Critical PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619): What Website Owners Need to Know
A severe security situation is unfolding across the web infrastructure landscape following the disclosure of two critical vulnerabilities embedded directly within the PHP core engine (tracked as CVE-2026-109618 and CVE-2026-109619, and widely referred to as "PHP2Shell").
Because these flaws target the underlying language interpreter rather than a specific plugin or theme, they affect the core runtime environment. Most notably, millions of WordPress websites, alongside sites running Drupal and Joomla, are directly exposed if they operate on vulnerable server configurations.
Government cyber security agencies—including the Canadian Centre for Cyber Security (CCCS / Cyber Centre)—and global security researchers have flagged these vulnerabilities due to the high risk of unauthenticated Remote Code Execution (RCE).
What are CVE-2026-109618 and CVE-2026-109619?
These critical memory-safety flaws exist in how PHP handles internal execution states and memory management:
- CVE-2026-109618: Involves how PHP handles out-of-memory errors during request processing, leading to potential use-after-free states and memory disclosure.
- CVE-2026-109619: Involves stale global states where internal request data survives after its backing memory is freed, paving the way for type confusion and code execution.
Rated with a severe CVSS score of 9.2, these bugs allow a remote attacker to send specially crafted requests to a vulnerable server and potentially execute malicious commands without needing any login credentials. Active exploitation attempts have been observed in the wild.
Are WordPress Sites Affected?
Yes. Because WordPress is written in PHP and powers an enormous share of the global internet, any WordPress site hosted on a server running an unpatched version of PHP is vulnerable.
It is vital to understand that updating your WordPress core, plugins, and themes is not enough. Even if your WordPress codebase is entirely clean and up-to-date, attackers can bypass application-level defenses because the flaw lives deeper down inside the server's PHP engine.
Official Guidance and Government Advisories
Security advisories have been published internationally, with national CERTs and agencies—such as the Canadian Centre for Cyber Security (CCCS)—urging immediate patch management and continuous monitoring. Official guidance emphasizes that temporary web application firewall (WAF) rules or mitigations are only stopgaps, and updating the underlying software package is the only complete remediation.
Action Plan: What Should You Do If Your Site Is Affected?
If you manage a website or server utilizing PHP, take the following steps immediately:
1. Check Your PHP Version
Log in to your hosting control panel (such as cPanel, Plesk, or your managed WordPress dashboard) or run a command-line check (php -v) to see which version of PHP your server is running. Versions affected include active branches prior to the emergency patches:
- PHP 8.5 (versions prior to 8.5.12)
- PHP 8.4 (versions prior to 8.4.27)
- PHP 8.3 (versions prior to 8.3.36)
- PHP 8.2 (versions prior to 8.2.35)
(Note: Older, end-of-life versions like PHP 8.1 and earlier will not receive official security updates from the PHP group, making upgrading to a supported, patched branch urgent.)
2. Update PHP Immediately
Contact your web hosting provider or system administrator to ensure your server packages are updated to the latest patched versions (8.5.12, 8.4.27, 8.3.36, or 8.2.35). Managed WordPress hosts are rolling out updates rapidly—verify with your provider that your environment has been secured.
3. Implement Stopgap Mitigations (If Immediate Patching is Impossible)
If you cannot patch your server environment right away, deploy temporary mitigations to reduce exposure:
- WAF Rules: Ensure your web application firewall (such as Cloudflare or enterprise WAF solutions) has activated rules blocking known exploit vectors (such as malformed multipart request payloads).
- Review Server Settings: System administrators have utilized configuration adjustments (like disabling session upload progress where applicable), though these are strictly stopgap measures and do not replace a true software update.
4. Audit and Monitor Your Logs
Because active scanning and exploitation attempts began prior to disclosure, review your web server and error logs for suspicious activities, unauthorized file modifications, or anomalous traffic spikes. If you suspect a server has been compromised, isolate it from public networks immediately while performing a forensic clean-up.