PHP2Shell: Is Your WordPress Server Actually Patched?

PHP2Shell puts the PHP runtime beneath your WordPress site on the emergency update list. On 21 October 2026, PHP released fixes for CVE-2026-109618 and CVE-2026-109619, vulnerabilities that can allow unauthenticated remote code execution. The practical question is whether the PHP process serving your site has received the fix.

A reassuring version number in a terminal is only part of that answer. This WordPress PHP security guide covers affected releases, what the research proves, and the evidence to request from your host before closing the update ticket.

The fix belongs in the PHP runtime serving the website. Verify that deployment with your host.

The short version

Facts and live status in this article were checked on 21 October 2026, US Eastern time. Sources and the KEV snapshot are listed below.

How PHP2Shell works

PHP normally keeps request data valid for the period in which the engine needs it. These flaws break that lifetime guarantee when processing is interrupted or internal state outlives its backing memory.

For the OOM-corruption flaw, an out-of-memory error can interrupt work while internal data is not ready for use. Cleanup can then act on invalid data. For the stale-state flaw, a worker retains a reference to memory belonging to an earlier request after that memory has been released. Both records describe routes to remote code execution.

The vulnerable boundary is inside PHP. The diagram shows component relationships, without an exploit sequence. PHP advisories

Credit matters here. Calif identifies researcher Ryan Austin as the author of its research. The CVE credits also recognize Wiz, OpenAI and the PHP developers who implemented remediation. This was coordinated work across researchers and maintainers.

What are the real exploit conditions?

The PHP announcement puts web-serving installations in scope, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It identifies mod_php as carrying the highest demonstrated risk.

The OOM advisory reports working remote code execution against mod_php before application code runs. That is why a WordPress login screen cannot be treated as the boundary protecting this path. The demonstrated execution uses the web worker's account; it is not automatically operating-system root access.

The FPM evidence needs careful wording. The PHP Foundation's release article reports application-level FPM code execution, while the OOM advisory still says no complete FPM exploit has been demonstrated for that SAPI. Separately, the stale-state advisory explicitly confirms session-lifecycle RCE against FPM. Those descriptions are not fully aligned. They do not support clearing FPM deployments as unaffected.

The stale-state advisory also explains that its demonstrated requests must reach the same worker. More workers can reduce success per request without removing the condition. Treat architecture as context for investigation, not an exemption from the update.

Threat status on 21 October 2026

Observed activity: watchTowr reports active exploitation attempts against both CVEs. Cloudflare independently reports attack traffic and changing payloads. These are primary observations of attacks; neither statement supplies a reliable count of compromised WordPress sites.

Evidence limits: Patchstack's timeline records hosting-partner incident reports at 07:34 UTC, then says its own telemetry at 13:57 UTC showed probing without hard evidence of breaches. The distinction between partner reports, observed attempts and confirmed compromise matters.

CISA KEV: neither CVE appeared in CISA's official JSON mirror, catalog 2026.10.21, when checked. The direct CISA feed rejected retrieval, so this check used CISA's own GitHub mirror. Absence from that snapshot does not contradict the attack reports.

Public PoC status: Calif's public research includes demonstrations, and Wiz describes its working exploit demonstrations. A proof of concept establishes that a technique works in a tested environment. It is not a harmless diagnostic to run against a production site. We did not execute an exploit or validate every script circulating under the PHP2Shell name.

Is my WordPress site affected?

Open Tools > Site Health > Info > Server. Record PHP version and PHP SAPI. WordPress documents the Site Health screen, and its server-information code identifies those fields. This checks the runtime handling that administrative request.

For supported upstream branches, compare the result with this table. The affected ranges come from the PHP CNA record; the fixes are confirmed in the release changelog.

Older PHP needs a host decision. The structured CVE ranges enumerate the supported branches. PHP's release notice separately directs users of 8.1 and older to a vendor backport or supported version, and supplies minimal source backports for 7.4, 8.0 and 8.1. The table is not clearance for omitted older versions.

For shell inventory, these commands are read-only. Use a trusted management shell and WP-CLI installation, outside any untrusted project configuration:

php -v
wp eval 'echo PHP_VERSION, PHP_EOL;' --skip-wordpress

The PHP manual documents the version check. The WP-CLI command prints its PHP version without loading WordPress. WP-CLI's environment documentation also warns that CLI configuration can differ from the web environment. A patched CLI result alone does not verify the site's PHP-FPM or Apache worker.

Ask your host to map the public site, administrative requests and other deployed instances to their actual PHP service. Where vendor packages backport fixes, request the package revision and advisory covering both CVEs. A base version string alone cannot establish whether that vendor fix is present.

Our recommended completion record combines the deployed package, running web service and a functional site check.

