PHP’s developers released urgent security updates Wednesday for two critical flaws that can let an attacker run code on a vulnerable web server without logging in.

The October 21 advisory identifies the problems as CVE-2026-109618 and CVE-2026-109619. The project says installations handling web requests need attention, with the greatest risk assessed for Apache’s mod_php configuration.

The fix belongs in the server’s PHP software

The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Linux distributors and long-term-support suppliers may deliver fixes through their own packages, so the PHP team directs operators to check their vendor’s updates.

PHP 8.1 and older no longer receive regular fixes from the project. Some vendors provide backported patches, but operators need to verify that protection rather than assume an old installation is covered.

The team says configuration changes can reduce particular attack paths, but they do not make an affected installation safe. Updating remains the complete solution.

A weakness below the website’s own code

Researcher Wiz calls the issue PHP2Shell. Its team says the flaws involve memory handling when PHP encounters fatal errors while processing requests. The problem sits in PHP itself, beneath the application running on it.

Wiz reports demonstrating attacks against WordPress, Drupal and Joomla installations, as well as a way to read sensitive information from PHP process memory. Those demonstrations establish what the researchers achieved in testing; they are not a count of websites that have been breached.

The company says AI tools helped its researchers find, test and adapt the attacks, and that it coordinated disclosure and patch verification with PHP’s team, Calif and OpenAI. That account is the research team’s description of its work.

Hosted protection depends on the provider

Automattic says customers of WordPress.com, WordPress VIP, WP Cloud, Pressable and Tumblr are already protected. Its assurance applies to those hosted services; it does not establish protection for every independently hosted WordPress website.

The company says updating a theme, plugin or WordPress itself is insufficient on its own because the repair is in the underlying PHP runtime. For a site whose hosting company manages that software, Automattic advises asking the host to confirm the security update has been applied.

For Canadian businesses and community organizations that run PHP-based sites, that distinction matters: the relevant question is whether their server’s PHP has received the fix. The public advisories reviewed for this report do not identify a Canadian victim.

Sources