Two critical PHP vulnerabilities dropped Tuesday. Security researchers are calling them PHP2Shell. CVSS score of 9.2 out of 10. Every website running PHP is technically affected.

If you’re a small business owner with a WordPress site, you’ve probably already seen the news and started wondering whether your site is about to get hacked. Short answer: if you’re on managed or shared hosting with a reputable provider, you’re almost certainly fine. You don’t need to do anything right now.

What PHP2Shell Is

Two separate vulnerabilities, disclosed October 21 by the PHP security team (PHP.net advisory).

CVE-2026-109618 is an out-of-memory corruption bug. When a PHP server runs out of memory mid-request, cleanup code treats partially-initialized data as valid. An unauthenticated attacker can trigger this with a single web request, before your WordPress code ever runs. Affects Apache with mod_php and PHP-FPM.

CVE-2026-109619 is a use-after-free bug. A fatal error at exactly the wrong moment can leave a PHP worker pointing at memory from a previous request. The next request reads freed memory. Researchers at OpenAI and Wiz independently demonstrated working remote code execution from this bug back in August 2026, according to the PHP Foundation blog.

Both sit at CVSS 9.2 and allow unauthenticated remote code execution. They were patched the same day they were disclosed: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are the fixed versions.

The root cause of the OOM bug was spotted during a 2024 PHP security audit funded by the Sovereign Tech Agency. No working exploit was found at the time. It took until August 2026 for independent researchers to get there.

Why the Disclosure Got Messy

The CVE IDs leaked two days early. Then security firm Chainguard published technical details more than six hours before the coordinated embargo lifted, according to the PHP Foundation’s post-mortem. That gave attackers an earlier start than intended.

CISA issued an alert urging immediate patching, but noted it had not observed exploitation in the wild at time of publication. Cloudflare and watchTowr both reported early exploitation attempts after the embargo broke.

CERT-EU published a security advisory the same day.

What This Means If You Run WordPress on Shared Hosting

PHP is the language WordPress runs on. So yes, your site is affected. But the patching responsibility here falls almost entirely on your hosting provider, not you.

Major shared hosting platforms run CloudLinux, which confirmed backports for every PHP version from 5.2 through 8.5. That includes PHP 8.1 and older, which the official PHP project doesn’t support anymore. Your host almost certainly runs a version of PHP that has already received, or is actively receiving, these patches.

Tenable’s FAQ on PHP2Shell lays out the technical exposure clearly: the attack surface is the web server layer, not the application layer. That’s your host’s infrastructure. If they’ve applied mitigations or patches (and most have by now), requests never reach the vulnerable code path.

What You Should Actually Do

If you’re on managed WordPress hosting: Check your host’s status page or advisory notices. Most reputable hosts issued communications Tuesday. If they’ve confirmed mitigations are in place, you’re done.

If you manage your own VPS or server: Patch immediately. PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, whichever version you’re on. If you’re still on PHP 8.1 or older, look for vendor-provided backports (CloudLinux has them) or use this as the push to upgrade your PHP version, which you should have done months ago.

Regardless of your setup: This is a good reminder to confirm your site has automatic updates turned on for WordPress core and plugins, and that you know who’s responsible for patching your PHP version. If you don’t know the answer to that second question, call your host today.

The Bigger Picture

These vulnerabilities are a reminder that the web’s critical infrastructure runs on code that’s decades old, maintained by a relatively small team, partly funded by foundations and tech-agency grants.

The 2024 audit that first spotted the OOM issue was funded by the Sovereign Tech Agency as part of broader investment in open-source infrastructure security. The exploit still took two more years and independent researchers to weaponize, but the audit put it on the map.

Patches are out. The coordinated disclosure, despite the early leak, worked. For most small business owners with managed hosting, the critical window has already closed. Check your host’s status page, confirm mitigations are in place, and move on.

More hot takes: Hot Takes →

📬 The SmallBizAI Brief

One practical AI tip for Australian small business. Every Tuesday. Free.

Join business owners getting smarter about AI every week.

Subscribe free →