On October 21, 2026, the PHP project released emergency patches for two critical vulnerabilities that can let an attacker run code on a server without logging in. Both are rated 9.2 out of 10. Security researchers are calling the pair PHP2Shell. If a site runs PHP, including most WordPress, Drupal, Magento, and Laravel sites, the fix is a PHP update, not a plugin update.
What happened
On October 20, the PHP team warned that two critical fixes were coming and told operators to be ready. The release was moved up a day after the CVE numbers began circulating. On October 21 the patches shipped in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
The bugs are:
- CVE-2026-109618. If PHP hits its memory limit at the wrong moment, cleanup can treat half-built request data as valid. That memory corruption can lead to remote code execution.
- CVE-2026-109619. Internal state from one request can survive after its memory is freed. A later request on the same worker can use that stale state.
Both affect PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Apache mod_php is the highest-risk setup. PHP says a demonstrated exploit can trigger on mod_php with one unauthenticated request, before application code runs. Remote code execution was also confirmed on PHP-FPM.
The flaws go back to PHP 5. Only the still-supported branches get an official patch. PHP 8.1 and older are end of life and will not receive a fix from the PHP project.
What to install
| Branch | Fixed version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Updating to one of those releases is the only complete fix. A WordPress or Drupal update does not replace it. If you manage PHP yourself, apply the patched version and confirm the site still loads, forms still submit, and checkout still completes. If a host manages it, ask whether the October 21, 2026 PHP security release is installed.
Sites still on PHP 8.1 or older should move to a supported branch. There is no official patch for those versions.
Who this affects
Any site that runs PHP. That includes WordPress, Drupal, Magento, and custom applications. The Drupal Security Team issued PSA-2026-10-20 on the same day, telling site owners the update is their responsibility and that a patched PHP release is the only complete mitigation.
A plugin, a password change, or a firewall rule is not a substitute. Internet-facing servers should be patched first.
What Zinc Online Solutions is doing
Zinc Online Solutions hosts and maintains client sites from South Florida. We emailed clients the same day. There is no sign that those sites were affected. We are installing the update on our servers tonight, Wednesday, October 21, starting at 11:00 PM Eastern, and checking each site afterward. Clients on our hosting do not need to do anything. A site may be offline for a few minutes.
Why the platform matters
A fast site that ranks and converts still needs the software underneath it patched. That is part of web development and of keeping an ecommerce store online. SEO does not help a site that is down or compromised. If you are not sure who is responsible for PHP on your site, contact Zinc Online Solutions.
Frequently asked questions
What is PHP2Shell? PHP2Shell is the name researchers gave to two critical PHP bugs fixed on October 21, 2026: CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution.
Does this affect WordPress? Yes. WordPress runs on PHP. A WordPress site on an unpatched PHP version is exposed even if WordPress itself is up to date.
Which PHP version do I need? 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on your branch. PHP 8.1 and older do not get an official fix.
Do I need to do anything if Zinc hosts my site? No. We emailed clients and are applying the update tonight. Reply to that email if something looks off tomorrow.