{"id":1770,"date":"2026-10-22T09:19:13","date_gmt":"2026-10-22T13:19:13","guid":{"rendered":"https:\/\/servitiq.ca\/?p=1770"},"modified":"2026-10-22T09:19:13","modified_gmt":"2026-10-22T13:19:13","slug":"php2shell-php-vulnerabilities-website","status":"publish","type":"post","link":"https:\/\/servitiq.ca\/en\/articles\/php2shell-failles-php-site-web\/","title":{"rendered":"PHP2Shell: the PHP flaws threatening your website (and what to do)"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><strong>Your website, online store or client portal most likely runs on PHP.<\/strong> WordPress, WooCommerce and most CMSs are built on this language. On October 21, 2026, the PHP team released emergency fixes for two critical flaws, nicknamed <strong>PHP2Shell<\/strong>, which under certain conditions allow an attacker to take control of a web server <strong>without any password<\/strong>. Here is what you need to know, in plain language, and what you should check right now.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">PHP2Shell at a glance<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Identifiers:<\/strong> CVE-2026-109618 and CVE-2026-109619<\/li>\n\n\n\n<li><strong>Severity:<\/strong> CVSS v4.0 score of 9.2 out of 10 for each (<a href=\"https:\/\/blog.qualys.com\/vulnerabilities-threat-research\/2026\/10\/20\/php-announces-critical-security-release-for-two-vulnerabilities\" target=\"_blank\" rel=\"noopener\">Qualys<\/a>)<\/li>\n\n\n\n<li><strong>Impact:<\/strong> remote code execution, without authentication<\/li>\n\n\n\n<li><strong>Who is affected:<\/strong> any PHP installation that serves web pages \u2014 PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed (<a href=\"https:\/\/securitylabs.datadoghq.com\/articles\/php2shell-critical-vulnerabilities-in-php\/\" target=\"_blank\" rel=\"noopener\">Datadog Security Labs<\/a>)<\/li>\n\n\n\n<li><strong>Fixed versions:<\/strong> PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Why are these flaws so serious?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most web vulnerabilities target a specific plugin, theme or form. PHP2Shell is different: it lies <strong>in PHP itself<\/strong>, before your site even runs. According to Datadog Security Labs, \u201cPHP processes the malicious request before any application code runs.\u201d In other words, a strong password, a WordPress security plugin or a well-coded site are not enough to block the attack.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In simple terms:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>CVE-2026-109618<\/strong> \u2014 when a request exhausts the memory allocated to PHP, PHP can abandon a half-finished operation, then \u201cclean up\u201d by treating invalid data as if it were valid.<\/li>\n\n\n\n<li><strong>CVE-2026-109619<\/strong> \u2014 a PHP process can keep information from a previous request that points to memory that has already been freed. A later request sent to the same process can then reuse this stale data.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In both cases, a skilled attacker can turn this memory mix-up into running their own commands on the server: theft of customer data, installing a backdoor, sending spam or ransomware.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Are attacks already happening?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The technical details leaked on October 20, before the planned disclosure date. Several sources report malicious activity:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Amazon Threat Intelligence observed an exploitation attempt as early as <strong>October 17, 2026<\/strong>, four days before the fixes were released (<a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/21\/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619\/\" target=\"_blank\" rel=\"noopener\">Help Net Security<\/a>).<\/li>\n\n\n\n<li>Cloudflare reported attack traffic targeting these flaws (<a href=\"https:\/\/blog.qualys.com\/vulnerabilities-threat-research\/2026\/10\/20\/php-announces-critical-security-release-for-two-vulnerabilities\" target=\"_blank\" rel=\"noopener\">Qualys<\/a>).<\/li>\n\n\n\n<li>Datadog says it is aware of broad, untargeted scanning of the Internet.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Attackers don\u2019t need to target you personally: bots scan the Internet looking for any unpatched server. <strong>The size of your business does not protect you.