In this guide (7)
On October 21, 2026, the PHP project released an emergency patch for two critical vulnerabilities, dubbed PHP2Shell, that allow code to be executed on a server without any credentials. They affect every PHP-based site, not a single CMS: WordPress, PrestaShop, Joomla, WooCommerce and custom installations. Here's what they are, who is truly at risk, why an application firewall alone is not enough, and what to do right away.
On October 21, 2026, the PHP project released an emergency patch for two critical vulnerabilities, nicknamed PHP2Shell, that allow code execution on a server without any credentials. They affect every PHP-based site, not a single CMS: WordPress, PrestaShop, Joomla, WooCommerce and custom installations are all equally affected if the underlying PHP version is not up to date. Here's what they are, who is really at risk and what to do right away.
What PHP2Shell is
PHP2Shell is the name the security community has given to two distinct vulnerabilities at the heart of PHP, the language that powers most of the world's websites and ecommerce stores: WordPress, PrestaShop, Joomla, WooCommerce, Magento, and countless custom-built applications. The two flaws, identified as CVE-2026-109618 and CVE-2026-109619, both have a CVSS severity score of 9.2 out of 10 and allow an attacker to execute code on the server without needing any credentials, any administrative access, any password.
Technical details leaked online on October 20, 2026, ahead of the planned coordinated disclosure. The PHP project reacted by releasing patches the following day, October 21 at 1:30 PM UTC. According to researchers who monitor the network with dedicated sensor networks, active exploitation of these flaws began the very same day as the patch: that means, as you read this page, there are automated attack attempts underway against sites that haven't been updated.
Who is at risk
The risk doesn't depend on the CMS you use, but on the version of PHP that CMS runs on.
| PHP Version | Status | What to do |
|---|---|---|
| 8.5, prior to 8.5.12 | Vulnerable | Update to 8.5.12 |
| 8.4, prior to 8.4.27 | Vulnerable | Update to 8.4.27 |
| 8.3, prior to 8.3.36 | Vulnerable | Update to 8.3.36 |
| 8.2, prior to 8.2.35 | Vulnerable | Update to 8.2.35 |
| 8.1 and earlier versions | Out of official support, no patch planned for this flaw | Check with your hosting provider, plan the upgrade |
| PHP 7.x and PHP 5.x | End of life for years, no patch ever released for this vulnerability | The version needs to be replaced, not just updated |
A detail that affects many small and medium-sized Italian businesses: a not-insignificant share of company websites still run on outdated PHP versions, often without the site owner even knowing it. Checking your own version today is a check that takes just a few minutes.
How the attack works, in brief
The two vulnerabilities exploit different internal PHP mechanisms.
CVE-2026-109618. PHP interrupts a request when it exceeds the configured memory limit. If the interruption occurs at a precise moment, for example during the processing of a deliberately malformed file upload, some data structures remain only partially initialized. The subsequent cleanup stage treats that incomplete data as valid, opening the way to code execution.
CVE-2026-109619. This involves a reference to data from a previous request, tied to PHP's upload progress feature, which remains active longer than it should on the same worker process. A subsequent request can access that reference before it is reinitialized, an error known as use-after-free, with consequences ranging from reading other users' memory to code execution.
In both cases, the outcome for an attacker is the same: the ability to upload and run a webshell, a script that lets them control the server remotely. We covered this in more detail in our article on what a webshell is and how to block it.
What to do right away
Check your site's PHP version. Ask your hosting provider, or check directly in the control panel if you have access.
If you're on PHP 8.2, 8.3, 8.4 or 8.5 but not on the latest patch, update right away to the correct version listed in the table above.
If you're on PHP 8.1 or earlier, there is no patch for this specific flaw. Consider a hosting provider that applies updates for you, or plan the PHP version upgrade as a priority, not as a task that can be put off.
In the meantime, if your hosting provider or your web application firewall has already rolled out a specific rule for this exploit, check that it's enabled, but treat it as a stopgap measure, not a substitute for the patch.
Check your server logs for unusual requests to upload endpoints in the days following October 20, 2026, the date the technical details leaked ahead of the official patch.
Why a web application firewall alone is not enough
A web application firewall (WAF) can reduce the risk, but it's worth being precise here: according to the official advisory from CISA, the US cybersecurity agency, a WAF "may provide some protection until systems are updated", explicitly defining it as a secondary measure. Updating the PHP version remains what CISA calls "the essential fix".
The reason is technical: several security researchers have observed that the requests used to exploit PHP2Shell are small, around 450 bytes, and look like a normal multipart upload. Generic WAF rules, those based on request size or on recognizing known attack patterns such as SQL injection or cross-site scripting, aren't designed to catch this type of request: a rule written specifically for this exploit's particular pattern is needed. The same goes for the article we dedicated to how a web application firewall works: a WAF is a layer of defense, not a substitute for the patch.
If your site is still on PHP 5 or PHP 7
For those on PHP 5 or PHP 7, PHP2Shell isn't a problem that a patch will fix: those versions haven't received security updates for years, and this is just the latest in a series of flaws that remain permanently open on those installations. It's not a question of when the update will arrive: it won't. If your site is still on one of these versions, it was probably already at risk before PHP2Shell, and it will be again afterwards, for the next vulnerability and the one after that. As has happened in other cases we've documented, such as sites that stayed on an unsupported version of an ecommerce platform, staying on unsupported software is a choice you pay for in security, not in convenience.
What this means for those using managed hosting
On a traditional PHP installation, a shared hosting setup with WordPress, PrestaShop or Joomla installed manually, the responsibility for updating the PHP version almost always falls on whoever manages the site, site by site, one at a time. On managed hosting, the PHP version of the infrastructure is updated centrally by the platform provider, not by the individual customer: this is a real operational difference between the two models.
That said, it must be stated just as clearly: no web application firewall, including KeideaCMS's native one, eliminates the need to update the underlying PHP version. A WAF reduces the risk from a set of known attack techniques; it doesn't replace the patch, for any platform. If you manage business websites and want to know for certain which PHP version they run on and whether they're exposed to this flaw, the most direct way is a technical security check of your site, don't take the answer for granted.
