PHP2Shell: A Flaw in PHP Itself Lets Attackers Take Over a Site Without Logging In
PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21. They fix CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (CVSS 4.0), which allow code execution on the server without logging in. The flaw is in PHP itself, so almost any WordPress site is exposed, whatever its version. Wiz showed working attacks on current WordPress, Drupal and Joomla images, and Patchstack logged exploitation reports hours before the patches were published.
The fix is a PHP update, and WordPress.org says no core update is needed. Managed hosts will do it for you, while on a VPS it’s up to you. PHP 8.1 and older got no release at all. PHP suggests setting session.upload_progress.enabled=0 as a stopgap, but calls updating the only safe choice.
