PHP2Shell: why updating WordPress won't fix this one

If your website runs on WordPress, your first instinct this week may be to click “Update”. This time, that won’t fix the problem.

On 20 October, details of two critical flaws in PHP leaked before a fix was ready. They’re officially numbered CVE-2026-109618 and CVE-2026-109619, and have been nicknamed PHP2Shell. The PHP project released its fix early, on 21 October. The flaws sit in the engine underneath your website, not in WordPress or your plugins, so the fix has to happen on the server.

PHP is the programming language running underneath most WordPress, WooCommerce, Drupal and Joomla sites. It also powers many online shops, client portals and intranets, including ones you may not think of as “websites”.

On an unpatched server, an attacker can run their own code without ever logging in. In practical terms, that can mean:

• customer or employee data copied off the server
• your website defaced or used to spread malware
• a foothold from which the attacker moves into the rest of your network

This isn’t only a European story

One search found more than 9,800 internet-facing PHP servers in South Africa. Afrihost, 1-Grid and Xneelo have already written to their customers about it.

Security firms saw the first attack attempts before the fix was even published, and attackers are still trying these flaws against servers that haven’t been updated. If you haven’t had confirmation that your servers are patched, assume they aren’t.

What to do now

1. Find every server running PHP in your business. That includes your website, client portal and intranet, and anything a supplier hosts for you.
2. Get written confirmation from whoever hosts each one that PHP is on a fixed release: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. A verbal “we’re on it” isn’t enough.
3. On PHP 8.1 or older? There’s no official fix coming. Upgrade, or take the site offline until you can. That’s also the advice of CISA, the US government’s cybersecurity agency.
4. Check the devices that carry PHP inside them. Some firewalls and network appliances do, and their makers are publishing their own updates.
5. Ask your host or IT provider to check the server logs for anything unusual since 17 October, and to keep watching.

A web application firewall (a filter that sits in front of your website and blocks suspicious requests) can stop many of these attempts and buy you time. It doesn’t replace the update. It won’t catch every attack, and attackers keep producing new variations that slip past the filters. Treat it as a seatbelt, not a substitute for fixing the server.

If something has already gone wrong

The National Cybersecurity Hub is South Africa’s official incident response team for businesses, and the place to report an attack. If there’s reason to believe personal information was accessed, POPIA (the Protection of Personal Information Act) requires you to notify the Information Regulator and the people affected as soon as reasonably possible. Don’t wait for certainty before getting advice: the clock starts when you have reasonable grounds to suspect a breach

Our team has already checked and patched your environment. You don’t need to chase anyone. If a supplier hosts something for you outside our environment, let us know and we’ll help you get the confirmation in writing.

Not sure where you stand?

Find out before an attacker does. Our free, zero-commitment assessment checks whether your environment is exposed and gives you a plain-language picture of what needs fixing.

Check if you’re vulnerable: request an assessment →