October 21, 2026 | Double-Helix LLC | Security Advisory
Two critical vulnerabilities in PHP, collectively known as PHP2Shell, are prompting an urgent security response across the internet.
PHP powers a substantial portion of the web, including popular content management systems and e-commerce platforms such as WordPress, Drupal, Joomla, and Magento. These vulnerabilities affect the underlying PHP runtime—not simply individual applications or plugins.
The flaws could allow unauthenticated attackers to directly execute malicious code on vulnerable web servers, potentially compromising sensitive information and using affected servers as a foothold to attack other systems within the organization.
Both vulnerabilities carry a CVSS 4.0 severity score of 9.2 (Critical):
- CVE-2026-109618 – Remote Code Execution via Out-of-Memory Corruption
- CVE-2026-109619 – Remote Code Execution via Stale Global State
Websites and Hosting Providers Respond
Website operators, hosting providers, and security vendors are moving quickly to deploy emergency patches and protective measures. Some commercial websites and online services have been temporarily taken offline as a precaution.
Cloudflare has confirmed that it deployed PHP2Shell-specific Web Application Firewall (WAF) protections ahead of public disclosure, including protections for customers on its Free plan.
Major cloud infrastructure providers, including AWS, Google Cloud, and Microsoft Azure, also participated in the coordinated response, including updates to AWS WAF, Google Cloud Armor, and Microsoft Azure WAF.
- Read Cloudflare’s October 21 security announcement
- See Microsoft’s PHP2Shell advisory and Azure WAF mitigations
- Google’s PHP2Shell Security Bulletin
Security researchers have demonstrated working exploits, and Cloudflare has reported observing attack traffic targeting its customers. Additional website disruptions may occur as emergency maintenance and patching continues.
Who Is Affected?
Organizations operating PHP-based websites or applications should assess their exposure immediately, particularly internet-facing systems. This includes websites built on WordPress, Drupal, Joomla, Magento, and other PHP-based platforms.
The following PHP security updates are available:
| PHP Branch | Fixed Version |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
Older or unsupported PHP versions may require vendor-supported security patches or migration to a supported release.
Importantly, upgrading WordPress or its plugins alone does not address these vulnerabilities. The underlying PHP runtime must be patched.
Recommended Actions
- Identify affected systems. Inventory PHP installations, including websites, applications, and third-party platforms.
- Patch immediately. Apply the appropriate PHP security updates, use hosting or server configuration tools to select the updated version, and verify that applications are running the patched PHP runtime.
- Prioritize internet-facing services. Address publicly accessible PHP-based websites and applications first.
- Enable WAF protection. Use a Web Application Firewall (WAF), such as Cloudflare, to help detect and block malicious requests. Enable applicable managed security rules and vulnerability-specific protections as they become available.
- Confirm vendor remediation. Verify that hosting providers and third-party application vendors have addressed the vulnerabilities.
- Monitor for exploitation. Review security logs and alerts for suspicious activity and potential compromise.
A Web Application Firewall provides an additional layer of defense but is not a substitute for patching the underlying PHP runtime.
Double-Helix Perspective
PHP2Shell highlights how vulnerabilities in widely used underlying technologies and frameworks can expose otherwise well-maintained applications.
A diligent program of inventorying technology assets, identifying vulnerable components, and responding quickly to critical security updates are fundamental to an effective security posture.
Double-Helix LLC helps organizations assess security risks, identify potential exposures, and prioritize practical remediation.
