PHP2Shell is a serious PHP security issue that can affect WordPress websites through the software running underneath them. Keeping WordPress and its plugins updated is still essential, but these vulnerabilities require attention to the server’s PHP runtime as well.
Web V8 has applied PHP2Shell patches to the affected PHP hosting systems we manage. Here is what the issue means for website owners, which PHP releases contain the fixes, and why the separate Node.js security update also matters.
What is PHP2Shell?
PHP2Shell is the name used for two critical vulnerabilities disclosed in October 2026: CVE-2026-109618 and CVE-2026-109619. Both concern PHP’s handling of memory and internal request state. Under the right conditions, an attacker can execute code without first logging into the website.
- CVE-2026-109618: memory exhaustion can leave PHP’s internal data in an unsafe state during request processing and cleanup.
- CVE-2026-109619: a worker can retain references to memory from an earlier request after that memory has been released. A later request can encounter that stale state.
The exact exposure depends on the PHP version, server setup and application behaviour. The PHP Foundation describes the underlying issues in its security release explanation; the first advisory and second advisory provide the technical detail.
Why WordPress websites can be affected
WordPress runs on PHP. Researchers demonstrated PHP2Shell attacks against WordPress, as well as other PHP applications. This is a vulnerability in PHP itself, so a fully updated WordPress installation can still be exposed when its underlying PHP runtime is vulnerable.
Successful exploitation can allow code to run with the PHP worker’s permissions or expose sensitive process memory. That can put website files, credentials and other data at risk. It does not automatically mean the attacker has administrator access to the entire server. See the researchers’ PHP2Shell explanation.
Web V8’s PHP2Shell patch update
We have patched the affected PHP hosting systems under our management. The scope of this update is the PHP2Shell vulnerabilities described above; it should not be read as a claim that every application or server is immune to every security issue.
If Web V8 manages your hosting and you want confirmation for a particular website, contact our team. If you manage a separate server or deployment yourself, check its runtime independently rather than assuming a change to another hosting service covers it.
Which PHP versions contain the fixes?
PHP2Shell fixes are available in the supported PHP releases below and through documented backports for PHP 7.4, 8.0 and 8.1. The table includes the first fixed upstream releases and verified examples of patched legacy packages. Use the latest security update available from your PHP vendor.
| PHP branch | Fixed release or package | Fix type |
|---|---|---|
| 7.4 (EOL) | 7.4.33 — built 21 October 2026 | Plesk for Linux backport |
| 8.0 (EOL) | 8.0.30 — built 21 October 2026 | Plesk for Linux backport |
| 8.1 (EOL) | 8.1.34 — built 21 October 2026 | Plesk for Linux backport |
| 8.2 | 8.2.35 | First fixed upstream release |
| 8.3 | 8.3.36 | First fixed upstream release |
| 8.4 | 8.4.27 | First fixed upstream release |
| 8.5 | 8.5.12 | First fixed upstream release |
PHP 7.4, 8.0 and 8.1 also have backported patches. Although these branches are end-of-life, the PHP security team provided minimal source backports for PHP2Shell. Participating hosting vendors and Linux distributions can supply their own patched packages. Availability depends on the vendor and platform; the source backports are not new standard upstream releases. See PHP’s official security advisory.
An unchanged version number does not necessarily mean PHP is unpatched. For example, Plesk’s Linux update retained PHP 7.4.33, 8.0.30 and 8.1.34, with its advisory identifying fixed builds dated 21 October 2026. Those build details apply to Plesk’s packages, not every vendor. Check your provider’s package release, build information or changelog to confirm the fixes are included. These patches do not restore general upstream support for an end-of-life PHP branch. Read Plesk’s advisory.
Update the runtime actually serving each site, then restart or replace the relevant services and workers. Updating WordPress alone does not perform that server update. Firewall rules can help reduce exposure, but they are not a substitute for the PHP security update.
Follow the latest PHP announcements too. PHP published additional guidance on 23 October for a separate session upload-progress issue, CVE-2026-115560, involving an unusual combination of configuration and application code. Its advice includes disabling session upload progress where applicable. Treat follow-up guidance as separate from confirmation that the original two PHP2Shell flaws were patched.
What about Node.js and Node2Shell?
Node2Shell is a separate vulnerability, not PHP2Shell spreading into JavaScript. Tracked as CVE-2026-111497, it affects the Brotli decompression code bundled with Node.js. Malformed compressed data can corrupt process memory, potentially causing a crash, memory disclosure or remote code execution when an application decompresses attacker-controlled input.
The Node.js project rated the issue high severity and released fixes on 21 October 2026. The first fixed releases are 22.23.4, 24.22.1 and 26.12.1. Move unsupported deployments onto a supported, patched release and restart or redeploy the running application. See the official Node.js security release.
Exposure depends on what the application does. Relevant paths can include decompressing responses through fetch(), accepting compressed request bodies through Express middleware, or using Brotli APIs directly. Simply having JavaScript in a WordPress theme does not establish that the website is exposed to this Node.js flaw. Akamai’s analysis explains those application paths.
A PHP upgrade does not update Node.js. Review Node.js services, containers and deployment environments separately. This article’s Web V8 patch confirmation relates to PHP2Shell; it is not a blanket Node.js patch confirmation.
What website owners should do now
- Ask your hosting provider which PHP runtime serves your website and whether it contains the PHP2Shell fixes.
- Keep WordPress, themes and plugins current alongside server updates.
- Review any Node.js applications separately and deploy a patched supported runtime where needed.
- If compromise is suspected, investigate it. Applying a patch prevents the covered vulnerability from being used again; it does not remove a backdoor or reverse an earlier breach.
For help confirming your Web V8 hosting setup, get in touch. Security guidance and version references checked on 27 October 2026.
