On October 21, 2026, the PHP team released fixes for two critical vulnerabilities collectively named PHP2Shell. Both enable remote code execution and are rated 9.2 out of 10 under CVSS 4.0. They affect PHP 5.4 and later — which means WordPress, WooCommerce, Drupal, Joomla, Magento, Laravel and thousands of custom landing pages.
The good news: there is no mass worm like Log4Shell yet. Public exploits do not work against a default PHP installation, and an attack requires specific server conditions. The bad news: exploitation attempts were observed before the official patches were released, so updating is still urgent.
- What: two critical PHP RCE vulnerabilities.
- Who is affected: PHP 5.4+, WordPress, CMSs, landing pages, PBNs, custom sites.
- What to do: update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
- If you cannot update: temporarily block `multipart/form-data` and enable WAF rules.
What was found
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both are use-after-free bugs in the PHP engine. When a fatal error occurs — usually when a request exceeds `memory_limit` — PHP aborts the request but does not always clean up memory correctly. The next request or a reused worker may treat freed memory as live data.
The first bug is in the upload-progress handler. It can both execute code and return part of server memory in a response — potentially passwords, tokens, API keys and even TLS private keys from other requests. The second involves fatal-error backtraces and OPcache type confusion, and also leads to RCE.
The attack starts with a `multipart/form-data` request — the same format browsers use for file uploads. PHP parses the request body before application code runs, so applications with clean code are still affected.
Who is affected
The flaw is in PHP itself, not in a specific CMS. Sansec lists affected applications: Magento 2.4.9, WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Roundcube 1.7.4, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1 and WHMCS.
For affiliate teams this is especially painful for three reasons:
- Landing pages. Old promo pages often run on WordPress or custom PHP and are never updated.
- PBNs and site networks. The more projects you run, the higher the chance one server was forgotten.
- Paid traffic. If a landing page is compromised and redirects are injected, the budget keeps spending while conversions disappear.
Which versions are safe
| Branch | Safe version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 and older | No official patches, only distribution backports |
PHP 8.1 and older branches are end-of-life. Patches come from server software vendors: Ubuntu, Debian, Remi, CloudLinux, AlmaLinux and others. The official `php` Docker image will not get a fix for 8.1 or older — migrate to a supported branch.
How to check your PHP version
- Hosting panel. In cPanel, Plesk or DirectAdmin the PHP version is usually shown in the site or domain settings.
- Command line. `php -v` shows the CLI version, not necessarily the PHP-FPM/Apache version. Check the SAPI that actually serves the site.
- phpinfo(). A temporary `phpinfo()` file shows the version and settings, but do not leave it publicly accessible.
- WordPress. Tools → Site Health → Info shows the PHP version WordPress sees.
- Hosting support. The most reliable option: ask them to confirm the package is updated and contains CVE-2026-109618.
Updating WordPress, Drupal or plugins does not update PHP on the server. These are different layers.
What to do
- Back up the site and database before updating.
- Update PHP to a safe version via the hosting panel or package manager.
- Restart PHP-FPM or Apache — without a restart, workers may keep running the old code.
- Test the site: forms, file uploads, admin, checkout and key redirects.
- Check the SAPI. If you use Apache + mod_php, updating PHP-FPM may not fix the issue. Confirm which handler actually serves the site.
- Enable WAF and review logs for suspicious `multipart/form-data` requests.
- Update not only the main site but also old landing pages, test domains and PBNs.
If you cannot update right now
These are temporary measures, not a replacement for the patch. They buy time but do not fully close the issue.
- Block `multipart/form-data` at the nginx or Apache level. This breaks file uploads and may break checkout — test carefully.
- Disable `session.upload_progress.enabled` in php.ini or the PHP-FPM pool. This alone is not full protection, but it reduces the attack surface.
- Add WAF rules. AWS, Cloudflare and other vendors have published signatures; check with your provider.
- Restrict admin access by IP and enable two-factor authentication.
- Watch memory usage. Some temporary mitigations suggest `memory_limit = -1`, but that lets a single request consume all server memory. Do not leave it that way for long.
If the site is already compromised
- Pause paid traffic to the suspicious landing page so you do not burn budget.
- Check redirects, `index.php`, `.htaccess`, uploaded files and cron jobs.
- Rotate passwords, API keys, tokens and SSH keys.
- Check for new admin users and changes to DNS records.
- Restore from a clean backup and update PHP to the patch.
- Check the domain in Google Safe Browsing and notify your host.
Why this matters for affiliate marketing
A compromised landing page is not just “the site is down”. An attacker can inject redirects, hidden ads, form stealers or use the server for spam. If paid traffic is still flowing, you lose budget and partner trust, and the ad account may receive complaints and restrictions.
Pay special attention to projects that have not been maintained: old PBNs, test domains, landing pages for closed campaigns. They often stay online and remain an entry point.
FAQ
What is PHP2Shell?
It is the common name for two critical PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619. Both allow remote code execution under specific conditions.
How bad is it?
CVSS 9.2 is critical. But there is no mass worm like Log4Shell yet: public exploits do not work against a default installation and require specific server conditions.
Which PHP versions should I update to?
8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you run 8.1 or older, install a distribution backport or migrate to a supported branch.
Is updating WordPress enough?
No. The vulnerability is in PHP, not WordPress. You need to update the PHP version on the server.
Should I take the site offline?
Sansec does not recommend it. Updating PHP is sufficient. Take the site offline only if a compromise is confirmed or you cannot update and want to wait it out.
Can WAF alone protect me?
WAF is a temporary measure. The patch is still required: signatures may not cover every attack variant.
What about old PHP 7.4 landing pages?
Look for a backport from your host or distribution. If there is none, migrate to PHP 8.2+ or retire the page.
How do I know if the site is compromised?
Check redirects, new files and admins, `.htaccess`, DNS and cron changes. If the landing page has hidden links or unknown scripts, assume a compromise is possible.
Sources
Technical analysis: Sansec — PHP2Shell. Official releases: PHP.net. CVE records: CVE-2026-109618, CVE-2026-109619. WAF rules: AWS Security Bulletin. Timeline: watchTowr.