What happened
PHP is the software that runs behind WordPress, WooCommerce and many other websites. On 21 October 2026 the PHP project released fixes for two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. They are rated critical and are widely known as “PHP2Shell”.
In some server setups, the flaws let an attacker run their own code on the web server without logging in. That could lead to stolen data, changed pages or hidden malware. The UK's National Cyber Security Centre (NCSC) published an alert the same day.
Who is affected
Any website served by a version of PHP that has not been updated. That includes most WordPress and WooCommerce sites. The risk is highest on servers that run PHP through Apache's built-in PHP module, but the PHP project advises everyone to update.
The problem is in PHP, not in WordPress or WooCommerce. Updating your website, theme or plugins does not fix it. The PHP software on the server has to be updated, which is usually your hosting company's job.
Many managed hosting companies say they updated PHP within a day or two. If you run your own server or VPS, updating it is up to you or your developer. PHP 8.1 and older get no official fix and should be upgraded to a supported version.
What to do
- 1Ask your host to confirm in writing that PHP on your site has been updated. The fixed versions are 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later. Some hosts install the fix under their own version numbers, so their written confirmation matters more than the number.
- 2If you manage your own server, update PHP now. If you cannot update straight away, the PHP project has published temporary measures you can apply in the meantime.
- 3If you cannot do either quickly, the NCSC says you should consider taking the site offline until it can be fixed.
- 4If your site was not updated promptly, check it for signs of compromise. Amazon reported attempts to exploit these flaws from 17 October 2026, four days before the fixes were released.
Is anyone actually exploiting it?
Yes. Attackers are actively trying to exploit these flaws, and at least one successful attack has been reported. Firewall rules from providers such as Cloudflare help, but they are not a substitute for updating PHP.
On 23 October 2026 the PHP project also announced a separate flaw, CVE-2026-115560, that only affects unusual configurations and has no fix yet. Its advice is to keep one of the temporary measures in place until its next regular release.