This week, a pair of serious security flaws in PHP triggered a global scramble. Governments took websites offline, Cloudflare reported millions of exploit attempts, and Amazon confirmed attackers were probing systems days before the public patches arrived.
If your business runs a WordPress site, WooCommerce store, or any custom PHP application, this is worth paying attention to—even if your plugins and themes are up to date. The problem sits in PHP itself.
What Happened
On October 21, 2026, the PHP project released emergency security updates for two critical vulnerabilities that had been tracked as CVE-2026-109618 and CVE-2026-109619 (sometimes called PHP2Shell). Both carry a CVSS score of 9.2 and can allow an unauthenticated attacker to execute code on a vulnerable server.
The issues were discovered with help from AI models and reported by security researchers (including Calif and Wiz). Details leaked ahead of the planned disclosure, which forced PHP to move the release up by a day. The PHP Foundation later acknowledged that signs of one of the problems had been known since a 2024 audit, but fixing it was delayed by resource constraints and decision-making challenges.
Amazon’s threat intelligence team reported seeing exploitation attempts as early as October 17—four days before the patches were public. Cloudflare observed attack traffic jump into the millions once the issues became widely known. Some researchers have since noted that reliable mass exploitation appears harder than initially feared (attacks often need specific server conditions), but that does not change the advice: update as soon as possible.
What the Vulnerabilities Actually Do
Both flaws live in PHP’s core memory management and error handling—the parts of the language that process nearly every web request.
- CVE-2026-109618 involves out-of-memory handling. Under certain conditions, PHP can leave partially initialized data behind that later gets treated as valid, leading to memory corruption and potential remote code execution.
- CVE-2026-109619 involves stale global state (a use-after-free condition). A fatal error can leave internal pointers pointing at freed memory from a previous request, which a later request on the same worker can abuse.
The highest risk is on Apache with mod_php, where an unauthenticated request can trigger the issue before any application code runs. PHP-FPM, cgi, FrankenPHP, and LiteSpeed are also affected. Because the bugs are in PHP core, a fully updated WordPress installation can still be vulnerable if the underlying PHP version is not patched.
Who Is Affected
Supported PHP versions received official patches:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Anything older than these on the 8.2–8.5 branches is vulnerable. PHP 8.1 and earlier are end-of-life and do not receive official releases (though some source backports and distribution patches exist). Sites running outdated PHP—common with neglected shared hosting—are at elevated risk.
WordPress, WooCommerce, Magento, Drupal, Joomla, and many other platforms that run on PHP are in scope. Even a simple site can be affected if it is serving web requests on an unpatched PHP version.
What You Should Do Right Now
- Check your PHP version. In WordPress this is often visible under Tools → Site Health or through your hosting control panel. If you are on anything below the fixed versions listed above, you need an update.
- Update PHP (or ask your host to). This is the only complete fix. There are no reliable configuration-only workarounds.
- Verify after the update. Confirm the new version is active and that the site still functions correctly (some older plugins or themes can have compatibility issues with newer PHP).
- Review your overall security posture. While you are in the control panel, check that WordPress core, plugins, and themes are current, and that unused ones are removed.
- Plan for the future. Sites left on end-of-life PHP versions will keep facing this kind of risk. Moving to a currently supported version (or a managed environment that handles updates) is the longer-term fix.
If you are not comfortable doing this yourself, or if your host is slow to respond, it is reasonable to get help. Downtime or a compromise is usually more expensive than a quick, careful update.
How Zinc Online Solutions Can Help
We build and maintain WordPress and WooCommerce sites for South Florida businesses, and security and updates are part of the work we already do.
- Need a clean, fast WordPress site that is easier to keep secure? See our web development services.
- Running an online store? We build and optimize Shopify and WooCommerce ecommerce solutions.
- Looking for ongoing maintenance, security checks, and hosting support so you are not reacting to the next emergency? Reach out through our main site—we handle priority checks and updates for local clients.
We are based in Fort Lauderdale and work with businesses across South Florida (and remotely). If you want us to take a look at your PHP version and site setup this week, contact us and include your site URL.
Bottom Line
The PHP2Shell vulnerabilities are real, patches are available, and exploit attempts have been observed. For most small and mid-sized businesses the practical step is straightforward: confirm your PHP version and update it. Doing so now reduces risk and avoids the scramble that many organizations went through this week.
If you are unsure where to start or want a second set of eyes on your WordPress or ecommerce site, we are happy to help.
