FarolCyber
News

Two critical PHP flaws threaten millions of sites, including WordPress; update now

The flaws let attackers run code on servers running PHP and are already being exploited. Who is at risk and which versions carry the fix.

By the FarolCyber desk
Published on · 2 min read

Illustration of website windows with cracked PHP code, a red alert and a server with warning lights.
Illustrative image.

If you have a website, an online store or a blog, ask your host whether PHP has been updated. Two critical flaws, announced on October 21, hit nearly every PHP version released in the past decade, and attacks are already under way.

How big the problem is

The flaws, CVE-2026-109618 and CVE-2026-109619, let an attacker run code of their choosing on a vulnerable server. According to Krebs on Security, they affect web servers running PHP 5.4 or later. Wiz says every version released in the last ten years has at least one of the two (Wiz is an advertiser on the blog, which the article discloses).

PHP runs underneath platforms such as WordPress, Drupal, Joomla and Magento. Censys found about 2.58 million internet-facing hosts and 54.9 million web properties running PHP. About 70% of sites, per the report, need core software updates. Wiz compares the case to Log4Shell in 2021.

Already being exploited

Working exploits exist, and Cloudflare said it detected attack attempts and turned on firewall rules. Wiz expects mass attacks to install web shells, programs that give an intruder remote control of a site. Reuters reported that government websites in Europe and elsewhere went offline after the disclosure. OpenAI, which took part in the research, called the case “one of the most impactful security issues in recent memory.”

The fix

PHP released an emergency update the same day. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and Ubuntu has already published new packages. Wiz warns that many organizations will take a while to patch, because PHP is embedded in everything. Censys set up a tracker at php2shell.censys.com.

How to protect yourself

  1. Find your site’s PHP version in the hosting panel and update to one of the fixed versions. If your host manages it, ask when it will be done.
  2. Update WordPress, themes and plugins to the latest version.
  3. Turn on a web application firewall, such as Cloudflare’s, which gives some protection until you update.
  4. Back up your site now, preferably off the server.
  5. Look for odd files in the site folder, such as scripts you did not create, and change admin passwords if you find any.

Original source

Read next