If your website runs on WordPress, WooCommerce, Magento, Joomla, Drupal or Laravel, this week’s news applies to you. Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution on PHP installations serving web requests. The pair is nicknamed PHP2Shell. In plain terms, an attacker doesn’t need a password or a stolen account to run their own commands on an unpatched server. The flaws are in PHP itself, not in a plugin or theme, so any site on a vulnerable PHP version is exposed, even a simple one. The affected versions reach back nearly to PHP 5.4. Both flaws carry the PHP security team’s critical rating.
The timeline matters.
Details leaked on October 20, ahead of the planned disclosure, and PHP then shipped fixes early on October 21. The patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Attacks followed quickly. Tenable noted that Amazon’s threat intelligence team saw exploitation attempts beginning October 17, before public disclosure, and advised starting investigations from at least that date. So updating now is necessary, but it isn’t enough if your site may have been probed for several days.
What Do Small Business Need to Do?
- Find out which PHP version your site runs. Check your hosting dashboard, usually under “PHP version” or “MultiPHP.” In WordPress, Tools → Site Health → Info → Server also shows it. The NCSC advises checking all PHP installations, not just outdated ones, since all versions may be affected.
- Update PHP to a patched release. On shared or managed hosting, this is usually a dropdown or a support ticket. Ask your host in writing whether they’ve applied the October 21 fixes. If you manage your own server, update to one of the versions above. If you’re on a PHP version older than 8.2, move up to a supported, patched branch instead of waiting. I didn’t find fix information for older branches.
- Apply the temporary mitigations if you can’t update immediately. PHP’s guidance includes disabling session.upload_progress and, on PHP 8.5, turning off fatal_error_backtraces for CVE-2026-109619. Session upload progress is on by default, and turning it off does nothing for CVE-2026-109618, so treat this as a stopgap only.
- Put a web application firewall in front of your site if you don’t already have one. Cloudflare and several security vendors have published protections for these flaws, but a firewall is a cushion, not a substitute for patching.
Check whether you were already hit.
Because attempts started before the patch, look for signs of compromise from October 17 onward. Review your server access logs for unusual requests or large uploads, look for new or modified PHP files in your uploads and plugin folders, check for admin accounts you didn’t create, and run a malware scan with a tool such as Wordfence or Sucuri. Change passwords for your hosting panel, database and admin accounts if anything looks wrong, and make sure you have a clean, recent backup stored somewhere other than the server itself.
Partner With the Experts
Cyber threats change daily, and keeping up with tactics like ClickFix can be a full-time job. If you want to ensure your business network is fully monitored and your team is trained against the latest exploits, we are here to help.
Contact us today for a comprehensive cybersecurity assessment to find and patch the hidden vulnerabilities in your business defenses.
Philipp Emma | philipp@psntech.com | 313-715-3421 (cell)