The PHP development team has released emergency security updates for two critical remote code execution vulnerabilities that affect the underlying runtime used by WordPress and numerous other web platforms.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are collectively being called PHP2Shell. Both received CVSS 4.0 scores of 9.2.
Administrators should upgrade immediately to one of the following corrected versions:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
This is a material update to the pre-release warning issued earlier on October 21. Defenders now have confirmed fixed versions and enough public technical information to expect rapid exploit development and automated scanning.
TWO FLAWS CAN BE CHAINED FOR UNAUTHENTICATED CODE EXECUTION
The PHP security advisories describe the vulnerabilities as remote code execution issues involving out-of-memory corruption and stale global state.
Public research indicates that the two weaknesses can be chained to execute attacker-controlled code without authentication. Because the flaws exist in the PHP engine, applications may remain exposed even when their own code, themes and plugins are fully updated.
Researchers reported successfully reproducing the attack against current versions of several widely deployed platforms, including:
- WordPress
- Drupal
- Joomla
- Magento
- WooCommerce
- MediaWiki
- Roundcube
- phpMyAdmin
- Nextcloud
- Laravel
- Symfony
- WHMCS
This does not establish that every installation of these products has been compromised. It demonstrates that updating an affected web application without updating its PHP runtime may leave the underlying vulnerability intact.
UNSUPPORTED PHP VERSIONS CREATE A SERIOUS REMEDIATION PROBLEM
PHP’s normal releases correct the flaws only in its supported 8.2, 8.3, 8.4 and 8.5 branches.
Researchers say the vulnerable code dates back to PHP 5.4, placing a large population of unsupported PHP 5, PHP 7 and PHP 8.0 or 8.1 systems at risk.
The PHP team has reportedly made source-level backports available for PHP 7.4, 8.0 and 8.1, but it is not providing normal official binary releases for those retired branches. Linux distributions and commercial long-term-support providers may publish their own backported packages.
Organizations should not assume an older installation is protected because its package manager reports no available update. Administrators must verify whether their operating-system vendor or PHP package provider has explicitly corrected both CVEs.
Migration to a supported PHP branch remains the safest long-term response.