Updating WordPress or your plugins does not fix this one. The two critical flaws, nicknamed "PHP2Shell," are in PHP itself. PHP is the software on the web server that runs WordPress, Drupal, Joomla, Magento and most small-business websites. The fix is a new version of PHP, and on most small-business sites that's installed by whoever runs the server, usually your web host. WordPress security firm Wordfence warned that automatic updates won't apply it, CNBC reported.
What's confirmed
- The flaws: PHP's security team lists them as CVE-2026-109618 and CVE-2026-109619. Both can allow "unauthenticated remote code execution," meaning an attacker can run commands on your web server without logging in. PHP's GitHub advisories rate both 9.2 out of 10 (critical).
- The fix: PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on the morning of Wednesday, Oct. 21, a day early because details had leaked online on Oct. 20.
- Older versions: PHP 8.1 and older no longer get official releases. PHP's security team did publish minimal source-code patches for 7.4, 8.0 and 8.1 for people who build PHP themselves, and some Linux vendors and long-term-support providers offer their own backported fixes. If your site runs 8.1 or older, plan to move off it.
- Secrets in memory: PHP's advisory lists "memory disclosure" as a confirmed impact of CVE-2026-109619. SecurityWeek reports that the flaws can be used to read server memory that may contain passwords, API keys and other secrets.
- The US government's advice: CISA urged organizations to patch immediately. It also said anyone who can't update right away, or who still runs PHP 8.1 or older, should take PHP-based systems offline until they're patched. Nextgov/FCW and Defense One reported that the NSA and FBI joined that warning.
- Overseas: The UK's NCSC and CERT-EU gave the same advice: patch now, and take systems offline or isolate them if you can't. The Dutch NCSC took its own website offline as a precaution.
What isn't known yet
Attackers are already trying. watchTowr, Cloudflare, Patchstack and Hadrian all reported exploitation attempts, according to SecurityWeek. But as of about 2:15 PM ET on Oct. 21, no source had confirmed a successful break-in, and CISA had not added either flaw to its Known Exploited Vulnerabilities catalog. "Whilst nobody has been successful to date, we don't expect that will last long," watchTowr's Jake Knott told SecurityWeek. CISA said it had not seen exploitation when it published its alert. Palo Alto Networks' Unit 42 counts more than 22.6 million internet-exposed instances that may be vulnerable.
The takeaway
This is a "find out who owns your server" week. If you're on shared or managed hosting, your host updates PHP, and you need them to confirm they've done it. If you or a contractor run your own server or cloud machine, the update is on you. Either way, a green "WordPress is up to date" message tells you nothing about PHP.
What to do today
- Ask which PHP version you run. Email your host or web person and ask them to reply in writing with the exact version for each site. WordPress also shows it under Tools > Site Health > Info > Server.
- Update today. You need 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor package that says it contains the fix. Ask them to restart PHP afterward.
- On 8.1 or older? Plan the migration to a supported version now. Until it's done or your vendor confirms a backported fix, CISA's advice is to take the site offline.
- Check shared hosting. Ask your host directly whether its shared servers and control panels have been patched. Don't assume they have.
- Check plugins and backups. Make sure your plugins and themes work on the new PHP version. Confirm you have a recent clean backup stored somewhere other than the web server.
- Rotate secrets. Because server memory can leak, change the passwords and keys your site uses once PHP is patched. That includes database, admin, SFTP and hosting logins, plus payment, email and other API keys.
- Watch for signs of compromise. Look for admin accounts you didn't create, new or changed files in the site folder, unexpected redirects or pop-ups, and alerts from your host. Huntress advises watching for the web server launching shells or download tools. If something looks off, preserve the logs and call for help before you wipe anything.
How Brotherly Technology can help
Brotherly Technology helps small businesses and professional firms in Rome, Northwest Georgia and beyond work through incidents like this. We can confirm your PHP version with your host, coordinate the update, rotate credentials and check for signs of compromise. If you're not sure who updates PHP on your site, give us a call today.
Sources
- PHP: Security advisory: Critical remote code execution vulnerabilities, update now (Oct 21, 2026)
- PHP GitHub advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
- CISA: Critical Vulnerabilities in PHP Require Immediate Patching (Oct 21, 2026)
- Nextgov/FCW: US agencies urge fixes for programming language flaws (Oct 21, 2026)
- Defense One: Critical flaws in ubiquitous website software draw urgent warning from NSA, FBI (Oct 21, 2026)
- UK NCSC: Critical security issue affecting PHP (Oct 21, 2026)
- CERT-EU Security Advisory 2026-018: Critical Vulnerabilities in PHP (Oct 21, 2026)
- SecurityWeek: PHP2Shell patches land as first exploitation attempts hit sensors (Oct 21, 2026)
- BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws (Oct 21, 2026)
- Huntress: Rapid Response: php2shell (Oct 21, 2026)
- Google Cloud: Responding to core PHP vulnerabilities (Oct 21, 2026)
- Unit 42 (Palo Alto Networks): Threat Brief: Critical Vulnerabilities in PHP (Oct 21, 2026)
- CNBC: Government websites go dark as software flaw sparks security scramble (Oct 21, 2026)