<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The real problem: end-of-life PHP versions<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">PHP2Shell highlights a broader risk. Each PHP branch receives security fixes for a limited time. According to <a href=\"https:\/\/www.php.net\/supported-versions.php\" target=\"_blank\" rel=\"noopener\">php.net<\/a>, as of October 2026:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Version<\/th><th>Security fixes until<\/th><th>Status<\/th><\/tr><\/thead><tbody><tr><td>PHP 8.5<\/td><td>December 31, 2029<\/td><td>\u2705 Supported<\/td><\/tr><tr><td>PHP 8.4<\/td><td>December 31, 2028<\/td><td>\u2705 Supported<\/td><\/tr><tr><td>PHP 8.3<\/td><td>December 31, 2027<\/td><td>\u2705 Security fixes only<\/td><\/tr><tr><td>PHP 8.2<\/td><td>December 31, 2026<\/td><td>\u26a0\ufe0f Ends in a few weeks<\/td><\/tr><tr><td>PHP 8.1<\/td><td>December 31, 2025<\/td><td>\u274c End of life<\/td><\/tr><tr><td>PHP 8.0<\/td><td>November 26, 2023<\/td><td>\u274c End of life<\/td><\/tr><tr><td>PHP 7.4<\/td><td>November 28, 2022<\/td><td>\u274c End of life<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">For PHP2Shell, the PHP team exceptionally released source-code fixes for versions 7.4, 8.0 and 8.1 (<a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/21\/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619\/\" target=\"_blank\" rel=\"noopener\">Help Net Security<\/a>). But these versions no longer receive regular updates: the next flaw may never be fixed. WordPress itself recommends <a href=\"https:\/\/wordpress.org\/about\/requirements\/\" target=\"_blank\" rel=\"noopener\">PHP 8.3 or newer<\/a> and states that older versions \u201cmay expose your site to security vulnerabilities.\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">PHP2Shell is not an isolated case: the <a href=\"https:\/\/www.php.net\/ChangeLog-8.php\" target=\"_blank\" rel=\"noopener\">PHP changelog<\/a> lists about ten vulnerabilities fixed in version 8.5.11 alone, released in September 2026 (FPM, OpenSSL, SOAP, Phar\u2026). A server that is not updated regularly piles up these flaws.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What to do now: 5 concrete steps<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1. Find out your PHP version<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In WordPress, go to <strong>Tools \u2192 Site Health \u2192 Info \u2192 Server<\/strong>. You can also find it in your host\u2019s control panel (cPanel, Plesk, etc.).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Require your host to update<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you are on shared or managed hosting, updating PHP is usually your provider\u2019s responsibility. Ask them in writing whether they have applied versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or the equivalent fix from their Linux distribution), and on what date.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. If you manage your own server: patch, then restart<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Install the fixed version, rebuild your Docker images if applicable and <strong>restart all PHP processes<\/strong>. According to Datadog, \u201conly patching fixes these vulnerabilities.\u201d If you cannot patch immediately, temporary measures exist, including disabling <code>session.upload_progress.enabled<\/code> \u2014 but they do not replace the update. The UK\u2019s NCSC even recommends considering taking offline any system that cannot be fixed quickly.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Add a layer of protection in front of your site<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A web application firewall (WAF) can filter known attempts. Cloudflare has deployed rules for PHP2Shell, including for its free-plan customers \u2014 a partial protection that does not replace the fix. See our article <a href=\"\/en\/blog\/dns-waf-zero-trust-protect-smb\/\">DNS, WAF and Zero Trust: protecting your website and access<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. Check for signs of intrusion<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A successful attack does not necessarily crash the site. Watch for: unknown PHP files on your site, new administrator accounts, unusual \u201cAllowed memory size exhausted\u201d errors in the logs, or a web server running system commands. If in doubt, call a professional before simply \u201ccleaning up.\u201d<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How ServiTIQ protects its clients\u2019 sites<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On October 22, 2026, within hours of the fixes being released, ServiTIQ updated all the PHP environments it hosts to PHP 8.3.36 and applied the recommended hardening measures. That is what <a href=\"\/en\/blog\/managed-docker-hosting-smb\/\">managed hosting<\/a> gives you: you don\u2019t have to track security alerts yourself.