What to do

Apply the PHP security update first through your host or supported package channel. Use the fixed release for your branch, or a vendor build explicitly covering both CVEs. The PHP security notice is the authoritative starting point. Updating WordPress components remains normal maintenance, but these fixes belong to PHP.

Then ask the operator to restart or replace the affected web workers and verify the running build. watchTowr's remediation guidance explicitly includes worker restarts. Our recommended acceptance check is to reopen Site Health, confirm the host's package evidence, and test the site's normal login, forms and checkout where applicable. Keep a usable backup and a rollback plan during the change.

Here is a message you can paste into your hosting ticket:

Please confirm which PHP build serves example.com, including the public site and wp-admin. Does it include fixes for CVE-2026-109618 and CVE-2026-109619? Please provide the vendor advisory or package revision, confirm the affected workers were restarted or replaced, and identify any deployment still awaiting the fix.

If an immediate update is unavailable, have the host reduce external exposure while arranging it. PHP's temporary measures address particular paths and are incomplete. In particular, Calif warns that removing PHP's memory cap increases memory-exhaustion risk. Avoid applying configuration snippets without the operator reviewing their availability impact.

For agencies, keep a site-by-site record: hostname, owner, web runtime, package evidence, deployment time, verification result and unresolved exceptions. Our WordPress patch-gap article explains the value of checking that a patch actually reached a site. Here, include the host in that handoff.

Were you targeted?

Wiz's investigation guidance identifies unusual multipart traffic associated with memory-limit errors or repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID response cookies, and unexplained worker restarts. These are investigation leads, not signatures that independently prove PHP2Shell exploitation.

On exported, uncompressed log copies, our proposed triage filters are:

grep -nEi 'Allowed memory size|Out of memory|Maximum execution time|segfault' example.com-php-error.log
grep -nE '" 500 ' example.com-access.log

The second command assumes Apache Common or Combined log layout. Check your actual format before using it. Apache's documentation shows that standard access logs do not contain full request bodies or response cookies, so they cannot reconstruct every signal above. Correlate timestamps with retained proxy, WAF and host telemetry.

For an initial file inventory, run this from a preserved WordPress filesystem copy:

find wp-content/uploads wp-content/mu-plugins -type f -name '*.php' -print

The commands search and list without executing PHP. We tested them against harmless fixtures, including legitimate matches and empty results. Missing directories, permission errors and incomplete retention need to remain visible in the investigation record. A listed file may be legitimate; review its provenance and compare it with a trusted copy before removal.

We did not establish a CVE-specific malicious filename, hash or address from the primary sources used here. Do not substitute unrelated campaign indicators. If changes cannot be explained, follow WordPress's incident guidance: document symptoms, preserve a snapshot and involve the host. Ask the responder to review access and secrets as well as files. An empty search cannot establish that compromise did not occur.

Where PowerSEC fits

As checked on 21 October 2026, PowerSEC's pricing page lists local malware and vulnerability scanning plus core/plugin checksum verification in Free, and incident response runbooks in Pro Protection. These can support WordPress-side review; they do not establish that a host's PHP package is patched. The vendor's PHP update is the fix. For unexplained changes, request a PowerSEC assessment.

Bottom line

Make the update ticket specific: which site, which running PHP service, which fixed package and who verified it? Keep the compromise investigation as a separate task with its own evidence and limitations.

For WordPress owners, the next useful action is to contact the host with the request above. For agencies, collect that confirmation for each deployment and keep exceptions open until someone owns the remaining work.

Sources

All sources were fetched during this research run on 21 October 2026, US Eastern time. Technical documentation supplies background, not the news hook.

• PHP security announcement, dated 21 October 2026. Scope, fixes and temporary-measure limitations.

• CVE-2026-109618 and CVE-2026-109619, PHP CNA records published and updated 21 October 2026. Types, versions, score, vector and credits.

• PHP advisories: OOM corruption and stale global state, published 21 October 2026. Tested impact and conditions.

• PHP Foundation release account, Calif research and Wiz research, 21 October 2026. Research credit, demonstrations and technical context.

• watchTowr, Cloudflare and Patchstack, 21 October 2026. Observations and their limits.

• CISA's official KEV mirror, catalog 2026.10.21, released 21 October 2026.

• PHP changelog. Its release headings are dated 22 October 2026, while the announcement and Foundation account are dated 21 October. They agree on the fixed versions; this article uses the announcement as its dated news hook.

• Documentation: WordPress Site Health, server debug fields, WP-CLI environment information, PHP command-line options, Apache logs and WordPress incident response.

• PowerSEC pricing and assessment page, current product scope checked during this run.

KEV checked on 21 October 2026 against CISA's official GitHub mirror, catalog 2026.10.21: CVE-2026-109618 and CVE-2026-109619 were not listed in that snapshot. Primary sources nevertheless report active exploitation attempts.