Technology

Critical PHP Vulnerability Puts Millions of Websites at Risk: WordPress Site Owners Urged to Update

Oct 23, 2026

A pair of critical security vulnerabilities in PHP, one of the technologies powering a large part of the internet, has triggered urgent warnings for website owners and hosting providers. The flaws could allow attackers to execute malicious code on vulnerable servers without logging in, potentially exposing sensitive information and giving attackers control over affected systems.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were addressed through emergency security releases published by the PHP development team on October 21, 2026. Both received a CVSS v4.0 severity score of 9.2 out of 10.

The vulnerabilities are collectively known as PHP2Shell. Security authorities are urging organisations to identify affected systems and apply the available fixes immediately. Source: CERT-EU security advisory

The issue is particularly relevant to websites built with WordPress, Drupal, Joomla and other platforms that depend on PHP. However, the vulnerabilities originate in the PHP runtime itself rather than in a specific content management system.

What Are the Newly Discovered PHP Vulnerabilities?

PHP is a server-side programming language used to process website requests, communicate with databases and generate dynamic content. It is a core technology behind blogs, business websites, online stores and many other web applications.

According to the UK National Cyber Security Centre, the two vulnerabilities involve errors in PHP's internal memory handling and request processing.

CVE-2026-109618 involves memory corruption during out-of-memory handling. Under certain conditions, PHP may interrupt request processing while internal data is only partially initialised. Subsequent cleanup can then handle that data incorrectly.

CVE-2026-109619 involves stale internal state. Information associated with an earlier request may remain accessible after its underlying memory has been released, potentially allowing a later request handled by the same worker to interact with invalid data.

Under certain conditions, these flaws can lead to unauthenticated remote code execution (RCE). This means an attacker may be able to execute unauthorised code on a vulnerable server without first obtaining a legitimate account.

Successful exploitation could potentially result in data exposure, unauthorised file changes, website defacement or further server compromise, depending on the environment and the privileges of the affected process.

The Canadian Centre for Cyber Security has also published an alert covering both vulnerabilities and recommending immediate security updates.

Why This Vulnerability Matters for WordPress

Many website security incidents originate in outdated plugins, vulnerable themes or poorly configured applications. PHP2Shell is different because it affects the underlying programming language runtime.

This distinction matters because updating WordPress alone does not necessarily resolve the problem.

A website can run an up-to-date WordPress installation while still using a vulnerable PHP version supplied by its hosting environment. If the underlying runtime remains unpatched, the website may continue to be exposed.

The same concern applies to Drupal, Joomla and custom-built PHP applications.

The risk is not limited to one hosting configuration. CERT-EU identifies PHP-FPM, Apache with mod_php, CGI-based PHP, FrankenPHP and LiteSpeed among the affected environments. The PHP project's assessment identifies Apache's mod_php configuration as particularly concerning.

For this reason, administrators should check the PHP runtime used by their actual website rather than relying only on the version of their content management system.

Sources: CERT-EU and UK NCSC.

Which PHP Versions Need an Update?

The PHP development team published security releases for affected supported branches on October 21, 2026.

PHP branchFixed releasePHP 8.58.5.12PHP 8.48.4.27PHP 8.38.3.36PHP 8.28.2.35

These are the published fixed releases for the two vulnerabilities. Administrators should check the official PHP security announcements for any subsequent updates.

PHP 8.1 and older branches no longer receive security fixes from the main PHP project. Some operating system vendors and commercial providers may backport security patches to older versions, so administrators should confirm their vendor's advisory rather than assuming that the displayed version number alone establishes whether a system is protected.

PHP 8.2 is also approaching the end of its security-support period, currently scheduled for December 31, 2026. Organisations using it should plan a migration to a newer supported branch.

The official PHP website provides release announcements and download information.

How WordPress Website Owners Can Protect Their Sites

WordPress site owners should treat this as a server-level security issue, not simply a plugin update.

