PHP released emergency security updates yesterday for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell. Both allow unauthenticated remote code execution, and both live in the PHP engine itself rather than in any plugin or application. If you’re a Bangkok or Thailand business running a website, an online store or a booking system on PHP, this one deserves attention today rather than at your next maintenance window.
What’s actually in these two vulnerabilities
Both bugs are memory-safety flaws in how PHP handles fatal errors, usually an out-of-memory condition, in the middle of a request. CVE-2026-109618 is rated as remote code execution through out-of-memory corruption: PHP can be interrupted while internal request data is only partly initialized, and request cleanup then treats that invalid data as valid. CVE-2026-109619 is a use-after-free through stale global state: request-owned data survives after its memory has been released, and a later request handled by the same worker can use it before PHP resets it.
The PHP project’s own advisories are GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. Both are scored CVSS 4.0 9.2 (Critical). Red Hat scores CVE-2026-109619 lower, at 8.1 on CVSS 3, because exploitation needs a precise out-of-memory condition. NVD rates the same bug 9.8, and a public exploit chain already exists.
Who found it, and why the timing is so uncomfortable
The flaws were disclosed by PHP and Wiz Research, who used frontier AI models to help find the bugs, develop the exploit and validate the patch. Wiz’s view is that the flaws have existed for decades, but exploiting them took a chain of steps at the edge of what human researchers could manage, and AI models lowered that barrier. Details also leaked online on October 20, before coordinated disclosure and before patches were available. A public exploit tool combining both bugs into one login-free attack is already circulating, and Palo Alto’s Unit 42 counted over 22 million potentially vulnerable exposed instances.
Which versions are affected
Every PHP version from 5.4 through 8.5.11 is affected. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php setups facing the highest risk. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier are end of life and get no official releases, though the PHP security team has published minimal source backports for 7.4, 8.0 and 8.1 for people who build from source. Linux distributions received the patches ahead of the public release, so check your vendor’s packages first. If you use a volunteer-maintained repository such as remirepo, the advice is to switch to distribution packages or build from source, because it won’t have updates immediately.
How to check if you’re actually exposed
If your site runs PHP, you are almost certainly in scope. The real questions are which PHP version you run and whether your server has been patched. In WordPress, you can see the PHP version under Tools → Site Health → Info → Server. On the server itself, run php -v and check your PHP-FPM or Apache module as well, since they can differ from the command-line version. Distribution packages often backport fixes without changing the upstream version number, so check your vendor’s security advisory or package changelog before deciding you’re unpatched.
A static brochure site with no PHP is not affected. A hotel booking site, a WooCommerce store, a custom PHP application or a shared server hosting several client sites should be treated as urgent. Updating WordPress itself does not fix this, because the flaw is below the application layer.
What to actually do about it
- Update PHP now to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your distribution’s patched package, then restart PHP-FPM or Apache so the new version is actually loaded.
- Check for end-of-life PHP. Anything on 8.1 or older needs a vendor backport or an upgrade to a supported release, not just a routine update.
- Add a WAF layer while you patch. Cloudflare has deployed rules for the known exploit vectors to all customers, including the free plan. Treat this as a stopgap, not a fix.
- If you can’t patch immediately, consider taking the affected system offline, as the UK’s NCSC has advised, or restricting public access until it’s updated.
- Review logs and keep tested, offsite backups. Look for unusual PHP errors, memory exhaustion and unexpected files, because a fast rollback is exactly what an RCE scenario calls for.
How we handle this for our Clients in Thailand
At Sierra IT Group, a PHP engine-level flaw like this is exactly why we run ongoing WordPress maintenance packages rather than leaving updates to chance. Every site we manage gets server, PHP, core, plugin and theme updates applied promptly, with monitoring and tested backups in place before anything changes. Our fully managed WordPress hosting adds hardened server configurations and firewall rules on top, and if a site has already been compromised, our malware removal and recovery team gets it cleaned up and back online fast. If you’re not sure which PHP version your site is running, get in touch and we’ll check it for you.