PHP2Shell: Attacks Seen After PHP Patch, What to Do

On October 21, 2026 at 14:00 UTC, PHP shipped fixes for two critical flaws now known as PHP2Shell. They can let an attacker run code on a server without logging in. Cloudflare says it saw attack traffic after details leaked. Any site running on PHP, including WordPress and Drupal sites, should check its version today.

What we know

Fixed versions: according to the php.net advisory of October 21, they are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The flaws are CVE-2026-109618 and CVE-2026-109619.
Who is exposed: php.net says all installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php.
Old branches: PHP 8.1 and older no longer get updates from the project. Given the severity, php.net published minimal source patches for 7.4, 8.0 and 8.1 for people who build PHP themselves or lack a long-term-support vendor.
The leak: the PHP Foundation says the CVE IDs began circulating on October 20 around 15:00 UTC, with a wrong release time and a wrong score (10.0 instead of 9.2). It moved the release forward one day, from October 22 to October 21.
The attacks: Cloudflare says it observed attack traffic against its customers after the leak. The PHP Foundation says that, at release time, it had not identified any working exploit. Neither source gives a number of compromised sites.
Cloudflare's rule: according to its blog, since 03:02 UTC on October 21 every plan with its web application firewall (WAF), including Free, is protected by default. It still tells customers to patch PHP.
How it was found: the PHP Foundation says the first signs appeared in 2024, but the fix stalled for months, which it calls a structural failure. On August 11, 2026, security firm Calif and OpenAI separately reported the same root cause. OpenAI says Calif found it with OpenAI's GPT-5.6 Sol model.

What changes and what doesn't

Until yesterday the advice was to prepare. Now the patch exists and the job is to apply it.

Cloudflare stresses that the bug is in PHP itself, not in site code. Updating WordPress, Drupal or plugins does not fix it: PHP on the server has to be updated.

Cloudflare's rule helps only if your traffic goes through Cloudflare, and the company calls it an extra layer, not a replacement for the patch. The same goes for the temporary settings php.net lists: they reduce exposure but, in the advisory's words, do not make an installation safe.

Expect more of this. OpenAI says these flaws are among "several significant vulnerabilities" it has already found, and that it expects such findings to rise sharply in the coming months. The PHP Foundation says it has published 15 CVEs since July 1.

What to do today

Check your PHP version. In WordPress: Tools → Site Health → Info → Server. In Drupal: Reports → Status report. Most hosting panels show it in the PHP version selector.
Compare it with this list:

- 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later: you are on a fixed release.

- A lower 8.2 to 8.5 release: update within your branch.

- 8.1, 8.0 or 7.x: there is no official release; ask your provider for a patched package or plan a move to 8.3 or 8.4.

On shared hosting, ask today: "Have you applied the October 21 PHP security release (CVE-2026-109618 and CVE-2026-109619) on my plan? If not, when?" The version shown in your panel may not change if the host applies its Linux distribution's patched package.
If your site sits behind Cloudflare, make sure the WAF is on. On paid plans, Cloudflare asks customers to confirm its managed ruleset is in block mode.
On a VPS or your own server, whoever runs it should install the distribution's fixed packages today and restart PHP.
After updating, load your key pages, test forms and checkout, and watch Search Console for a rise in server errors.
Set up a routine. If urgent patches become more frequent, decide who updates PHP, the CMS and plugins, how fast, and keep recent backups.

Sources

Updates: no changes since publication.