Major PHP2Shell Vunerability Leaves WordPress and Other Sites Open to Attack Until Updated
A critical PHP bug can let hackers seize control of servers that power WordPress and many everyday websites. Probably a good time to avoid secure transactions on websites that use PHP, for a while.
A serious security problem in PHP, the programming language that runs a large share of the websites Americans use every day, was patched on October 21, 2026. The two critical flaws, known as PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, allow an attacker to run their own code on a vulnerable server without logging in. That means an attacker could steal data, change what a site shows, or plant tools to attack visitors.
The problem sits in the core of PHP itself, not in any particular website’s code. It affects versions going back more than a decade. Sites built with WordPress, Drupal, Magento, and many others can be hit even if their own software is up to date. Updating WordPress, a theme, or plugins does not fix it. Only updating the PHP software on the server does. The FBI’s Cyber Division told organizations to update right away or take systems offline if they cannot. Some government and other sites in Europe went dark temporarily while they applied the fixes. Early attack attempts were already being seen.
For most ordinary users, there is no patch to install on a phone or home computer. The risk comes from the websites they visit. A compromised site could show fake login pages, serve bad downloads, redirect visitors to malware, or, in the case of crypto-related pages, swap out a wallet-connect button for a tool that drains funds. WordPress powers many local business sites, community pages, and online stores that people trust. When those servers stay unpatched, visitors can walk into trouble without realizing it.
Large hosting platforms that run WordPress.com and similar services said they had already applied the updates. Smaller hosts and self-run servers are a different story. Many older PHP versions no longer get official fixes, so some site owners must upgrade the whole system or risk staying exposed.
Users can take simple steps while the patching continues. Treat unexpected redirects, download prompts, or login requests with caution, even on sites that normally look familiar. If a page asks for a password reset or payment details out of the blue, leave it. Skip connecting crypto wallets to sites for now, especially claim or airdrop pages, and only download wallet apps from official stores. Use different passwords for different accounts and turn on multi-factor authentication where it is offered. If a site you use regularly looks off or goes offline, it may simply be getting fixed—check back later rather than entering information on a substitute page someone sends by email or message.
The underlying issue is that a huge part of the internet still depends on software maintained with limited resources. When a hole like this appears, big platforms can move quickly while smaller operators and their visitors are left waiting. Checking that the sites you rely on have been updated is one practical way to reduce the chance of problems.
Sources / More reading
- The PHP Foundation announcement: https://x.com/ThePHPF/status/2112633155631108544
- PHP Foundation blog on the release: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
- FBI Cyber Division warning: https://x.com/FBICyberDiv/status/2112921648252719420
- Eliza on wallet risks: https://x.com/Elizacreatez/status/2112905558810309120
- JFrog Security Research overview: https://research.jfrog.com/post/php2shell-all-you-need-to-know-about-cve-2026-109618-and-cve-2026-109619/
- BleepingComputer: https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/
- Malwarebytes on visitor advice: https://www.malwarebytes.com/blog/bugs/2026/10/php2shell-why-websites-are-going-offline-for-emergency-security-updates
- Automattic (WordPress.com protection): https://automattic.com/2026/10/21/your-sites-are-protected-against-the-php2shell-vulnerabilities/
- Newsweek on user impact: https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225
- Sansec technical details: https://sansec.io/research/php2shell
- Help Net Security: https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/