NewsOctober 25, 20265 min read

php2shell PHP vulnerability: ARTIC-hosted sites protected

On 21 October 2026, two critical PHP flaws (php2shell) were disclosed. Who is affected, how to check, what ARTIC did, and what any PHP/WordPress site should do now.

Marc Bolet · Web, automation and AI at ARTIC

In this article

What happened, and when
Who is affected and how to check
What ARTIC did on 21 October
What to do now (short checklist)
How to reduce risk next time
Frequently asked questions
Who is looking after your website?
Sources

On 21 October 2026, two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were published and are collectively known as “php2shell” CVE-2026-109618 CVE-2026-109619. The PHP project issued a security release for PHP 8.4 (8.4.27) urging an update PHP 8.4.27, and WordPress reminded that any PHP application server can be affected and explained how to check your PHP version WordPress. On the same day, we applied the fix across ARTIC-hosted sites and our standard protections were already in place.

Key takeaways

Two PHP CVEs (CVE-2026-109618 and CVE-2026-109619) were published on 21 October 2026 NVD 109618 NVD 109619.
PHP 8.4.27 is a security release; users are encouraged to update PHP 8.4.27. WordPress notes the issue affects any PHP server and offers a version check path WordPress.
Fixed versions cited include 8.5.12, 8.4.27, 8.3.36 and 8.2.35 Hostinger.
As of 25 October 2026, neither CVE is listed in CISA’s Known Exploited Vulnerabilities catalog CISA KEV.

What happened, and when

On 21 October 2026, two PHP vulnerabilities were disclosed: CVE-2026-109618 and CVE-2026-109619, nicknamed “php2shell” NVD 109618 NVD 109619. According to the National Vulnerability Database (NVD), both involve request memory/state handling issues that can, in certain conditions, lead to remote code execution (RCE) NVD 109618 NVD 109619. NVD rates CVE‑2026‑109618 as Critical (CVSS v3.1 9.8) and CVE‑2026‑109619 as High (CVSS v3.1 8.1), with CVSS v4.0 9.2 assessments from php.net recorded for both NVD 109618 NVD 109619.

The PHP project announced the immediate availability of PHP 8.4.27 as a security release and encouraged all PHP 8.4 users to update PHP 8.4.27. Separately, WordPress clarified that these issues are not specific to WordPress and can affect any server hosting PHP applications; it also explains how to check your PHP version within WordPress WordPress.

Given the potential for RCE and the vendor guidance, updating PHP remains the top priority whenever a patched build is available NVD 109618 NVD 109619 PHP 8.4.27.

Who is affected and how to check

WordPress states these vulnerabilities affect any server that hosts a PHP application; there is no WordPress core update required or planned for this incident WordPress. Hostinger reports that fixed builds include 8.5.12, 8.4.27, 8.3.36, and 8.2.35; earlier versions are affected Hostinger. If you are on PHP 8.4, the PHP project specifically released 8.4.27 as a security update PHP 8.4.27.

To check your PHP version in WordPress, go to Tools > Site Health > Info > Server; many hosting panels also show the version in their dashboards WordPress. WordPress also notes that versions of PHP prior to 8.2 no longer receive security updates from the PHP project, and if you manage your own infrastructure and cannot immediately remediate, some national cyber security agencies advise considering taking the system offline until it can be fully mitigated WordPress.

If you need structured ways to stabilise and test after a PHP change, these resources on website maintenance, web optimisation, professional WordPress web design, and technical SEO can help plan safe rollouts.

What ARTIC did on 21 October

At ARTIC (a B2B digital marketing team in Catalonia, Spain), we resolved the incident in five minutes. Even before the official patch landed, our standard stack already closed three doors: 1) our servers handle requests in a way that does not match the attack pattern, so malicious code would not execute; 2) the vulnerable PHP function was disabled on our platform; and 3) each website runs in an isolated account with least‑privilege access, so even a hypothetical success would not reach the server or another client site.

On 21 October, we deployed the vendor fix across all managed hosting. Clients did not need to take any action. Our platform performs five‑minute monitoring, SSL certificate monitoring, and hardened server security. For sites under maintenance, we run controlled updates of WordPress core, plugins and themes, and produce a monthly report covering uptime, performance and actions taken.

For teams hosted elsewhere, confirm with your provider that patched PHP builds are in place and ask about any interim web application firewall (WAF) mitigations while updates roll out WordPress.

What to do now (short checklist)

Check your PHP version. In WordPress: Tools > Site Health > Info > Server WordPress.
Update PHP to a fixed release. Hostinger cites patched lines as 8.5.12, 8.4.27, 8.3.36 and 8.2.35 Hostinger. If you are on PHP 8.4, install 8.4.27 PHP 8.4.27.
If you manage your own server and cannot remediate immediately—especially on versions prior to 8.2—consider taking the system offline until fully mitigated, as highlighted by WordPress’ guidance from national agencies WordPress.
Ask your host whether they have applied the PHP fixes and whether temporary WAF/server‑level mitigations are in place WordPress.
Before major version jumps, test in staging, confirm theme/plugin compatibility, and keep a rollback plan. A structured website maintenance routine reduces risk.

How to reduce risk next time

Keep PHP promptly updated. Apply security releases such as PHP 8.4.27 without delay on supported lines PHP 8.4.27.
Avoid end‑of‑life versions. WordPress notes that versions prior to 8.2 are no longer receiving security updates from the PHP project WordPress.
Layer defences: per‑site isolation, least‑privilege accounts, and well‑maintained WAF rules help reduce exposure while vendor patches deploy.
Standardise maintenance windows, staging tests and rollbacks. Visibility routines around performance and health help spot regressions after updates; see web optimisation and technical SEO.
Automate alerts and operational checklists where possible; our work as a Claude Partner shows how AI‑assisted workflows can add resilience.

As of 25 October 2026, neither CVE-2026-109618 nor CVE-2026-109619 appears in CISA’s Known Exploited Vulnerabilities catalog; patching remains essential regardless CISA KEV.

Frequently asked questions

What is “php2shell” and which CVEs are involved?

“php2shell” refers to two PHP vulnerabilities disclosed on 21 October 2026: CVE‑2026‑109618 and CVE‑2026‑109619 NVD 109618 NVD 109619.

Does this affect WordPress? Do I need a WordPress update?

This is not a WordPress flaw. It affects any server running PHP applications, and no WordPress core update is required or planned for these issues WordPress.

Which PHP versions contain the fix?

The PHP project released 8.4.27 as a security update for the 8.4 line PHP 8.4.27. Hostinger also cites fixed builds 8.5.12, 8.3.36 and 8.2.35 in addition to 8.4.27 Hostinger.

Is this being actively exploited?

As of 25 October 2026, neither CVE is listed in CISA’s Known Exploited Vulnerabilities catalog CISA KEV. Regardless, update PHP to a patched version as soon as possible WordPress.

Who is looking after your website?

At ARTIC, website maintenance includes controlled updates, backups and server monitoring, and if your site is slow we optimise it. If it is hosted elsewhere, we can help you move it.

Sources

Informative article with the sources linked, up to date on the publication date.