A WordPress dashboard can show every plugin as up to date while the PHP runtime underneath it still needs an urgent security patch. That distinction matters after the disclosure of two critical PHP vulnerabilities on 21 October 2026, now widely called PHP2Shell.
The correct identifiers are CVE-2026-109618 and CVE-2026-109619. Both use the year 2026. The PHP project has released fixes, so website owners and hosting teams have a concrete action to take rather than waiting for another advisory.
For an Indian business running a store, booking service or client website, the immediate question is simple: which PHP build is actually serving requests, and has its fix been deployed? Updating a theme, changing a password or buying a security plugin does not answer that question.
What Has Been Confirmed?
The PHP security team's 21 October advisory identifies two runtime flaws that can permit remote code execution without an attacker logging in. The individual security advisories rate each vulnerability Critical, with a CVSS v4.0 score of 9.2.
Remote code execution means running attacker-controlled instructions on the server. The demonstrated impact is execution with the web worker's permissions, not an automatic promise of root-level access. The eventual damage depends on what that account can read, modify or reach.
Researchers demonstrating an exploit is also different from confirming that a particular business has been breached. This article does not establish whether your server has been attacked. It explains the disclosed weaknesses and the evidence to collect when arranging a fix.
How the Two Vulnerabilities Differ
CVE-2026-109618: Out-of-Memory Corruption
The first flaw concerns how PHP handles a failed memory allocation. A request can be interrupted while internal request data is not fully ready. Cleanup can then act on that invalid state. The problem is inside the runtime, rather than simply being an insecure line in a site's own PHP script.
PHP's detailed advisory confirms remote code execution over HTTP against Apache's mod_php. In that demonstrated path, request parsing and cleanup can reach the flaw before application code begins. An application's login check therefore does not provide a dependable barrier against that path.
CVE-2026-109619: Stale State Between Requests
The second flaw involves a worker retaining references to memory belonging to a request that has ended. If that memory has been freed but the reference survives, a later request handled by the same worker can encounter stale state. This is a use-after-free problem.
The official advisory documents confirmed paths involving fatal-error backtrace state and session upload progress. It also describes validated session-lifecycle exploitation against PHP-FPM under suitable application conditions. That qualification matters: different server configurations expose different paths, but using FPM is not a reason to dismiss the update.
Which Websites and PHP Versions Need Attention?
PHP's warning covers installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It identifies mod_php as the highest-risk setup. That is a prioritisation signal, not a declaration that the other environments are safe.
NHS England's alert also describes demonstrated exploitation in PHP-based products such as WordPress, Drupal and Joomla. This does not mean that every installation of those applications is compromised. It means their administrators need to examine the underlying PHP runtime, not only the application's update screen.
The patched upstream releases announced on 21 October are:
| PHP branch | Patched upstream release |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
Use the fixed release or a later supported security release for the branch concerned. Older upstream releases need attention too. A hosting company may supply a backported fix, but that needs a vendor advisory and a full package-version check, not a verbal assurance that an old branch is still supported.
Why an Older-Looking Package Can Already Be Patched
Linux distributors sometimes apply security fixes without adopting the newest upstream version number. Ubuntu's USN-8948-1, for example, lists 8.3.6-0ubuntu0.24.04.13 for Ubuntu 24.04 LTS and 8.1.2-1ubuntu2.28 for Ubuntu 22.04 LTS as corrected packages.
Those are distribution-specific builds, not alternative upstream release targets for every server. Conversely, seeing only 8.3.6 is not enough to establish whether the Ubuntu fix is installed. Keep the complete package revision, operating-system release and package source together when checking a server.
PHP 8.1 and older no longer receive normal upstream support. Vendor backports can address this incident where available, but they do not remove the need for a migration plan. Ask who supplies the patch and how long that maintenance arrangement lasts.
A Practical Checklist for Hosting Teams and Agencies
For a small agency managing several client sites, work through the actual hosting accounts rather than assuming all clients share one runtime. A useful handover record contains the following:
- Inventory: record each website, hosting account, PHP handler, runtime branch and maintenance owner. Include containers and vendor products with embedded PHP; the Dutch NCSC warns that PHP dependencies can exist beyond ordinary websites.
- Patch evidence: obtain the installed build and the vendor's confirmation that it fixes both CVE identifiers. A command-line
php -vcheck is useful, but it describes that executable; the web server may use a different version. - Deployment evidence: confirm that the PHP workers or the relevant web service were restarted as required. Canonical notes that installing packages alone can leave applications needing a restart.
- Application checks: test sign-in, contact forms, uploads and checkout where applicable. Record failures and resolve compatibility problems with the hosting team instead of silently returning to a vulnerable build.
- Closure: retain the package revision, affected domain list, restart time, test results and the person responsible. Leave unresolved accounts visible in the incident tracker.
This record is more useful than a screenshot saying that automatic updates are enabled. Our existing guide to vulnerability triage and patch evidence for small IT teams explains the broader prioritisation process. It is background guidance, not a PHP-specific CERT-In advisory.
What If the Patch Cannot Be Applied Immediately?
ENISA's joint statement recommends prioritising internet-facing systems and considering isolation from public networks when immediate remediation is not possible. For a business website, that decision should involve the hosting provider and the person responsible for continuity, with a defined patch window rather than an indefinite workaround.
PHP documents temporary measures, including disabling session.upload_progress.enabled before request parsing and restarting every worker. For PHP 8.5, disabling fatal_error_backtraces blocks one confirmed path. Neither setting covers all variants. Applying a setting late inside application code is not equivalent to configuring the runtime before request handling.
The out-of-memory advisory also discusses enforcing memory_limit=-1 as a partial mitigation. Removing PHP's memory ceiling changes availability risk and still leaves underlying allocation failures relevant. Do not copy that setting across production servers without an administrator assessing resource boundaries and the full advisory. Raising an ordinary finite limit is not a complete fix.
A plugin update, suppressed error messages or a clean-looking homepage is not proof of remediation. Keep temporary measures documented and replace them with patched runtime builds. If compromise is suspected, preserve relevant logs and involve incident responders; patch installation alone does not investigate an earlier intrusion.
Conclusion
PHP2Shell is a runtime security issue, so the fix must reach the PHP build that handles real web requests. Start with exposed services, obtain evidence for both CVEs, restart the affected processes and verify the application afterwards. For a business owner without server access, the most useful next step is a specific hosting support request with both identifiers and a request for the installed fixed package revision.
Research checked on 22 October 2026. Image: Pixabay via Pexels, listed as free to use under CC0. Illustrative PHP code photograph; it is not an exploit demonstration or evidence of a compromised server.
