PHP2Shell Patches Ship as Attackers Probe WordPress Stores

PHP released emergency fixes on Oct. 21 for two critical remote code execution flaws, and security firms report attackers probing unpatched servers.

If your store, blog or landing pages run on self-hosted PHP (WooCommerce, WordPress, Magento, Adobe Commerce), you are the one who has to verify the fix. Updating WordPress does not update the PHP runtime underneath it, and a flaw at that layer works even when your plugins are clean. Owners who run Shopify for the storefront still need to check any WordPress blog or marketing site sitting beside it. I covered the scheduled release on Wednesday in my earlier PHP patch post, and the patch itself changes what you do next. This is the follow-up for the Ecommerce Paradise reader who owns a store, not a server.

Below: what PHP shipped and which versions are covered, why the release came a day early, where the evidence on active attacks conflicts, and a six-step checklist for this week.

Own the company behind the store: form your LLC with Northwest, the best LLC formation service for ecommerce owners. Northwest does not sell your address and puts its own on your public filings, which keeps your home out of the paperwork. Form your LLC with Northwest →

PHP2Shell Fixes: CVE-2026-109618 and CVE-2026-109619 Explained

PHP’s security team shipped the fixes around 14:00 UTC on Oct. 21, according to The Hacker News. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and PHP rates each 9.2 on the CVSS v4.0 scale. An early leak claimed a 10.0, but that was not PHP’s rating, per The Hacker News.

The two bugs work differently. BleepingComputer describes CVE-2026-109618 as an out-of-memory corruption chain that gives remote code execution as the web worker account. CVE-2026-109619 is a stale global state problem that enables a heap use-after-free, memory disclosure and code execution with the same privileges. Both stem from PHP leaving memory corrupted when a request ends abnormally.

Recorded Future’s Insikt Group analysis says Wiz demonstrated unauthenticated code execution against WordPress, Drupal and Joomla using the first flaw, and against Drupal and WordPress using the second. The PHP team rates Apache with mod_php as the highest risk. In its words, per BleepingComputer: “We consider the risk highest for mod_php.”

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get upstream updates. The project published minimal source backports for 7.4, 8.0 and 8.1, according to The Hacker News, and some distributions and long-term-support vendors ship their own backported fixes under older-looking version numbers.

Which versions are affected is not fully settled. The Hacker News says nearly every version back to 5.4 in any setup that serves web requests, including PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. CyberScoop reports CERT-EU saying every version from PHP 5 onward, and notes that neither the technical cause nor a full version list was officially confirmed when it published.

The exposure numbers are large and rough. VirusTotal counted about 5.1 million PHP-serving IP addresses, per Recorded Future. Only about 1.1 million disclose a version. Of those, roughly 758,000 run end-of-life branches (5.4 through 8.1) against roughly 272,000 on supported branches. About 85,000 ran the Sept. 24 releases, the newest before this fix. Those counts show exposure, not confirmed vulnerable hosts.

The evidence on attacks conflicts, so here is each side. Dane Knecht, Cloudflare’s CTO, said, “We are seeing early attacks emerging and are updating mitigations as new vectors show up,” per The Hacker News. That outlet also reports watchTowr citing “active exploitation attempts.” Kelly Shortridge, chief product officer at Fastly, told CyberScoop, “We see clear evidence attackers are actively probing and performing reconnaissance across PHP applications.”

On the other side, Jon Semon, principal security operations analyst at Huntress, said his team has “not observed, or independently confirmed, successful in-the-wild exploitation,” per CyberScoop. CISA said it had not observed exploitation as of that article’s publication. Recorded Future cites Patchstack reporting exploitation incidents from hosting partners before the patch shipped, and says the evidence does not establish how many compromises succeeded.

The UK’s National Cyber Security Centre told organizations to update PHP systems immediately or take them offline until patched, per BleepingComputer. Techaeris adds that government sites in the Netherlands and Finland went offline as a precaution, a claim I could not corroborate elsewhere.

