If your website runs on WordPress, Drupal, Joomla, or almost any custom web application built in the last two decades, there’s a very good chance it runs on PHP. Today, PHP released emergency patches for two critical vulnerabilities affecting every version of the language back to PHP 5, meaning a significant portion of the internet has been exposed to a serious security problem since the details leaked yesterday.
Here’s what happened, what it means, and what to do if you’re not sure whether this affects you.
What PHP2Shell Is
The PHP security team posted an advance notice on Tuesday, October 20, alerting administrators that emergency patches were coming Wednesday at 14:00 UTC. The announcement was unusual; PHP rarely gives advance notice of a security release before the patches are ready. As it turns out, information about the two vulnerabilities leaked early, forcing the timeline forward.
Security researchers at watchTowr confirmed the leaked details were real. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 on the CVSS v4.0 scale. Both are remote code execution vulnerabilities, meaning an attacker who exploits them can run arbitrary commands on your web server without any authentication required. The research community has started calling the pair “PHP2Shell.”
watchTowr told BleepingComputer they had already reproduced CVE-2026-109618, but held back technical details until patches shipped. As of today, those patches are out.
Cloudflare moved quickly, releasing an emergency update to its managed Web Application Firewall ruleset Tuesday night to protect its customers while patches were still in transit. If you’re behind Cloudflare’s WAF, you had some mitigation in place before today. If you’re not, the patches are what matter. As of the writing of this, WordPress hasn’t provided a patch yet.
Why This Is a Bigger Deal Than Most Vulnerability Notices
Remote code execution vulnerabilities are about as serious as it gets. When a vulnerability is rated 9.2 and described as an RCE flaw, it means an attacker who finds your server and sends the right request can execute commands on it, such as installing malware, stealing data, redirecting traffic, or using your server as a launchpad for attacks on other systems. No password is required. Not even social engineering. Just a server running unpatched PHP and an attacker who knows the exploit.
The scope here is unusually wide. The flaws reportedly affect PHP versions 5, 6, 7, and 8. PHP 5 reached end of life in December 2018. PHP 6 was abandoned before it was ever released. PHP 7 reached end of life in November 2022. That means businesses running those versions won’t receive patches, which, according to one estimate, includes roughly 884,000 end-of-life hosts exposed with no official fix coming.
PHP 8 is the current supported branch and does have patches available today. If you’re running PHP 8.x, update immediately.
The fact that details leaked before the scheduled disclosure date is also significant. Normally, a vulnerability is discovered, a patch is developed, and coordinated disclosure gives administrators time to patch before attackers know what to exploit. When details leak early, that window compresses. Attackers who were watching had a head start on building exploits before patches were available. The urgency here is real.
Unpatched vulnerabilities are consistently one of the most common findings in our penetration tests. If you’re not sure what’s running on your web server or when it was last updated, a vulnerability scan can tell you before an attacker does. Talk to MainNerve about what that looks like.
Do You Even Know If You’re Running PHP?
Most small business owners can’t answer this question off the top of their heads.
PHP powers an estimated 76% of all websites with a known server-side language. If your website runs on WordPress, you’re running PHP. Drupal, Joomla, Magento, WooCommerce, Laravel, and many developer-built custom web applications are all PHP. The list is long enough that the more useful question is probably: what platform is your website built on?
If you’re not sure, ask your web developer, your hosting provider, or whoever manages your site. If your site is on a managed hosting platform like WP Engine, Kinsta, SiteGround, or most other reputable WordPress hosts, they will likely push the PHP update to your server automatically or with minimal action on your part. Check your hosting dashboard today to see whether an update is pending.
If you manage your own server or have a VPS (virtual private server), you’re responsible for the update yourself. That means logging into the server, checking your current PHP version, and updating to the latest patched version in the PHP 8 branch.
What to Do Right Now
Step one: find out what PHP version you’re running.
Most hosting control panels, like cPanel, Plesk, and DirectAdmin, show your PHP version in a section called “PHP Manager,” “MultiPHP Manager,” or similar. Alternatively, ask your hosting provider directly.
Step two: update to PHP 8.x immediately.
Today’s patches are for the PHP 8 branch. If you’re running PHP 8.x, update to the latest release now. If your hosting provider manages PHP updates, contact them to confirm the update has been applied or is scheduled.
Step three: if you’re running PHP 7.x or earlier, you have a bigger problem.
PHP 7 is end of life and will not receive patches for CVE-2026-109618 and CVE-2026-109619. Running PHP 7 has been a security liability for years, and this vulnerability makes it urgent. The fix is migrating to PHP 8, which may require testing your website or application for compatibility. Prioritize this immediately rather than treating it as a backlog item.
Step four: check whether your web application firewall has been updated.
If you use Cloudflare’s WAF or a similar service, verify that the emergency rules for PHP2Shell have been applied. This is mitigation, not remediation, as it reduces your exposure while you complete the PHP update, but it doesn’t replace the update.
Step five: if you have a developer or IT provider, confirm they’re aware.
Security updates to PHP can occasionally break compatibility with older web application code. A good developer will test before updating in production. A bad outcome is an untested update that takes your site offline. The risk of that is manageable and worth it; the risk of running unpatched PHP against a known critical RCE is considerably worse.
If you’re not sure whether your web server is exposed to PHP2Shell or other critical vulnerabilities, MainNerve can help you find out. We’ve been helping organizations identify and close these kinds of gaps for over 20 years. Reach out here. Or call us at 833-847-3280.
The Bigger Picture
This vulnerability is a good example of something we write about regularly: the window between a vulnerability being disclosed and an attacker exploiting it is shrinking. In this case, details leaked before patches were even ready, giving attackers a head start. The Microsoft Digital Defense Report we covered earlier this month found that the median time from vulnerability discovery to weaponization has dropped below 24 hours. PHP2Shell is a live demonstration of that pressure.
The organizations that came through today in reasonable shape are the ones that know what software they’re running, have a process for applying updates quickly, and have someone paying attention when emergency notices like this one go out. For a small business whose website runs on WordPress through a managed hosting provider, the update may happen automatically. For a business running a custom application on a self-managed server, today required someone to take action.
If you’re not sure what’s running on your web server, it’s time to find out. Not just for PHP2Shell, but for everything else that’s been accumulating since the last time anyone looked. We’re glad to help with that conversation. Reach us at mainnerve.com/contact-us or call 833-847-3280.