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Security monitoring<\/strong> of PHP, WordPress and your plugins<\/li>\n\n\n\n<li><strong>Scheduled updates<\/strong> with a rollback image in case of problems<\/li>\n\n\n\n<li><strong>Guided migration<\/strong> of sites still on PHP 7.x or 8.0\/8.1 to a supported version<\/li>\n\n\n\n<li><strong>Backups<\/strong> and a web application firewall in front of your sites<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Not sure which PHP version your site runs on, or whether your host has applied the fix?<\/strong> <a href=\"\/en\/contact\/\">Contact us<\/a> : we will check your site and clearly explain the risks and your options.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ<\/h2>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Is my WordPress site affected by PHP2Shell?<\/summary>\n<p>If your site runs a PHP version older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (without a fix from your distribution), you should assume it is. The flaw is in PHP, not in WordPress: updating WordPress is not enough.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Does a security plugin like Wordfence protect me?<\/summary>\n<p>Not against this type of flaw. A WordPress plugin runs inside PHP, whereas PHP2Shell is triggered before your site\u2019s code runs. Only updating PHP fixes the problem; a WAF in front of the server can reduce the risk in the meantime.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>My site runs on PHP 7.4 and works fine. Why change?<\/summary>\n<p>PHP 7.4 has not received official fixes since November 28, 2022. For PHP2Shell, a source fix was exceptionally released, but there is no guarantee the same will happen for future flaws. Moving to PHP 8.3 or 8.4 often requires adjustments to the theme or plugins: better to plan it than to be forced into it.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>My host says they are handling it. How can I check?<\/summary>\n<p>Ask for the exact PHP version installed and the update date. In WordPress, the Site Health page shows the version your site uses. A reliable host should be able to give you a clear answer.<\/p>\n<\/details>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Sources: <a href=\"https:\/\/www.php.net\/supported-versions.php\" target=\"_blank\" rel=\"noopener\">php.net \u2013 supported versions<\/a>, <a href=\"https:\/\/www.php.net\/eol.php\" target=\"_blank\" rel=\"noopener\">php.net \u2013 unsupported branches<\/a>, <a href=\"https:\/\/securitylabs.datadoghq.com\/articles\/php2shell-critical-vulnerabilities-in-php\/\" target=\"_blank\" rel=\"noopener\">Datadog Security Labs<\/a>, <a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/21\/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619\/\" target=\"_blank\" rel=\"noopener\">Help Net Security<\/a>, <a href=\"https:\/\/blog.qualys.com\/vulnerabilities-threat-research\/2026\/10\/20\/php-announces-critical-security-release-for-two-vulnerabilities\" target=\"_blank\" rel=\"noopener\">Qualys<\/a>, <a href=\"https:\/\/wordpress.org\/about\/requirements\/\" target=\"_blank\" rel=\"noopener\">WordPress.org<\/a>. Information current as of October 22, 2026; the situation may change.<\/em><\/p>","protected":false},"excerpt":{"rendered":"<p>Two critical flaws in PHP (CVE-2026-109618 and CVE-2026-109619) allow attackers to take control of a web server without a password. What SMBs need to check right now.<\/p>","protected":false},"author":1,"featured_media":1771,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_swpsp_post_exclude":false,"footnotes":""},"categories":[16],"tags":[],"class_list":["post-1770","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-securite"],"_links":{"self":[{"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/posts\/1770","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/comments?post=1770"}],"version-history":[{"count":1,"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/posts\/1770\/revisions"}],"predecessor-version":[{"id":1772,"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/posts\/1770\/revisions\/1772"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/media\/1771"}],"wp:attachment":[{"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/media?parent=1770"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/categories?post=1770"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/servitiq.ca\/en\/wp-json\/wp\/v2\/tags?post=1770"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}