Most PHP security news is about a plugin or a framework. This one is different. On October 21, 2026 the PHP project shipped emergency releases for two critical bugs in the PHP runtime itself, nicknamed php2shell. Updating WordPress, your plugins or your own code does not fix them. The PHP binary on the server has to be upgraded.

What the bugs are

The two issues are tracked as CVE-2026-109618 and CVE-2026-109619, and the PHP security team rates both Critical (CVSS v4.0 score of 9.2). Both are memory safety problems that a specially crafted HTTP request can trigger:

• CVE-2026-109618: PHP runs out of memory before some internal data is fully set up. During cleanup it can then use that half-built data as if it were valid.
• CVE-2026-109619: a fatal error interrupts a request but leaves PHP holding references to memory that gets freed when the request ends. A later request handled by the same worker can follow those stale references.

Depending on the setup, the result is anything from a crash, to leaking data from other requests, to remote code execution. According to Wiz Research, every PHP version back to 5.4 is affected by at least one of the two bugs.

A leaked disclosure

The details leaked on October 20, a day before the coordinated release, so attackers had a head start. Cloudflare had been building firewall rules since early October and switched on protection for all its customers, including the free plan, at 3:02 UTC on October 21, about nine hours before the official disclosure. It saw attack traffic right away, along with attackers mutating payloads to get around the new rules.

Cloudflare’s write-up covers the bugs, the rules it deployed and how to check that they are active on your zone: Cloudflare deploys protections against php2shell vulnerability.

What to do

1. Upgrade PHP. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are out of support and get no upstream fix, although some Linux distributions have backported patches. If your host manages PHP for you, ask them whether they have already upgraded.

2. Restart the workers. PHP-FPM keeps long-running processes, so the new binary only takes effect once they are restarted.

3. Use a WAF as an extra layer, not as the fix. Cloudflare’s rules only help if your origin accepts traffic from Cloudflare alone. If the server’s IP is reachable directly, an attacker can simply skip the firewall.

4. If you cannot upgrade today, Patchstack lists stopgaps that reduce exposure without making a server safe: a low post_max_size, turning off session.upload_progress.enabled in the server config (not in .user.ini), and fixing any fatal errors or timeouts an attacker can trigger. Treat these as a bridge to the upgrade, nothing more.

Why it matters

PHP still runs a huge share of the web, WordPress included. A bug in the runtime means every site on an unpatched server is exposed at once, whatever it runs on top. If you host PHP anywhere, check the version today.