php2shell: the PHP vulnerabilities every WordPress site has to patch now

What php2shell is

CVE-2026-109618 is a flaw in how PHP recovers when a request runs out of memory: PHP can stop while internal request data is only partly set up, and the cleanup afterwards treats that broken data as valid. CVE-2026-109619 lets internal state from one request outlive its memory, so a later request handled by the same PHP worker can use it. The PHP project rated both 9.2 on the CVSS v4.0 scale, which is critical.

Every PHP installation that serves web requests is affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP project considers mod_php the highest risk, because it has a working exploit in which one unauthenticated request triggers the attack before any application code runs. Security researchers report that proof-of-concept code is already public, so expect automated attacks on every PHP site.

Which PHP versions fix it

Each supported PHP branch has one release that fixes both flaws (the table below). PHP 8.2 reaches end of life on 31 December 2026 and gets no security fixes after that, so if you're upgrading anyway, moving to 8.3 or later saves you a second upgrade soon.

PHP 8.1 and older no longer get updates from the PHP project. Some Linux distributions and long-term-support vendors provide backported fixes, and the PHP security team published minimal source backports for 7.4, 8.0 and 8.1 for people who build PHP themselves. For everyone else, the answer is an upgrade to a fixed release.

Why WordPress updates won't fix it

WordPress, its plugins and its themes are written in PHP, but PHP itself is installed on the server. Automatic updates, the Updates screen and security plugins can't change it. On managed or shared hosting, your host updates PHP; on your own server, it comes from your operating system's packages or wherever you installed PHP from.

How to check your site

In WordPress, open Tools → Site Health → Info and expand Server: the PHP version is listed there. If it's below the fixed release for its branch, the site is exposed.

One catch: if your PHP comes from a Linux distribution (Debian, Ubuntu, RHEL, AlmaLinux and others), the fix is often backported without changing the version number. A version like 8.2.7-1~deb12u1 can already be patched. Check your distribution's security notice for CVE-2026-109618 and CVE-2026-109619, or ask your host which build you're on.

If your host manages PHP, check their status page or ask them directly whether they've deployed one of the fixed releases. If you run the server yourself, take a backup, then install the updated packages from your distribution or vendor and restart PHP.

If you can't update today

The PHP project is clear that only an update is a complete fix. Its advisory lists settings that narrow specific attack paths while you schedule the update. Apply them exactly as written there, in php.ini or the server configuration rather than ini_set() or a .user.ini file, and restart every PHP worker.

For CVE-2026-109619 the main setting is session.upload_progress.enabled=0. For CVE-2026-109618 the advisory suggests memory_limit=-1, set where applications can't override it, together with a low post_max_size and a container or cgroup memory limit as a safety net. Read the advisory before changing memory limits: memory_limit=-1 removes PHP's own memory ceiling, which is why it's paired with an outside limit.

Be careful with quick fixes shared on forums and social media, such as edge scripts that promise to block the attack. At best they reduce exposure, and code from an unknown author that inspects every upload to your site is a risk of its own. The fix is updating PHP.

How Relvato flags it

Relvato's vulnerability monitor reads the PHP version a WordPress site runs on, through the Relvato plugin, and reports php2shell as a critical finding with the release to update to. On a site without the plugin, the exposure scan flags it when the server announces a vulnerable PHP version in its X-Powered-By header, and suggests hiding that header.

If your host patched a distribution build without changing the version number, confirm it with them and ignore the finding: it stays ignored on later scans.