A plain-language review of the PHP security issues disclosed this month, showing which sites are affected, who should act, and what to do first.
What was disclosed in October 2026
On October 21, 2026, the PHP project released emergency security updates for two critical flaws in the PHP core interpreter: CVE-2026-109618 and CVE-2026-109619, together called php2shell. Both are rated 9.2 (CVSS v4.0).
Both allow unauthenticated remote code execution, meaning an attacker can run commands on your server without logging in.
Details became public before the fixes shipped. CISA added both flaws to its Known Exploited Vulnerabilities (KEV) Catalog on October 26, 2026.
Who should act and how urgently
Any unpatched PHP installation serving web requests is at risk. That includes Apache with mod_php (which PHP considers the highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
CISA urges immediate patching. Update to one of these fixed releases:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
At INTELLIPLANS, we treat this as a same-day task for any site running WordPress, WooCommerce, Laravel or a custom PHP build. The next step is to confirm which PHP version your site runs today.
A separate issue, CVE-2026-115560, was disclosed on October 23, 2026. It requires an unusual PHP configuration and application behavior, and the October 21 releases do not fix it. For affected setups, PHP recommends disabling session.upload_progress.enabled until a security update is available.
How Each Vulnerability Was Scored
Severity, exploitability and patch availability
Each flaw was rated on four criteria, using only details from the CISA alert, the PHP security advisory and vendor threat briefs. Anything not confirmed in those sources is marked unconfirmed.
- Severity: the official CVSS base score, where both flaws rate Critical.
- Exploitability: whether the flaw needs a login, and whether it appears in the KEV Catalog.
- Affected PHP versions: which branches are exposed. PHP 8.1 and earlier are treated as unsupported.
- Patch availability: whether a fixed release exists.
A flaw that is unauthenticated, listed in KEV and patchable ranks highest.
Impact on SEO and site uptime
Each scorecard adds a plain-language line on what the flaw means for your business. A server takeover can mean injected spam pages, redirects or a crashed site, all of which hurt crawling and organic visits.
After patching, check Google Search Console for unexpected pages, manual actions or security warnings.
Some hosts backport fixes, so the PHP version number may not change after patching. Confirm with your provider rather than relying on the number alone.
Vulnerability Scorecards
The two PHP2Shell flaws covered in this review both score at the top of the rubric. Each card lists category, affected versions, severity, exploit status and fix version.
CVE-2026-109618
- Category: remote code execution (memory corruption)
- Cause: out-of-memory handling can interrupt PHP while internal request data is only partially initialized
- Affected versions: PHP 8.5, 8.4, 8.3 and 8.2 branches before the fixed releases. PHP 8.1 and earlier are unsupported
- Severity: Critical, 9.2 (CVSS v4.0)
- Exploit status: listed in CISA’s KEV Catalog since October 26, 2026
- Fix version: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35
What this means for your business: a stranger can run commands on your web server without a password, so sites using that unpatched PHP runtime may be exposed.
CVE-2026-109619
- Category: remote code execution (unauthenticated, no login needed)
- Cause: request-owned internal state can remain after its backing memory is freed; a later request can use that stale state
- Affected versions: the same supported branches, across Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed
- Severity: Critical, 9.2 (CVSS v4.0)
- Exploit status: listed in CISA’s KEV Catalog since October 26, 2026
- Fix version: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35
What this means for your business: the risk matches the first flaw. The same releases close both, so one update covers them.
Check which PHP branch your server runs. On PHP 8.1 or earlier, these releases do not apply; upgrade to a supported branch or confirm a vendor-provided backport.
Side-by-Side Comparison and Priority Ranking
The two flaws share a score, a fix and an exploit status, so the table below separates them only where the sources allow. Anything unconfirmed is marked as such.
| Factor | CVE-2026-109618 | CVE-2026-109619 |
|---|---|---|
| Category | Remote code execution (memory corruption) | Remote code execution (unauthenticated) |
| Severity | Critical, 9.2 | Critical, 9.2 |
| Login required | No | No |
| Ease of exploitation | Listed in KEV; detailed difficulty unconfirmed | Listed in KEV; detailed difficulty unconfirmed |
| Patch status | Available | Available |
| Urgency rank | 1 (tied) | 1 (tied) |
How to read the ranking
Both issues share the top rank because one update closes them together. There is no sensible order in which to patch them separately.
Prioritize by exposure instead. Servers running Apache with mod_php come first, since PHP considers that setup the highest risk. Then move to PHP-FPM, php-cgi, FrankenPHP and LiteSpeed hosts.
Example: an agency managing ten client sites on one shared server should patch that server before touching any single site’s plugins. One unpatched PHP runtime exposes every site on it.
