Critical PHP Vulnerabilities: What Website Owners Need to Know About PHP2Shell

What is PHP2Shell—and why does it matter?

PHP is server-side software used by WordPress and many other websites and applications. These vulnerabilities are in PHP’s core engine, beneath the site’s pages, themes and plugins.

• CVE-2026-109618: memory-exhaustion handling. An out-of-memory failure can interrupt PHP before internal request data is fully prepared. Cleanup can then act on invalid data, creating a path to remote code execution. Official advisory.
• CVE-2026-109619: stale internal state. PHP can retain references to memory from an earlier request after that memory has been released. A later request handled by the same worker can encounter that stale state and potentially enable code execution. Official advisory.

The actual attack path depends on the deployment, configuration and application. PHP identifies installations serving web requests—including Apache mod_php, PHP-FPM, PHP-CGI, FrankenPHP and LiteSpeed—as needing attention. A different hosting configuration is not a reason to skip the update.

For a business, the concern is control of the website and the information its server can access. A working homepage is not evidence that the underlying environment is secure.

How could a flaw survive for so many years?

Wiz reports that affected versions go back to PHP 5.4 and that the vulnerable code had existed for more than a decade. Its researchers used AI tools to help analyze complex memory behavior, test ideas and develop working demonstrations. The tools reduced the effort required to connect subtle weaknesses into a practical attack. Wiz’s discovery report.

The PHP Foundation’s account adds important history. During work following a 2024 security audit, a PHP core developer identified signs of the memory-exhaustion problem. A fix stalled amid difficult compatibility and engineering trade-offs, limited resources and the absence of a concrete remote-code-execution path at that time.

In August 2026, Calif researcher Ryan A reported remote code execution during an audit through OpenAI’s Patch the Planet program. Reports from OpenAI and Wiz helped establish the broader impact. The Foundation describes human researchers and maintainers working alongside AI-assisted tools to validate findings and develop fixes. The PHP Foundation’s explanation.

The business lesson: software that has worked for years still needs active security ownership. New research can change what attackers can do with an old weakness.

Which PHP versions are affected?

For the supported production branches, use the following minimum fixed releases. Later security releases in the same branch may supersede them.

PHP 8.1 and older are outside upstream support. Limited source backports were provided for 7.4, 8.0 and 8.1; they do not restore normal support. Hosting and Linux vendors may backport fixes without changing the upstream version number. Check the vendor’s package advisory, not just the displayed version. Sources: PHP advisory and release guidance.

How to patch your website’s PHP environment

Ask your hosting provider or technical team to own the update and verify completion. Installing a WordPress update does not, by itself, replace the server’s PHP runtime.

1. Inventory what actually serves each site. Include production, staging, subdomains, application servers and containers. Different sites on one hosting account may use different PHP handlers.
2. Prepare a recoverable change. Confirm current backups and test critical application compatibility. Prioritize the security update; do not let an unrelated redesign delay remediation.
3. Install the fixed runtime or verified vendor package. Use the hosting platform’s supported update process. A selector labeled “PHP 8.3” alone does not establish that the patch is installed.
4. Replace running processes. Restart or recycle all relevant PHP workers through the approved hosting procedure. Rebuild and redeploy container images where applicable so the next deployment also contains the fix.
5. Verify the live site. Confirm the web-serving runtime and package build, then check forms, logins, checkout, uploads, integrations and scheduled jobs. A command-line version check may refer to a different PHP installation.
6. Document and monitor. Record the installed build and completion time. Review unexpected errors or suspicious activity; escalate possible compromise for investigation.

PHP states that configuration workarounds are incomplete. A firewall or temporary setting change should not be treated as a replacement for the patch. If a provider cannot update promptly, ask for an exposure-reduction plan and a firm remediation timeline.

Patching closes these vulnerabilities; it does not prove that an exposed system was never compromised. Suspected intrusion requires a separate investigation.

Knowtion has patched affected customer websites

As of October 22, 2026, Knowtion has patched all customer websites affected by these PHP vulnerabilities. Customers with questions about their specific website can contact our team.

This is why website ownership extends beyond launch day. Someone needs to track the platform, respond to security advisories and coordinate changes across hosting and application dependencies.

Knowtion’s website services include WordPress and custom development, website takeover and rescue, hosting coordination and ongoing maintenance. Our Managed IT & Cybersecurity services bring broader patching, vulnerability management and continuity planning into the conversation.

If your website was built by a former employee, an unavailable developer or an agency that only handles content updates, start by asking one direct question: Who is responsible for the software underneath the site?