How PHP2Shell Leaked a Day Early and Forced a Same-Day Patch

Details leaked on Oct. 20, ahead of a planned Oct. 22 disclosure, according to The Hacker News. PHP pulled the release forward. When I wrote my earlier post, PHP’s advisory had named no CVE, no component and no attack path, and watchTowr said it had reproduced one flaw while seeing no exploitation. Today the CVEs, the memory-safety causes and public proof-of-concept code all exist.

The discovery story is unusual. CyberScoop credits the AI security firm Calif, which used an OpenAI model, with finding the flaws. Wiz independently reported them too. A group of Wiz researchers wrote that AI means exploitation difficulty “is no longer a barrier,” per CyberScoop. OpenAI’s own blog post, quoted there, says “frontier AI found these vulnerabilities before attackers did.”

PHP flaws have a track record. CyberScoop notes that CISA’s Known Exploited Vulnerabilities catalog already lists three PHP flaws, two of which were used in ransomware campaigns. Neither of these two was in that catalog when The Hacker News checked.

The patch lands in a rough week for self-hosted WordPress stores. In the last few days I covered a backdoor in some Rank Math PRO downloads. I also wrote up stolen UpdraftCentral keys used to backdoor WordPress sites. Those were plugin-layer problems. PHP2Shell sits below the plugins, which makes it harder to dodge by trimming your plugin list.

There is a real counterpoint to the alarm. Huntress found no post-exploitation activity matching the public proof of concept on the Linux web servers it can see, and CISA had seen no exploitation when CyberScoop published. CyberScoop also warns that other exploit code in circulation is unverified and may itself carry malware. Many hosts will push the update on their own, per Techaeris, though it names none.

Adobe Commerce stores had their own critical scare a day earlier, which I covered in my BlockStrap flaw post. Stacking two critical patches in one week is where small teams slip.

What PHP2Shell Means for WooCommerce and WordPress Stores

My read: treat this as a same-day job if you self-manage anything, and a same-day question if you do not. The reason is cost asymmetry. A patch window costs you an hour of staging time. A compromised checkout server costs you orders, ad spend, card trust and possibly customer data.

Here is hypothetical math, not a reported figure. Say a self-hosted WooCommerce store collects $1,500 a day in orders and spends $300 a day on Google Shopping. A three-day outage while you clean a hacked server is $4,500 in missed orders. If the ads keep running to a dead checkout, add $900 of wasted spend. That is $5,400 before you pay anyone to clean up. The fix would have cost an hour.

Where you land depends on who controls PHP for you. There are three common cases.

On a managed host that owns the PHP runtime, your job is verification. Ask for the exact PHP version running on each site, in writing, and the date it was patched. Managed plans from hosts like Cloudways are meant to move this work onto the host’s team. Liquid Web pitches managed hosting the same way. I am not claiming any of them has finished patching today; that is the question to put in your ticket.

On an unmanaged VPS you run yourself, patching is yours, and so are the restarts. A managed VPS from Scala Hosting is one way to hand that job off if you would rather not own it. Managed WordPress plans at SiteGround are another. Wordfence warns, per Techaeris, that automatic updates will not apply the fix, so confirm who manages PHP on your server.

On PHP 8.1 or older, you have the sharpest problem. There is no official patch coming, only source backports the PHP project described as minimal. Moving to 8.3 or newer on staging first is the real answer. Plugin and theme compatibility is the usual snag, which is why I would start this week rather than at the next incident.

If you decide the server job is not worth your time, that is a legitimate business decision. Hosted platforms such as Shopify run the server layer for you. I broke down the tradeoffs in my WooCommerce pricing breakdown. Do not migrate platforms in a panic this week, though. Patch first, decide later.

The second-order risk is stacking. A store that is already running a backdoored plugin and an unpatched PHP runtime has two doors open. My security infrastructure guide for high-ticket stores covers the layers I would want in place: monitoring, access control, backups you have tested, and a payment backup. On that last point, the backup plan for your payment processor applies equally to a hosting outage.

Timing matters too. Black Friday ad budgets start climbing in the next few weeks, and a server problem in November costs more than one in October. My high-ticket Black Friday stress test is the checklist I would run after you patch.

