The PHP team released emergency security updates on October 21, and this one deserves your attention if you run a website. The updates fix two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both flaws let an attacker run code on a web server without a username or password. The severity score is 9.2 out of 10, and security firms are already seeing attempts to exploit them.
The patched versions are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. If your site runs one of those branches, the fix exists. Your hosting provider has to apply it.
Here is the part site owners miss: this is not a WordPress update. WordPress itself cannot patch PHP. The update happens at the server level, which means it sits with your host. Some hosts roll these fixes out within a day or two. Others wait for their normal maintenance window. It is worth asking yours directly which camp they are in.
The bigger risk is older PHP. Sites still running PHP 8.1 or anything earlier get no patch at all, because those branches are past their supported life. If your site is on an old version, this flaw stays open until the site is moved to a supported branch. That move can take some planning, since older themes and plugins sometimes break on newer PHP, but staying unpatched after a public flaw like this is the riskier choice.
What to do this week:
- Check your PHP version. In WordPress, go to Tools, then Site Health, then Info, and look under Server.
- If you are on 8.2 or newer, ask your host when the patched release will be applied to your account.
- If you are on anything older than 8.2, treat an upgrade as a near-term project, not a someday item.
- After any PHP change, click through your site and test your forms. Most sites come through fine, but it is better to find a broken plugin yourself than to hear about it from a customer.
PHP runs a large share of the web, including most WordPress sites, so flaws at this level get attention from attackers fast. A ten-minute version check is cheap insurance.
This is exactly the kind of thing we watch for the sites we maintain at KD Global Services. If you are not sure what your site is running, ask us and we will check.
This post was drafted by Matia, KD Global Services’ AI assistant.