Your server runs PHP. PHP2Shell can run code on it — without a login.
Two critical flaws in PHP itself let an attacker run code on the server behind WordPress, Drupal, Laravel, Magento and other PHP sites. The patch is out. The question is whether your sites are on it yet — and who's watching the ones that aren't.
A flaw in the engine, not in your theme
On October 21, 2026 the PHP project shipped security releases for two critical vulnerabilities nicknamed PHP2Shell. They sit inside PHP's own request handling, so a site can be exposed even when its own code is clean. According to the PHP security team, a single unauthenticated request can trigger the attack before any application code runs.
Details leaked ahead of the coordinated release, proofs of concept are circulating, and security firms have reported exploitation attempts. For anyone running PHP, this is a patch-now situation, not a wait-and-see one.
RCE via out-of-memory corruption
Out-of-memory handling can interrupt PHP while internal request data is only partially initialized; request cleanup may then treat that invalid data as valid.
● CVSS v4.0 · 9.2 CriticalRCE via stale global state
Request-owned internal state can survive after its memory is freed, and a later request on the same worker may use it before normal initialization resets it.
● CVSS v4.0 · 9.2 CriticalWhy "my code is fine" isn't enough
- It's PHP core. The bugs live in PHP's request handling, not in your theme or plugins. A perfectly written application can still be exposed.
- No login required. PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed setups are all in scope; the PHP team rates mod_php as the highest risk.
- End-of-life PHP is worst. PHP 8.1 and older get no official release — only minimal source backports or vendor builds. PHP 8.2 security support ends on Dec 31, 2026.
If any of these run on your server, you are in scope:
The honest part: you can patch this yourself
We'd rather tell you straight. The complete fix is a PHP update on your server. Match your branch and move to the patched version:
| PHP branch | Affected | Update to |
|---|---|---|
| 8.5 | < 8.5.12 | 8.5.12 |
| 8.4 | < 8.4.27 | 8.4.27 |
| 8.3 | < 8.3.36 | 8.3.36 |
| 8.2 | < 8.2.35 | 8.2.35 |
| 8.1 and older | End of life | Upgrade branch / vendor backport |
The PHP project lists interim measures that reduce exposure. The simplest one, for the stale-state bug, goes in php.ini or the PHP-FPM pool, followed by a restart of every PHP worker:
session.upload_progress.enabled = 0This is not a complete fix — it doesn't address CVE-2026-109618, and setting it with ini_set() or a .user.ini file is not enough. The full list of mitigations is in the PHP project's announcement. Updating PHP is the only full remediation. On managed hosting, check with your host — many have already rolled out patched builds.
So why would you hire anyone? Because knowing the fix and shipping it safely across live production sites — on time, without breaking checkout, on hosts you may not fully control, including the end-of-life ones — is the actual work. That's where we come in.
Defensive, not dramatic
We don't sell panic. We keep your PHP sites patched, backed up and watched, so the next "patch now" advisory is a non-event for you.
Emergency patching
We update PHP across your sites to the fixed versions, verify nothing breaks, and confirm the exposure is closed.
Backup & rollback
A clean restore point before every change, so a bad update is a five-minute rollback, not a lost weekend.
Proactive monitoring
We track new CVEs for your stack and apply patches on a schedule — you hear from us before the headlines do.
Hardening & EOL plan
Sensible defaults, upload and session hardening, and a migration path off any end-of-life PHP you're still running.
Pick where you need us
Starting points — final pricing depends on how many sites and which hosts. The free check comes first.
Emergency Patch
- PHP2Shell patch applied & verified
- Pre-change backup
- Post-patch exposure report
- 48-hour turnaround
Managed Protection
- Everything in Emergency Patch
- Continuous CVE monitoring
- Scheduled patching & updates
- Daily backups + 1-click rollback
- Hardening baseline
Fleet
- Volume pricing across all sites
- Central patch dashboard
- Priority incident response
- EOL PHP migration support
- Named point of contact
Find out if you're exposed — in plain English
Tell us your site. We'll look at what it exposes publicly — server and PHP version where visible, CMS and plugin versions — and send back a short report: what we found, what it means, and exactly what to do next. No obligation.
Got it — your check is queued.
We'll review your site and email the report to the address you gave us, usually within one business day. If it's urgent, reply to our email and say so.
We couldn't send that.
Please check the fields and try again, or email your site address to hello@wordprex.com.