PHP2Shell: Updating WordPress Doesn't Update PHP

Two vulnerabilities, disclosed together and nicknamed php2shell:

• CVE-2026-109618 - out-of-memory handling via longjmp() leaves request memory uninitialized, which an attacker can drive to reliable code execution.
• CVE-2026-109619 - fatal-error handling leaves global memory pointing at freed regions, which later requests can read or branch on.

Both are rated CVSSv4.0 9.2. Both are unauthenticated - no login, no account, no plugin required. Every PHP release from 5.4 through 8.5.11 is affected, and the PHP project says every installation that serves web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed alike.

Wordfence, which protects over 5 million WordPress sites, reported blocking more than 74,000 exploit and probing attempts and no confirmed compromises among those sites as of October 21. watchTowr reported exploitation in the wild. Both can be true at once, and neither is a reason to wait.

Let's be straight: this is not a flaw in WordPress, and anyone telling you WordPress caused it is selling something. Laravel, Drupal, Magento and a hand-rolled contact.php are all equally exposed.

The reason it lands hardest on WordPress is structural. WordPress is a PHP application. There is no configuration, no hardening plugin and no premium tier that makes a WordPress site stop executing PHP on every single request. Wordfence put it in one line that's worth repeating: updating WordPress itself does not update PHP.

So the patch you need isn't in your wp-admin dashboard. It's in a layer most site owners have never logged into, don't control, and in many cases don't know the version of.

Upstream fixes exist for PHP 8.5, 8.4, 8.3 and 8.2. The PHP project is not shipping a new 8.1, 8.0 or 7.4 release - those branches are end-of-life. They did publish source backports for people who build PHP themselves. Whether your site gets a fix depends entirely on your host.

cPanel, CloudLinux and Plesk shipped backports within a day, often without changing the version string php -v prints. Cheap shared WordPress hosts frequently will not. We audited one ordinary cPanel box the day after disclosure: 27 vhosts, four PHP branches, 21 of them on PHP.org-EOL versions, zero patched packages installed. Two were still on PHP 7.4 (EOL November 2022). The host did have a backport in a disabled Imunify repo - most site owners never see that layer, and WordPress cannot apply it from wp-admin.

The honest version of 'just update PHP' on a typical WordPress site is: open a ticket, wait, then find out which plugins break on a live site. Or stop running PHP.

1. Find your PHP version. cPanel: MultiPHP Manager. Elsewhere: ask your host, or run our free scan.
2. Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor build confirmed to carry both fixes. A distro version number alone doesn't tell you.
3. Restart every PHP worker. Installing the package is not enough - running workers keep the old code in memory until they're recycled.
4. If you're on 8.1 or older, plan the version move now. A WAF (Imunify360, Wordfence, Cloudflare) blocks some known paths and buys you time; every advisory still says the PHP update is required.
5. Check what else runs PHP on the same account - a forgotten staging copy or an old /betacrm/ folder shares the same interpreter.

Here is the uncomfortable arithmetic. Hardening is a bet that you will win every future race between disclosure and patch, forever, on a site that pays you nothing while you do it. php2shell is the fourth or fifth time this decade that bet has been called.

A static site has no PHP process. There is no interpreter to confuse, no request memory to corrupt, no worker to restart. The HTML files don't execute. That doesn't make you invincible - your DNS, your host account and your build pipeline are all still real targets, and anyone who tells you static means unhackable is lying to you. But this entire class of vulnerability stops applying, and it stops applying permanently rather than until the next CVE.

Get rid of WordPress · The recurring security problems · Already compromised?