
PHP2Shell Explained: Who Is Affected and How to Secure WordPress
Critical PHP flaws dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619) enable unauthenticated RCE. WordPress and other CMSes are exposed; updating WordPress alone is not enough — patch PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and restart workers.



