Critical PHP2Shell Flaws Allow Unauthenticated RCE on PHP Servers

On 21 October 2026 the PHP project released security versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to close two critical flaws, CVE-2026-109618 and CVE-2026-109619. Known as PHP2Shell, they can allow unauthenticated remote code execution on PHP web servers. Each issue scores about CVSS 9.2.

CISA and CERT-EU warn that essentially every PHP install serving web requests is at risk, including PHP-FPM and Apache with mod_php. WordPress.org said no WordPress core update is needed — only the PHP runtime must be patched. AWS reported exploitation attempts from about 17 October, days before public disclosure, with broader exploitation afterward.

For technical details, affected versions and a step-by-step WordPress/CMS remediation checklist, read our full guide: How to fix the PHP2Shell vulnerability on WordPress.

Sources: CISA, WordPress.org, PHP Foundation.