Today the PHP project released security updates for two critical vulnerabilities in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell.” Both are rated 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS), the industry-standard scale for how severe a security flaw is. Anything from 9.0 up is classed as Critical, the highest band. These score that high because they can be attacked over the internet, need no login or action from a site owner, and can give the attacker control of the server: together they allow an attacker to run their own code on it.
If your site is hosted on WordPress.com, WordPress VIP, WP Cloud, Pressable, or Tumblr, your site is already protected.
Automattic worked closely with the PHP Security team to ensure that all sites hosted on our platform were protected as soon as possible. There is nothing you need to do.
If you run PHP yourself, read on.
What happened
PHP is the programming language that powers WordPress and a large share of the web. When PHP handles a request, it sets aside memory to do the work and cleans up afterward. The researchers found that if a request makes PHP fail partway through, for example: by running out of memory while processing a form submission, that cleanup does not happen correctly. Memory gets released while PHP still holds a reference to it, and a later request can reach it.
An attacker who carefully shapes what ends up in that memory can steer PHP into running commands of their choosing. That is the “shell” in PHP2Shell: control of the server.
Three things make this one serious:
- No login is required. The attack works with ordinary web requests.
- Your application does not need a bug. The flaws are in the PHP runtime. Researchers demonstrated working attacks against current WordPress, Drupal, and Joomla installs, and noted that even a minimal “Hello World” page on an affected version can be vulnerable.
- It reaches back a long way. Affected releases go back more than a decade, to PHP 5.4.
What to do if you manage your own PHP
Update PHP. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. This is a runtime fix, so updating WordPress, your theme, or your plugins will not protect you on its own. If your host manages PHP for you, ask them to confirm they have applied the update.
If you are on PHP 8.1 or older, plan to move now. The PHP project no longer ships fixes for those versions. Some Linux distributions and long-term support vendors backport security fixes, so check with yours, but the durable answer is a supported release. PHP 8.2 itself reaches end of life on December 31, 2026, so 8.3 or newer is the better target.
If you cannot patch today, reduce your exposure until you can:
- Put the site behind a web application firewall. Several providers, including Cloudflare, have shipped rules for these vulnerabilities.
- If your site does not accept file uploads, block multipart form submissions at the web server, and turn off PHP’s
file_uploadsandsession.upload_progress.enabledsettings. - Watch your logs for unusual multipart requests followed by PHP memory-limit errors or bursts of HTTP 500 responses. Wiz Research lists these as signs of attempted exploitation.
These steps buy time. They are not a substitute for the update.
Thank you
Coordinated disclosure only works when everyone involved does their part. Our thanks to the PHP Security team for their careful work on the fix and the release, and to Wiz Research, Calif, OpenAI, and Quarkslab for finding and responsibly reporting these issues. We were proud to be among the companies Wiz acknowledged for helping prepare guidance and mitigations, and we will keep working with the PHP and WordPress communities to keep the open web safe.
