On October 21 the PHP project shipped emergency patches for two flaws now going by the name PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 on CVSS v4.0. Both are unauthenticated remote code execution, which in plain words means an attacker runs their code on your server without logging in to anything. No stolen password, no phishing email, no insider. They send a request and the server does what they say.
The details leaked a day before the coordinated release. By the time the patches were public, attack traffic was already moving. Cloudflare says its firewall began blocking exploit attempts about nine hours before disclosure, and its CEO put the volume at tens of thousands of attempts in the first 45 minutes after the announcement, climbing into the millions. Amazon says it saw probing as early as October 17. No confirmed breach has been reported as of this writing, and neither CVE has been added to CISA's Known Exploited Vulnerabilities catalog as of this writing. That is the state of things today, not a forecast.
Who this is actually about
This is not a WordPress bug or a plugin bug. It is in PHP itself, which means it can reach any way PHP serves a web request: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed. If your site is WordPress, Joomla, Drupal, WooCommerce, Magento, or anything hand-built in PHP, the question is not whether your CMS is current. The question is which PHP version the server is running and whether anyone has updated it since the patches landed.
For a lot of businesses the honest answer is that nobody knows. The site was built once, handed over, and left running. There is no operator. There is a hosting login somebody has, a theme that still works, and a PHP version nobody has looked at in two years.
A firewall in front of it is not the fix
If you run behind Cloudflare or a similar service, some share of the attempts are being filtered for you right now, and that is worth something. It is not the fix. Cloudflare says plainly that attackers started changing their payloads to get past the new rules, which is what always happens: the rule describes the attack as it looked an hour ago. The vendors shipping those rules say so themselves. Patching is the only permanent answer.
The same goes for the partial mitigation circulating for CVE-2026-109619, turning off session upload progress. It closes one confirmed path. It does not close the flaw.
What to do
Update PHP to the patched release for your branch, then restart every worker so the new binary is actually the one serving requests:
- PHP 8.5 → 8.5.12
- PHP 8.4 → 8.4.27
- PHP 8.3 → 8.3.36
- PHP 8.2 → 8.2.35
If you are on managed hosting or a platform, confirm the patched build has actually been rolled out to your account rather than announced. "We are aware and monitoring" is not a patched server.
If you are on PHP 8.1 or older, there is no supported release coming for you. The PHP security team published source backports for 7.4, 8.0 and 8.1 for people building from source or waiting on a vendor, which means someone has to apply them and rebuild. That is a real job, and it is the moment to ask whether running an unsupported PHP branch in production is a position you want to be in the next time this happens.
We patch it. $1,000, 48 hours or less.
If reading the list above told you that you have no idea who would do any of it, that is the problem we solve.
Type FIXPHP into the chat at pixelworkers.org. Give us the site address and an email, and you get a quote on the spot at one set price that you can pay in the chat. Paying it starts the clock. We read every dependency and entry point for the PHP2Shell class of flaw and anything shaped like it, write and apply the patch, verify the fix against the way in, and send you a short note of what was open, what changed, and anything left for you to decide. A person reviews it before it ships. $1,000 flat, patched in 48 hours or less from the day we start.
We cannot promise in advance what we will find on your server. We can promise that Nora has eyes on it now rather than next quarter, and that you get the written record of what was found either way.
These flaws are ordinary in the only way that matters: the patch exists, and the sites that get hit will be the ones where nobody applied it.
Sources: PHP changelog · BleepingComputer · The Hacker News · SecurityWeek · Check Point
