PHP2Shell: What WordPress Website Owners Need to Know About the Critical PHP Security Vulnerabilities

October 22, 2026

October 22, 2026 | Pixelcarve Security Update

On October 21, 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities affecting websites worldwide, including those built on WordPress, Drupal, Joomla and other PHP-based platforms.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have both been assigned critical severity ratings of 9.2 out of 10.

The announcement has prompted widespread security warnings from hosting providers, IT departments, cybersecurity firms and government agencies. Some organizations have even taken websites offline as a precaution.

We’ve already received several inquiries from clients concerned about whether their websites are affected, so we wanted to provide a more detailed explanation of what’s happening, how we’ve responded, and what website owners should know.

What Is PHP2Shell, and Why Is It Serious?

Collectively referred to as PHP2Shell, the two vulnerabilities involve flaws in how PHP handles memory and certain web requests.

In some circumstances, attackers can exploit these flaws to execute malicious code on vulnerable servers without needing a username or password.

Successful exploitation could potentially expose sensitive information, compromise websites, or provide attackers with access to the underlying server environment.

Importantly, this isn’t a WordPress vulnerability specifically.

PHP is the underlying programming language powering WordPress and many other web applications. Even a website running the latest version of WordPress, with all plugins and themes updated, could still be exposed if its PHP installation hasn’t received the appropriate security patches.

And the threat isn’t entirely theoretical.

Amazon has since reported that its threat intelligence systems detected attempts to exploit PHP2Shell as early as October 17, four days before the vulnerabilities were publicly disclosed.

Following the October 21 release of security patches, researchers also observed additional exploitation attempts.

It’s a good reminder of how quickly newly discovered security vulnerabilities can become active threats.

Which PHP Versions Are Affected?

The PHP development team released fixes on October 21 for the following versions:

PHP Branch	Patched Version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

PHP 8.1 and earlier versions are no longer officially supported by the PHP project. However, some commercial hosting environments and long-term support providers maintain their own security patches for older PHP versions.

This is an important distinction. An older PHP version number doesn’t automatically mean a website remains vulnerable, provided its hosting environment has received verified vendor-maintained security fixes.

That said, older PHP installations should still be migrated to supported versions wherever possible. Extended security maintenance is useful, but it isn’t a permanent alternative to keeping software current.

For businesses using managed hosting, confirming the appropriate PHP updates have been applied is generally the responsibility of the hosting provider or server administrator.

Simply updating WordPress through its administration dashboard won’t resolve these vulnerabilities.

How Pixelcarve Responded

Our technical team was actively monitoring the security announcements and coordinating the necessary updates with our hosting security providers.

On October 21, the same day the official fixes became available, we successfully applied the required security patches to our managed hosting environment, including vendor-maintained patches for older PHP installations.

We also took the additional step of reviewing security activity around the disclosure period.

During a retrospective review of one of our managed servers, covering October 17 through October 22, our team identified three suspicious requests consistent with attempts to probe one of the disclosed vulnerabilities.

All three requests were blocked by our existing server-level security protections, returning HTTP 403 responses.

Our review of the available access logs, security logs and related system activity found no evidence of successful exploitation or compromise on that server.

While a retrospective log review can never establish with absolute certainty that an attack didn’t occur, these findings were reassuring and demonstrated that our existing security protections were responding to suspicious activity even before the underlying PHP patches were applied.

Our managed hosting environment uses multiple layers of protection, including server-level security monitoring, web application firewall rules, ongoing software maintenance and vendor-supported security updates.

No single security measure is foolproof, which is why we believe in maintaining several layers of protection rather than relying on any one product or service.

Why We’re Sharing This Update

Security updates aren’t unusual. In fact, they’re a routine part of managing websites and hosting infrastructure.

At Pixelcarve, we’re regularly applying updates and patches across our managed websites, WordPress installations, PHP environments and supporting infrastructure.

Most of these updates happen behind the scenes without individual client notifications. They’re frequent, generally routine, and don’t require any action from our clients.

This particular incident is different because of its severity, the number of potentially affected websites, and the considerable attention it’s received from cybersecurity organizations and mainstream media.

Given the understandable concern, we felt it was appropriate to share more detail about our response and the protections already in place.

What Should WordPress Website Owners Do?

If your website is hosted with Pixelcarve under our managed hosting services, the necessary patches addressing these two vulnerabilities have already been applied, and no further action is required on your part to install them.

We’ll continue monitoring the situation and addressing any additional security developments as necessary.

If your website is hosted elsewhere, we recommend confirming the following with your hosting provider:

PHP security patches: Have the fixes for CVE-2026-109618 and CVE-2026-109619 been applied and verified? If the server uses vendor-maintained PHP packages, confirm the patches are included in those packages.
Server security: Are appropriate web application firewall protections and other server-level security controls in place?
Security investigation: Have relevant server logs been reviewed for suspicious activity, including potential exploitation attempts before the public disclosure on October 21?
Ongoing maintenance: Is someone actively responsible for monitoring security advisories, deploying patches, maintaining backups and managing the hosting environment?

These are reasonable questions to ask any hosting provider, particularly when your website supports important business operations or handles sensitive information.

A Final Word on Website Security

No hosting provider can guarantee that a website will never encounter a security vulnerability. New flaws are discovered regularly, sometimes in software that’s been widely used and trusted for years.

The important distinction is how those vulnerabilities are managed.

Keeping a website secure involves considerably more than updating WordPress or installing a security plugin. It requires ongoing attention to the underlying software, hosting infrastructure, access controls and emerging threats.

For businesses, the goal should be straightforward: know who’s responsible for your website’s security, understand what’s included in your hosting and maintenance arrangements, and make sure there’s a reliable process for addressing vulnerabilities as they emerge.

For our managed hosting clients, that’s work we handle every day, whether it makes the headlines or not.

If you have questions about your website’s security or hosting environment, please contact Pixelcarve.

Additional Resources