on roughly 70% of all websites. That includes most of the platforms you'd recognize:

• WordPress (and WooCommerce)
• Drupal, Joomla, and other CMS platforms
• Laravel, Symfony, and other PHP frameworks
• Magento and many e-commerce systems
• Countless custom PHP applications and portals

Crucially, this is a flaw in the PHP runtime itself, not in any one application. That means it doesn't matter how well-maintained your WordPress plugins are — if the PHP version underneath them is unpatched, the site is exposed.

If your site doesn't run PHP, you're not affected by these particular vulnerabilities.Sites built on Node.js, Next.js, Python, Ruby, or served as static files don't run PHP at all, so PHP2Shell doesn't apply to them. (SMTPDoctor itself is a Next.js app on Node — one reason modern-stack sites sidestepped this entirely.) That said, almost everyone manages somethingon PHP, so it's worth checking.

How to check if your website is affected

The single most important rule: check the PHP version that serves web requests, not just the one on the command line. They're often different installs, and php -v in a terminal can report a different version than the one your website actually uses.

1. WordPress: go to Tools → Site Health → Info, expand the Server section, and read the PHP version.
2. cPanel hosting: open MultiPHP Manager or Select PHP Version to see (and change) the version for each domain.
3. Plesk: check PHP Settings for the domain.
4. Your own server: you need PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (or newer). If you installed PHP from your Linux distribution, the version number may stay the same after a backported fix — check the package changelog for the CVE numbers instead.

If the serving version is below 8.2.35, 8.3.36, 8.4.27, or 8.5.12, you're exposed and should act.

How to fix it

Updating is the onlycomplete fix — there's no configuration workaround that fully closes the hole. The steps:

1. Update PHPto 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (or your distribution's patched package). On managed hosting, this is usually a dropdown in your control panel — or your host may have already done it.
2. Restart every PHP process after updating. The old, vulnerable code can keep running in memory until the process is restarted.
3. If you're on PHP 8.1 or older(past end of life), apply the available patch and plan a migration to a supported branch — those versions won't get ongoing security fixes.
4. Check for signs of compromise and rotate secrets if you have any reason to think the site was exposed before patching.

One trap worth flagging for WordPress owners: automatic WordPress updates will not apply this fix. The fix is to the PHP runtime, which sits below WordPress — so updating WordPress, plugins, or themes does nothing for it. You (or your host) have to update PHP itself.

What this means for everyone else

Even if you don't run PHP, PHP2Shell is a useful reminder of a few durable security habits. Know your stack and its versions. Keep an inventory of what runs where, so that when the next critical CVE lands you can answer "are we affected?" in minutes, not days. And remember that your exposure is only as current as the runtime serving your requests — not the app sitting on top of it.

While you're auditing a site's health, it's a good moment to confirm the basics are solid: check your HTTP security headers, verify your SSL/TLS configuration, and make sure your domain isn't on any blacklists. If you want the email-and-DNS side covered too, our domain reputation guide walks through the full checklist.

Frequently asked questions