PHP has released emergency updates for two security flaws that could allow server attacks. WordPress sites, e-commerce sites, and enterprise applications are also affected.
The October 21, 2026 Two critical vulnerabilities in PHP, the language used by numerous websites and online applications, have been fixed. The flaws, known as PHP2Shell, can allow an attacker to execute code on the server without having login credentials.
The issue isn't related to a single CMS or vulnerable plugin. The vulnerabilities are directly in the PHP engine and can therefore affect even updated and properly configured sites. The security team released the fixes ahead of schedule, after technical information about the vulnerabilities was released.
PHP2Shell: What are the two vulnerabilities and why are they dangerous?
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, both received a severity score of 9.2 out of 10 on the CVSS 4.0 scale, the system used to evaluate the criticality of computer vulnerabilities.
Both involve issues with PHP's memory management. Under certain conditions, an attacker can exploit these errors to achieve remote code execution, a technique known as Remote Code Execution (RCE).
The first vulnerability occurs when handling errors related to out-of-memory. The second affects internal information that can remain accessible even after a request has been completed.
The potential outcome is particularly serious: an attacker could execute instructions with the privileges of the PHP process, access confidential information, or compromise the operation of the site.
The severity was confirmed by the official PHP team, who urged administrators to apply the updates immediately.
WordPress, Joomla, and e-commerce: which sites are affected?
The unique thing about PHP2Shell is that vulnerabilities don't necessarily depend on the software used to build the site.
WordPress, Joomla, Drupal, Magento, and custom PHP applications can be exposed when using vulnerable versions of the language.
This means that a site with updated themes, plugins, and CMS isn't automatically protected. If the server continues to use an incorrect version of PHP, the risk may persist.
According to the official advisories, several execution environments are potentially affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The highest risk has been identified in Apache configurations with mod_php, where exploitation has been demonstrated before the site's code has even been executed.
For businesses, the consequences can affect not only the availability of pages, but also customer data, connected systems, and the continuity of online services.
Which PHP versions have been updated?
Official fixes are available in the following releases:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Installations older than the correct versions of the respective branch should be verified and updated.
Of particular concern is PHP 8.1 and earlier versions, which no longer receive regular updates from the PHP project. Some vendors distribute fixes specifically for these environments, but you should check their availability and plan to migrate to supported versions.
The intervention must concern the environment in which the site is located: Updating WordPress or its plugins alone does not fix PHP2Shell.
Have there been any attacks yet?
The first information about the vulnerabilities circulated publicly on October 20, ahead of the release of security patches.
Several specialized companies, including watchTowr, Cloudflare and Patchstack, have reported exploitation attempts observed on their infrastructure.
It's important to distinguish these attempts from successful compromises: public reports alone don't allow us to quantify how many sites have actually been compromised.
The National Cybersecurity Agency, through CSIRT Italy, also highlighted the criticality of the vulnerabilities and the need for rapid intervention.
Temporary protection measures can reduce some attack possibilities, but they do not completely eliminate the problem. The solution indicated by the developers remains the’Applying security fixes to PHP.
What this means for your business
The discovery of PHP2Shell highlights how much a site's security depends on the infrastructure hosting it, not just on the updates visible in the administration panel.
To reduce exposure, companies should address three areas:
- Check your PHP version and hosting environment, asking your supplier if the corrections have already been applied.
- Schedule the update and check its compatibility, especially in the presence of e-commerce, customized plugins and integrations with management software.
- Check systems after surgery, verifying the correct functioning of the site and analyzing any anomalies in the logs and files.
For a company, keeping its website secure means protecting data, operations, and the reliability of the services offered to customers.
DigiFe supports companies in verifying and managing website security., identifying vulnerabilities, outdated configurations, and actions needed to keep the infrastructure up to date.
Discover the service of DigiFe cyber security to assess the security status of your company website.