Most high-ticket owners did not start a business to run servers. If you want the store built and operated by a team that handles this layer, that is what the turnkey done-for-you service exists for.

Patching protects the store you have. Want my team to scale the store you already have, on a stack that does not keep you up at night? See the scaling service →

PHP2Shell Patch Checklist for Store Owners This Week

Six moves, in this order:

List every PHP site you own: the store, the blog, landing pages, staging copies and forgotten subdomains. Old staging sites are easy to forget, and a forgotten install is an unpatched install. For each one, write down who controls PHP: you, your host, or an agency.
Ask each host, in writing, which PHP version each site runs and whether it includes the CVE-2026-109618 and CVE-2026-109619 fixes: 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a vendor backport that names the CVEs in its changelog. If you manage the server yourself, apply the update, restart PHP-FPM or Apache, and confirm the version afterward.
If your site runs PHP 8.1 or older, schedule a move to 8.3 or newer on a staging copy this week. Test checkout, shipping rate calculators and your payment gateway before you flip production.
If your host cannot patch today, apply the stopgaps BleepingComputer lists and restart all workers: set session.upload_progress.enabled=0, keep post_max_size low, and on PHP 8.5 set fatal_error_backtraces=0. These reduce exposure but are not a fix.
Check logs from Oct. 20 onward. The Hacker News lists the signals: unusual multipart requests followed by memory-limit errors or HTTP 500s, oversized PHPSESSID cookies, and unexplained worker restarts. If anything looks off, isolate the server, keep the logs, and rotate admin passwords and API keys.
Prepare for a bad day. Set uptime alerts on your checkout page, pause ad spend if checkout goes down, and pre-write the customer message in Gorgias and an order-status email in Klaviyo. Review my chargeback prevention guide too, because outages and delayed shipments are what trigger disputes.

If you would rather have a second set of eyes on how your store is set up, the discovery call is the fastest way to get one. A test of your checkout apps for hijacking is worth doing the same afternoon.

Frequently Asked Questions

Does PHP2Shell affect Shopify stores?
Not the Shopify storefront itself, since Shopify runs its own server layer. It does affect any WordPress blog, landing page or WooCommerce site you run on a separate host. Start with my guide to high-ticket dropshipping if you are still choosing a platform.

Will WordPress auto-updates fix it?
No. Wordfence warns that automatic updates will not apply the fix, per Techaeris, because PHP is the runtime under WordPress. Your host, server package or container image has to update it.

Which PHP versions have the fix?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no upstream updates, only minimal source backports for 7.4, 8.0 and 8.1, per The Hacker News. Some vendors backport fixes into older-looking version numbers, so check the changelog for the CVE.

Has anyone’s store actually been breached?
Sources disagree. Cloudflare and Fastly describe early attacks and active probing. Huntress and CISA had not confirmed successful exploitation when CyberScoop published. Patch as if it is happening, because the downside is lopsided.

Should I take my WooCommerce store offline?
The UK’s NCSC advised organizations to update immediately or take unpatched systems offline, per BleepingComputer. For a store taking orders, patching today beats going dark. If your host cannot patch and you cannot apply the stopgaps, ask your host about a temporary maintenance page. My WooCommerce dropshipping guide covers the setup trade-offs.

Is WooCommerce still worth running for a high-ticket store?
It can be, if someone owns patching. If nobody on your team does, compare it against managed WordPress hosts or a hosted platform. If you are still picking a product category, the free high-ticket niches list is a good place to start.

Want 1-on-1 coaching to fix the weak points in your high-ticket store before the holiday rush? Get the coaching details →

Some links in this post are affiliate links, which means I may earn a commission at no extra cost to you.

Patch first, then get back to selling. Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day.

If this was useful, these go deeper:

Trevor Fenner

Trevor Fenner is an ecommerce entrepreneur and world traveler from Seattle, Washington, and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.

He maintains homes in Seattle and Bali, spends most of the year overseas, and usually returns to Seattle for about a month each summer.