1. Check the active PHP version

Log in to your hosting control panel and locate the PHP version assigned to your website. On cPanel hosting, this is commonly available through MultiPHP Manager or a similar PHP configuration tool.

Confirm that the runtime has received the relevant security fix. If your hosting provider manages PHP for you, ask its support team to confirm the deployed version and patch status.

2. Update PHP through your hosting provider

Upgrade to an appropriate fixed release or a newer supported security release. Before making a major version change, back up your website files and database, and check compatibility with your plugins, themes and custom code.

If your hosting provider does not offer a fixed release, contact its support team and request an urgent security update.

3. Keep WordPress, plugins and themes updated

Updating PHP does not remove vulnerabilities in outdated WordPress extensions. Install available security updates, remove unused plugins and themes, and avoid extensions that are no longer maintained.

4. Use a web application firewall as an additional layer

A web application firewall (WAF) can help detect or block certain malicious requests. Cloudflare has published information about protections against PHP2Shell.

However, a firewall should not be treated as a replacement for patching. The PHP security team has stated that there are no complete mitigations and that updating is the only safe choice.

5. Review logs if your website was exposed

If your server was running a vulnerable PHP version, review relevant web server, application and authentication logs for suspicious activity. Investigate unexpected administrative accounts, unfamiliar files, unauthorised changes and unusual processes.

If you suspect a compromise, follow an incident-response process and seek qualified assistance where necessary. Updating the server is essential, but it does not automatically remove malicious changes that may already have occurred.

Source: PHP security announcements.

What Should Website Owners in Nepal Do?

The vulnerability is relevant to Nepal's growing digital ecosystem, where businesses, educational institutions, news portals and other organisations rely on websites to communicate with users and deliver services.

Many organisations use shared hosting or managed hosting packages, meaning they may not have direct control over the server's PHP installation. In these situations, the hosting provider plays an important role in applying security updates.

Website owners should not assume that a site is safe simply because it loads normally or displays an HTTPS padlock. HTTPS protects connections between users and websites, but it does not repair vulnerabilities in the server-side software.

Schools, colleges, online businesses and news websites should confirm which PHP version their websites use and ask their hosting providers whether the relevant security fixes have been applied.

Developers managing their own servers should also check staging environments, subdomains, containers and other applications that may include PHP. An overlooked service can remain exposed even after the main website has been updated.

For organisations without dedicated security teams, verifying the runtime version, maintaining reliable backups and contacting the hosting provider are practical first steps.

Why Immediate Patching Matters

The seriousness of PHP2Shell comes from the potential impact of the flaws and the widespread use of PHP.

A vulnerability in a particular plugin may affect websites that use that extension. A vulnerability in the PHP runtime can potentially affect many different applications that depend on it.

The risks also extend beyond hypothetical scenarios. Amazon Web Services reported an exploitation attempt detected in its MadPot threat-intelligence system on October 17, 2026, before the public disclosure of the vulnerabilities. This does not establish that every vulnerable website is being attacked, but it reinforces the importance of timely remediation.

Organisations should prioritise internet-facing systems, apply the appropriate security updates and investigate possible compromise where warranted. If an exposed service cannot be secured promptly, follow the relevant vendor and security-authority guidance on temporary mitigation or isolation.

The Bigger Lesson for Website Security

The PHP2Shell vulnerabilities highlight an important principle of cybersecurity: maintaining a secure website requires more than keeping its visible application updated.

The full technology stack matters, including the operating system, web server, programming language runtime, database, dependencies and application code. A weakness in one layer can undermine protections implemented elsewhere.

For businesses and institutions in Nepal, regular maintenance, supported software versions, reliable backups and clear communication with hosting providers should be treated as essential parts of operating a website.

The immediate priority is straightforward: check the PHP runtime, apply the relevant security update and investigate possible compromise if the website was exposed. Waiting until an incident occurs can turn routine maintenance into a much more expensive recovery process.

As attackers continue to target widely deployed software, timely patching remains one of the most effective ways for website owners to reduce preventable security risks.