PHP2Shell: Affected PHP Versions, Fixes and Security Checklist
Last verified: 23 October 2026. PHP2Shell is the name used for two critical PHP runtime vulnerabilities, CVE-2026-109618 and CVE-2026-109619. If you operate a PHP website, your immediate task is to identify the runtime serving it, install a fixed build and verify that the running workers have restarted. Updating WordPress alone does not replace this work.
This guide separates confirmed technical findings, dated attack observations and provider-specific claims. It also includes PHP’s 23 October follow-up advice, which matters even after the initial emergency update. Read more
