PHP Just Shipped an Emergency Patch (CVE-2026-109618): Why Your WordPress Update Button Will Not Fix It

I woke up to a different kind of security alert this week. Most of the time when a critical flaw lands, the fix is a WordPress update I can push in a few minutes. This one is not that. On October 21 the PHP team shipped an emergency release for two vulnerabilities that researchers are calling PHP2Shell, and the problem lives inside PHP itself. That means the “Update Now” button in your dashboard does nothing to protect you here.

I manage a mix of WordPress and WooCommerce sites, so I spent the morning working through each one. Here is what the flaw actually is, why it matters more than a typical plugin bug, and the exact steps I am taking.

What PHP2Shell actually is

There are two CVEs in this release, CVE-2026-109618 and CVE-2026-109619, and both are rated critical. The short version is that a single web request, with no login required, can be used to run code on your server. For an attacker that is close to the worst case, because once they can run code they can read your database credentials, drop a backdoor, or pivot to other sites sharing the same server.

The two bugs behave differently under the hood. CVE-2026-109618 comes from how PHP handles running out of memory in the middle of a request. The engine can be interrupted while request data is only half set up, and the cleanup step then treats that broken data as if it were valid. CVE-2026-109619 is a use-after-free, where internal state tied to one request survives after its memory has been released, and a later request on the same worker picks up that stale state. You do not need to follow the internals to act, but it helps to know this is a core-engine problem, not a configuration mistake you made.

It affects essentially every way PHP serves web traffic, including PHP-FPM, Apache with mod_php, php-cgi, and newer runtimes like FrankenPHP and LiteSpeed. Sites running mod_php sit in the most exposed position.

Why updating WordPress does not help

This is the part I keep repeating to clients. WordPress, your theme, and your plugins all run on top of PHP. When the hole is in PHP, keeping WordPress current is good hygiene, but it does not close this particular door. I learned to separate these two layers the hard way, and it is the same reason I treat a core WordPress patch like the recent 7.1.2 RCE fix as a completely different job from a server update. One gets clicked in the dashboard. The other happens at the host level.

So if you updated WordPress earlier this month and feel covered, I understand the instinct, but check your PHP version anyway. The two are not the same shield.

Step one: find out which PHP version you are on

You do not need SSH for this. In your dashboard go to Tools, then Site Health, then the Info tab, and open the Server section. It lists your exact PHP version. The patched releases to look for are:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

If you are on one of those or newer, your host has most likely already patched you. If you are on an earlier build of 8.2, 8.3, 8.4, or 8.5, you need the update applied. If you are on PHP 8.1 or older, no official patch is coming, because those versions are past end of life. The PHP team did publish minimal source backports for 7.4, 8.0, and 8.1 for people who build from source, but most site owners should read that as a clear signal to move to a supported version.

Step two: match the fix to how you are hosted

Managed WordPress hosting

If you are on a managed host, this is mostly handled for you. The good ones patched PHP before or right as the release went public. I still opened a ticket on each managed site to get written confirmation rather than assuming. Thirty seconds of asking beats a silent gap.

Shared or cPanel hosting

Most shared hosts let you pick your PHP version in the control panel, under something like “Select PHP Version” or “MultiPHP Manager.” Once your provider rolls out the patched build, switching to it there is usually enough. If the patched point release is not showing yet, that is a question for support.

VPS or self-managed servers

This is where the real work is. You or your developer need to install the patched PHP packages from your distribution as soon as they land, then restart PHP-FPM or your web server. If you cannot patch right away, the UK NCSC guidance is blunt: take the system offline rather than leave it exposed.

Buy yourself time with a WAF, but do not lean on it

If your site sits behind Cloudflare, they have pushed firewall rules targeting the known exploit patterns to every plan, including the free tier. That is a useful buffer while you arrange the real fix. I treat it as exactly that, a buffer. A determined attacker can often work around a rule set, so the PHP update is still the job. A WAF is a seatbelt, not a reason to skip the repair.

The part most people skip: test before you jump versions

If this forces you off PHP 8.1 and onto 8.2 or later, do not do it live on a Friday afternoon. Older plugins and custom code can break on a new PHP version, and WooCommerce stores are especially sensitive because a broken checkout costs real money. My routine is to clone the site to staging, take a full backup first, bump the PHP version there, and click through the important flows, checkout included, before touching production. If you want a fuller pre and post update routine, I built one into my WordPress security checklist.

While you are in there, it is worth knowing what a compromise looks like, because this flaw was reportedly being exploited before the patch shipped. If anything feels off, my guide on spotting a hacked WordPress site walks through the signs I check first.

My short version for today

Check your PHP version in Site Health. Get to a patched release, which means 8.2.35, 8.3.36, 8.4.27, or 8.5.12 at a minimum. Confirm it with your host instead of assuming. If you are stuck on 8.1 or older, plan the upgrade now and test it on staging. You can read the technical writeup from Help Net Security, grab the current builds straight from php.net, and if the version jump is new territory, the official WordPress guide to updating PHP is a solid starting point.

If you manage more than a handful of sites and auditing every PHP version today feels like a lot, that is exactly the kind of work I help with. An hour this week is cheaper than a weekend cleaning up a breach.