If you run a website, you may have had an urgent email from your host this week, or seen headlines about a "WordPress security risk". Something serious did happen, but the headlines don't always get the detail right. Here's a plain-English rundown, based on what the PHP project, national security agencies and security firms had published by 23 October 2026. It's a fast-moving story, so check your host's own updates too.
The short version
- On 21 October 2026, the PHP project released emergency updates for two critical flaws in PHP itself, now nicknamed "PHP2Shell".
- They're tracked as CVE-2026-109618 and CVE-2026-109619. The PHP project rates each one 9.2 out of 10 for severity, and the US National Vulnerability Database scores them 9.8 and 8.1 respectively.
- An attacker doesn't need a login. In the worst case, they can run their own code on the server.
- It's a PHP problem, not a WordPress problem. Any site or app running on an unpatched version of PHP is affected.
What is PHP, and what went wrong?
PHP is the programming language that runs on a web server and builds pages as people visit them. WordPress runs on it, and so do Drupal, Joomla, Magento, WooCommerce and Laravel. Think of PHP as the engine, and WordPress as one of many cars built around it. This week's problem is in the engine.
The PHP team describes two related bugs, both about how PHP tidies up its memory when a request goes wrong:
- CVE-2026-109618: if a request hits PHP's memory limit at exactly the wrong moment, PHP can leave half-built data behind and later treat it as valid.
- CVE-2026-109619: after certain errors, PHP can hang on to memory that has already been freed, and the next request can use that leftover data.
The PHP project says every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest on mod_php, where a single request with no login could set off a demonstrated attack before the website's own code had even started.
Which versions are affected?
According to the PHP project's advisories:
- PHP 8.5: versions before 8.5.12
- PHP 8.4: versions before 8.4.27
- PHP 8.3: versions before 8.3.36
- PHP 8.2: versions before 8.2.35
- PHP 8.1 and older: also affected, and no longer supported by the PHP project, so there's no official fixed release (some hosts and vendors have shipped their own patched builds)
Some hosts patch PHP without changing the version number you see, so an older-looking number doesn't automatically mean you're exposed.
Is it being exploited?
The sources don't all say the same thing yet:
- Details leaked on 20 October, the same day the PHP team announced its fix, which was released slightly ahead of its scheduled time on 21 October.
- Security firm watchTowr says it has seen exploitation in the wild since 21 October. Patchstack reported incidents passed on by hosting partners, and Cloudflare said it was seeing early attacks.
- When the US agency CISA published its alert on 21 October, it hadn't observed exploitation yet, but it still urged everyone to patch immediately.
So it's worth treating as urgent, but a warning isn't evidence that any particular site has been hacked.
So, is this a WordPress problem?
Not really. WordPress.org's own announcement says these vulnerabilities "are not specific to WordPress and affect any server that hosts a PHP application", and that "no WordPress update is required or planned".
WordPress gets the headlines because it's the most widely used PHP application, so it has the most site owners affected. The fair summary: WordPress core, plugins and themes aren't at fault, but every WordPress site runs on PHP, so every WordPress site on an unpatched server is exposed until PHP is updated. Updating WordPress or plugins won't fix it. Only a PHP update on the server will.
If you're on WordPress, the one thing to do is ask your host to confirm the PHP serving your site is patched for both CVEs. WordPress shows your PHP version under Tools > Site Health > Info > Server.
What about Webflow sites?
We build exclusively in Webflow, so we'll be upfront about our bias. Webflow says its hosting is fully managed, with "no updates to run, packages to install, or capacity planning", and that it monitors for vulnerabilities and deploys updates automatically. That means Webflow site owners had no PHP version to check this week.
That doesn't make Webflow immune to security risks. No platform is. Account security and any third-party scripts you add still matter, and you're trusting Webflow to do the patching. What it does is take server maintenance off your plate.
A flaw like this is a good reminder of how much quiet upkeep a self-hosted site needs. We've written a separate guide to the ongoing maintenance behind a WordPress site, and how it compares with Webflow. For the bigger picture, see Webflow vs WordPress. If you're considering a move one day, start with our WordPress to Webflow migration guide. Just don't rush it in a panic: patch first.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the nickname for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, fixed by the PHP project on 21 October 2026. They can let an attacker with no login run code on a server running an unpatched version of PHP.
Is WordPress affected by PHP2Shell?
WordPress itself doesn't contain the flaw, and WordPress.org says no WordPress update is required or planned. But WordPress runs on PHP, so any WordPress site on an unpatched PHP version is at risk until the server's PHP is updated.
Is PHP2Shell being exploited?
watchTowr and Patchstack have reported exploitation and attack attempts since 21 October 2026. CISA hadn't observed exploitation when it published its alert that day, but it urged everyone to patch immediately.
Are Webflow sites affected by PHP2Shell?
Webflow site owners don't need to update PHP, because there's no PHP server for them to run. Webflow says it manages hosting updates and monitors for vulnerabilities itself. Webflow isn't immune to every risk, so account security and third-party code still matter.
Photo by Pixabay on Pexels.
