Critical PHP Security Update (CVE-2026-109618 & CVE-2026-109619):
What Website Owners Must Do Now

Because PHP powers over 75% of all server-side web applications—including WordPress, WooCommerce, Laravel, Drupal, Joomla, and thousands of custom enterprise platforms—this advisory impacts nearly every business operating a PHP-backed website.

In this emergency handbook, our enterprise systems team breaks down what occurred, who is exposed, and the step-by-step actions required right now to secure your infrastructure.

What Happened & Timeline

• 21 October 2026: The PHP development group released emergency patch versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
• The vulnerabilities were originally uncovered in August 2026 by Wiz Research, collaborating with Calif and OpenAI, and coordinated with the PHP Core Security Team.
• The coordinated public disclosure was slated for 22 October 2026, but technical indicators leaked early, forcing the emergency release forward by 24 hours.
• The two vulnerabilities are officially cataloged as CVE-2026-109618 and CVE-2026-109619.

Why This One Is Extremely Serious

1. The Bug Is in the PHP Engine, Not in Your Website Code

The vast majority of web security vulnerabilities originate in third-party plugins, custom scripts, or outdated themes. In sharp contrast, PHP2Shell is an engine-level flaw located in the compiled C binary of the PHP runtime itself. Even if your web application code is flawless, sanitized, and thoroughly audited, your entire server remains vulnerable if the underlying PHP runtime is unpatched.

2. Zero Authentication Required

Threat actors do not require an administrative account, credentials, or customer login. Transmitting a crafted HTTP POST request with multipart form-data to any public page (such as your homepage, a contact form, or an API route) is sufficient to trigger the memory corruption condition.

3. It Reaches Back to PHP 5.4

Security research reveals that the vulnerable underlying logic has persisted in PHP code since PHP 5.4 (released in 2012). The PHP project only provides official security fixes for actively maintained branches (PHP 8.2 and newer). Legacy installations running PHP 8.1, 8.0, 7.x, or 5.x receive zero upstream patches.

4. Active Exploitation Attempts Have Started

Both Cloudflare and threat intelligence firm watchTowr documented live exploitation attempts in the wild targeting the unpatched flaw prior to public announcement. Cloudflare rapidly deployed emergency edge firewall rules on 21 October. While mass successful compromises had not been broadly publicized at release time, active automated scanning means unpatched hosts must be treated as actively targeted.

5. Critical Memory Leakage Even Without Code Execution

Researchers demonstrated that even if an attacker fails to achieve full shell execution, the exploit primitive can read raw memory segments from the PHP worker process. This memory disclosure can leak high-entropy secrets, including database connection strings, API tokens, encryption keys, and active user session data.

Who Is Affected: Runtime Matrix

What about WordPress? WordPress.org confirmed that no WordPress core update is required or planned. The fix exists purely at the PHP runtime layer.

What about Laravel, Symfony & Custom Apps? Updating your framework version or running composer update will not fix this issue. The server-level PHP binary must be patched.

What to Do Right Now: Step-by-Step Checklist

Step 1: Check Your Live PHP Version

• In WordPress: Navigate to Tools → Site Health → Info → Server and check PHP version.
• In cPanel or Plesk: Click Select PHP Version or PHP Manager.
• On Cloud Servers (SSH): Run php -v from the terminal. (Note: Verify both CLI PHP and your web server SAPI version using a temporary phpinfo() check).

Step 2: Update PHP According to Your Hosting Architecture

Step 3: Restart PHP-FPM and Web Server Daemons

Updating the system binary package is only half the battle. Persistent worker processes keep the old, vulnerable binaries resident in server memory until restarted.

Step 4: Verify the Patch & Test Functionality

• Confirm your PHP version outputs the patched minor release (e.g. 8.3.36, 8.4.27, or 8.5.12).
• On Debian/Ubuntu enterprise distributions that backport security patches into existing numbers, verify the changelog with apt-get changelog php8.3 and search for CVE-2026-109618.
• Conduct a smoke test: verify login, checkout carts, contact form submissions, and database operations.

Step 5: Temporary Mitigations (If Immediate Patching Is Blocked)

If you cannot reboot or upgrade PHP immediately due to production change-freeze windows, apply these partial mitigations:

• Disable upload progress in php.ini:
  php.ini configuration

  session.upload_progress.enabled = 0
  This severs one primary remote attack vector. WordPress and Laravel do not depend on this feature.
• On PHP 8.5 instances: Additionally configure fatal_error_backtraces = 0.
• Enforce Strict Request Body Caps: Restrict max upload sizes at Nginx/Apache edge proxies.
• Activate Web Application Firewalls (WAF): Keep Cloudflare WAF, AWS WAF, or ModSecurity in active blocking mode.

Step 6: Plan an Orderly Migration Off End-of-Life PHP

PHP 8.1 and earlier are officially retired. Operating unsupported PHP in 2026 places your enterprise at constant compliance and cybersecurity risk. Transitioning to modern PHP 8.3 or 8.4 provides massive JIT performance boosts and long-term security stability.

Warning Signs of an Exploit Attempt

If your servers were exposed to the public internet without the patch between 21 October and today, audit your access and system logs for these specific telemetry indicators:

• Anomalous Multipart POST Requests: High volumes of file-upload formatted requests directed to non-upload routes, followed immediately by worker memory exhaustion errors.
• Surges in HTTP 500 & 502 Errors: Unexpected bursts of gateway errors signaling sudden worker segmentation faults.
• Abnormally Large PHPSESSID Cookies: Cookies containing hundreds or thousands of bytes of binary padding in server access logs.
• Unexplained Worker Process Restarts: Rapid respawning of PHP-FPM pool child processes recorded in /var/log/php-fpm.log.
• Unrecognized Files or Accounts: New PHP files created in /tmp, /var/tmp, or public upload directories; new administrator users created in CMS databases.

What to Do If You Suspect Compromise

1. Patch PHP and Reboot Immediately: Close the entry vector before beginning forensics.
2. Rotate All Sensitive Credentials: Because PHP2Shell can read worker memory, immediately cycle database credentials, API access keys, SMTP passwords, and application secret keys (e.g. Laravel APP_KEY).
3. Perform Integrity Audits: Compare server code trees against your clean Git repository to discover unauthorized web shells.
4. Restore from Known-Clean Backups: If unauthorized files or altered binaries are confirmed, rebuild from a pre-incident snapshot.

Current Official PHP Support Lifecycle (2026)

Frequently Asked Questions