If your website runs on WordPress, Drupal, Joomla, TYPO3 or Magento, there's a security issue from overnight to check on today. Two critical vulnerabilities were found in PHP, the programming language those platforms are built on, which runs around 70 per cent of websites whose server-side language is known (W3Techs, 2026). They let an attacker take over a website's server without needing a login. The flaws were first found using artificial intelligence, according to a Google-owned security firm (ABC News, 2026), and the PHP project released fixes early on 22 October 2026, Australian time. Australia's cyber security agencies, along with agencies in the US, the UK, Europe and Japan, have advised organisations to update now and, if they can't, to take the site offline until they can (ABC News, 2026; CISA, 2026).
What this means in plain English
PHP is the software on the web server that runs the CMS, so the problem sits underneath WordPress, Drupal and the other platforms rather than inside them.
Updating WordPress or Drupal on its own won't fix it. Keep the CMS up to date as usual, and update PHP as well.
An attacker who gets in this way can change the website, read the data it holds and use the server to reach other systems.
If a hosting provider or developer looks after your website, ask them today which PHP version it runs and when it will be updated.
Two flaws in PHP let an attacker run their own code on a website's server
The two vulnerabilities are CVE-2026-109618 and CVE-2026-109619, and security researchers have nicknamed them "php2shell". The PHP project rates both 9.2 out of 10 for severity (PHP, 2026). An attacker can exploit either one by sending the website a specially crafted request, and doesn't need an account or a password to do it.
For technical readers, the first flaw corrupts memory when PHP runs out of memory part-way through setting up a request. The second leaves data from one request pointing at memory that has already been freed, which a later request handled by the same PHP process can then misuse. PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
PHP says the risk is highest on servers that use Apache with mod_php, a common older set-up, because there the attack works before any of the website's own code runs (Huntress, 2026). Nothing in WordPress, Drupal or any other CMS gets a chance to stop it, so those servers are the ones to fix first.
Details of the flaws leaked online on 20 October, before the fixes were out (Tenable, 2026).
An unpatched PHP website can be taken over without anyone logging in
An attacker who exploits these flaws can run their own code on the web server with the same access the website has. From there they can change the site, read data stored on the server or in the website's database and use the server to reach other systems on the same network.
Attackers don't need to pick their targets one by one, because they can scan the internet for servers running an unpatched PHP version. Security researcher Silas Cutler estimates more than 1.3 million internet-facing servers may be vulnerable (Tenable, 2026). Cloudflare reported on 21 October that it was "seeing early attacks emerging" (ABC News, 2026), and government agencies in the Netherlands, Finland, Denmark and France took websites offline as a precaution. The security firm watchTowr says it is seeing attempts to exploit both flaws, although the US Cybersecurity and Infrastructure Security Agency (CISA) had not seen any when it published its alert (Tenable, 2026; CISA, 2026).
Every CMS that runs on PHP is affected, whichever version of the CMS it runs
A site is exposed if its server runs an unpatched PHP version, even when the CMS itself is fully up to date. Researchers at Calif and Wiz have shown attacks working without a login against WordPress, Drupal, Joomla and Magento (Tenable, 2026; Huntress, 2026).
WordPress runs about 43 per cent of all websites, from blogs to corporate sites and online stores built on WooCommerce (ABC News, 2026).
Joomla is an open-source CMS used for business and community websites with more complex content and membership needs.
Drupal runs many large enterprise and government websites. The Drupal security team issued a public service announcement before the release telling site owners to set aside time to update PHP.
TYPO3 is used for large corporate websites, particularly those running several sites and languages from one installation.
Magento and Adobe Commerce run online stores, which hold customer and order data and so raise the stakes of a server takeover.
Custom applications built on PHP frameworks such as Laravel and Symfony are exposed in the same way, as are hosting control panels such as cPanel and Plesk. Websites built on a platform that doesn't use PHP, such as Kentico and Sitecore (both built on .NET) or a Node.js site, aren't affected, provided no other PHP software runs on the same server.
The PHP version a site runs decides which update it needs
The fixed versions are listed in the PHP project's announcement and can be downloaded from the PHP downloads page.
PHP 8.5: Update to 8.5.12.
PHP 8.4: Update to 8.4.27.
PHP 8.3: Update to 8.3.36.
PHP 8.2: Update to 8.2.35. PHP 8.2 stops receiving security fixes on 31 December 2026, so plan a move to 8.4 or 8.5.
PHP 7.4 to 8.1: No official release. The PHP project has published source code fixes that a developer or host can apply, and some Linux distributions and long-term support providers offer patched builds.
PHP 7.3 or older: No fix exists. Upgrade, or take the site offline until it is upgraded.
Six steps protect a PHP website from the php2shell attacks
Find every PHP website and application you run. Include intranets, customer portals, staging sites, old campaign sites and vendor software that comes with its own copy of PHP, because forgotten sites are exposed in the same way. Switching off a site you no longer need is often quicker than updating it. WordPress shows the PHP version under Tools, Site Health, Info, Server. Drupal shows it in the Status report, and Joomla shows it under System Information.
Update PHP to the fixed version, starting with sites the public can reach. Within those, start with servers that use Apache with mod_php and sites that hold customer data, such as logins, enquiries or orders. If a hosting provider manages the server, ask them to confirm in writing which PHP version each site now runs.
Test the update on a copy of the site where you can. Moving from PHP 8.1 or older to a supported version often breaks older plugins, modules and themes, which is why so many sites still run old versions. While that testing happens, the live site still needs one of the protections in step 4 or needs to be offline.
If you can't update today, reduce the risk in the meantime. PHP lists settings that lower it, including memory_limit=-1 (set so the application can't override it), a lower post_max_size (the largest request PHP will accept), session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0. Restart every PHP process after changing them. Setting memory_limit=-1 removes PHP's own memory cap, so a memory limit at the server or container level needs to take its place. Cloudflare has added rules that block known attacks for all its customers, including those on its free plan, but only for traffic that passes through Cloudflare. PHP is clear that none of these makes a site safe, and only the update does.
Check the server for signs it has already been attacked. The clearest sign is a PHP process (such as php-fpm, php-cgi, httpd or apache2) starting a command shell or a download tool like curl or wget (Huntress, 2026). Unfamiliar files in the website's folders and new user accounts or scheduled tasks are also signs. If you find any of these, disconnect the server from the internet and keep the web server and PHP logs for investigation.
Follow the official guidance as it changes. The PHP security announcements and the Australian Cyber Security Centre alert are the two sources to check over the coming days.
Updating PHP on the server protects every CMS that runs on it
Most of the risk from these vulnerabilities is removed by one change on each server: moving PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. An organisation that knows which PHP version each of its websites runs can make that change today, alongside the usual CMS updates, whichever CMS the sites are built on.
If you need assistance, please contact Adrenalin.
Sources
PHP project, security advisory and releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35, 21 October 2026 (UTC). php.net
Australian Cyber Security Centre, "Critical vulnerabilities in PHP", 21 October 2026. cyber.gov.au
CISA, "Critical Vulnerabilities in PHP Require Immediate Patching", 21 October 2026. cisa.gov
Drupal Security Team, PSA-2026-10-20, critical PHP update. drupal.org/security
ABC News (Reuters), PHP vulnerabilities, 22 October 2026. abc.net.au
Tenable, "php2shell (CVE-2026-109618, CVE-2026-109619): frequently asked questions", 21 October 2026. tenable.com
Huntress, "php2shell: leaked critical PHP vulnerabilities", 20 October 2026, updated 21 October. huntress.com
Learn from us
Join thousands of other Product Design experts who depend on Adrenalin for insights