Once you know which servers come first, the next step is turning that order into a dated action plan, which the checklist below sets out.
Business Impact of the PHP Flaws
Both flaws allow remote code execution, so the business cost starts with whoever controls the server. None of the outcomes below is certain. They describe what a successful attack can make possible.
Data exposure and downtime
Code running on your web server can read what the server can read. That includes configuration files, database credentials and customer records handled by a WooCommerce or Laravel application.
Downtime is the second risk. CVE-2026-109618 involves memory handling, so a failed attack may crash the PHP process instead of taking control, and the site goes offline either way.
- Web Design: rebuild or restore from a clean backup if files were altered.
- Hosting review: confirm which sites share the affected runtime.
There are two types of companies: those that know they’ve been hacked, and those that don’t.
Search rankings, ad accounts and customer trust
A compromised server can serve spam pages or redirects. Search engines may flag the domain, which affects SEO through lost crawl trust and warnings shown to visitors.
For PPC, ad platforms can suspend ads that point to a domain flagged for malware. Campaign spend then stops or lands on a broken page.
A browser warning or a spam email sent from your domain tells buyers the site was not protected, and rebuilding that trust takes longer than the patch.
Pair the PHP update with a Google Search Console check for security issues and unfamiliar URLs.
Action Checklist: Patching and Hardening
The single most important action is to move every PHP runtime to a fixed release. Everything else here supports that step or confirms it worked.
Within 24 hours
- Inventory: list every server and site running PHP, including staging and forgotten test environments.
- Back up: take a full backup of files and databases first.
- Update PHP: move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, matching your current branch.
- Reload: restart the web server or PHP process, whatever your setup.
- Verify: confirm the running version from the server, not from a control panel label.
Start with Apache and mod_php hosts.
Within 7 days
Both flaws are in CISA’s KEV Catalog, so assume scanning activity happened before you patched.
- Review logs for unfamiliar PHP files, odd POST requests and web server processes launching shell commands. The published hunting query can return false positives, so validate each result.
- Remove unused admin accounts and rotate database and API credentials if compromise is suspected.
- Update WordPress, WooCommerce and Laravel dependencies.
- Check WAF rules: a firewall may reduce exposure, but it does not replace the PHP update.
Ongoing
Watch Google Search Console security reports and uptime alerts, since a missed compromise often shows up there first. Recheck CISA’s alert page for revisions.
Next step: assign one named owner to each server.
FAQ
Is my WordPress site affected?
Likely yes, if it runs on an unpatched PHP runtime. The flaws sit in PHP itself, not in WordPress or any plugin, so every site on that server is exposed until PHP is updated.
PHP 8.1 and older no longer receive official PHP project security releases. Some distributions and long-term-support vendors provide backported fixes; otherwise, move to a supported release.
Does a firewall or security plugin solve this?
Not by itself. A web application firewall may reduce exposure temporarily, but the fix is the PHP update. Plugins run inside PHP, so they cannot repair a flaw in the interpreter.
Why is this treated as urgent?
Both flaws are in CISA’s Known Exploited Vulnerabilities Catalog, which means exploitation has been observed and the issue is not only theoretical.
How do I know if I was compromised?
Look for signs rather than waiting for a confirmed alert:
- PHP files you did not upload, especially in upload or cache folders.
- Web server processes launching shell commands.
- Unfamiliar URLs or security warnings in Google Search Console.
- Unexpected outbound email or sudden server load.
If any of these appear, restore from a clean backup and rotate credentials after patching.
Who can confirm my PHP version?
Your hosting provider or developer can check it from the server. Ask for the exact running version and whether the web server was restarted after the update, since a control panel label may not reflect what is actually loaded.
Conclusion
Overall threat rating and recommendations by audience
We rate this month as High for any business running PHP. Both flaws are critical and both are in CISA’s KEV Catalog, yet fixed releases exist. That makes patching a clear, achievable task rather than a waiting game.
Your first move depends on how you run your site:
- Small site owner: ask your host to confirm the running PHP version today, then check Google Search Console.
- E-commerce store: patch first, then review logs and rotate credentials, since customer and payment data sit behind PHP.
- Agency or in-house team: inventory every environment, patch by branch, and record who verified each server.
At INTELLIPLANS, we treat a PHP security patch as a business continuity task, because uptime, rankings and ad delivery all depend on it. Next step: recheck CISA’s alert page for revisions before you close the work.
References
- Critical Vulnerabilities in PHP Require Immediate Patching
- Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618 …
- Responding to core PHP vulnerabilities CVE-2026-109618 …
- Critical PHP vulnerabilities (Oct 2026) , Information Technology
- php2shell, Leaked Critical PHP Vulnerabilities (CVE-2026- …
