PHP2Shell: a critical PHP vulnerability hits WordPress and every PHP site, and attackers are already using it. Is my WordPress site affected? →

Engineering notes & release logs

What we shipped, what broke, and what we learned — from real products. See our apps Hire the team

Oct 232026
5 min read·Security

PHP2Shell: what to patch today and how we help

Updated October 27: on CISA’s exploited list, working exploits confirmed, PHP’s follow-up on upload progress and a regression in 8.4.27 and 8.5.12. Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, let an attacker run commands with one request, before your application starts. Exploited in the wild since October 21. The fixed versions, the stopgaps that buy time, the log lines that mean trouble, and how we patch and harden PHP sites.

securityengineering Read the post