On 21 October 2026 the PHP project published fixes for two serious flaws in the language that runs most of the web, including WordPress. They are tracked as CVE-2026-109618 and CVE-2026-109619. You may also see them talked about together under the name “php2shell”.
If your site is hosted with Spire, you can stop here if you like: we have already installed the 21 October 2026 PHP security builds, and we have added extra firewall protection in front of them. The rest of this note is for anyone who wants to understand what happened, whether you write code or you simply want a clear account.
The short version
Both issues are rated critical. On a server that is still running an unpatched copy of PHP, someone on the internet could, in the wrong circumstances, run their own commands. They would not need a password. That is called unauthenticated remote code execution, and it is the kind of bug you close the same day. That is what we did.
The fixes shipped in these PHP releases, all dated 21 October 2026:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
The versions on our hosting platform are now PHP 8.4.27, PHP 8.3.36 and PHP 8.2.35. Each of those binaries was built on 21 October 2026.
What the two flaws actually are
Every visit to a dynamic page goes through PHP. It reads the request, runs the application, then tidies up. These bugs sit in that tidy-up, in the part of PHP that manages memory and errors. They are not a hole in WordPress, WooCommerce, or a plugin you installed.
CVE-2026-109618 — memory pressure at the wrong moment
PHP stops a request that tries to use more memory than it is allowed. If that stop lands while PHP is still setting up its internal notes for the request, the tidy-up can treat half-finished data as if it were complete. Public research has shown that, on some setups, a visitor can turn that mix-up into the ability to run commands on the server. The PHP team rates the risk highest where PHP is built into the web server itself. The same class of problem has also been confirmed where PHP runs as a pool of workers, which is how modern hosting — including ours — serves websites.
CVE-2026-109619 — a previous visit leaving something behind
A PHP worker usually handles many visits, one after another. This bug can leave a scrap of internal state pointing at memory that has already been thrown away. The next visit handled by that same worker may read the leftover before PHP resets itself. Researchers confirmed that this can crash a worker and, against a real application, be used to run commands.
Any server answering web requests with an unpatched PHP is in scope. That includes PHP-FPM, Apache with PHP built in, PHP as CGI, FrankenPHP and LiteSpeed. CISA’s alert on 21 October said exploitation had not been seen in the wild at the time of publication. The advice from CISA and the UK’s National Cyber Security Centre is still to update internet-facing PHP immediately, because the issues are serious enough to scan for.
What we have done
The PHP project is clear that the update is the complete fix. Other measures shrink particular routes in; they leave the underlying issue in place. We have done the update, and we have added a second layer:
- PHP itself is updated. The binaries customers use on our platform are the 21 October 2026 security releases: 8.2.35, 8.3.36 and 8.4.27.
- Extra firewall mitigations are in place in front of those services, while the wider industry watches for scanning.
Shared, reseller and agency hosting pick this up automatically. There is no plugin to update, no file to edit, and no ticket to raise for this one.
If you run a VPS or another server where you install PHP yourself, move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP so the workers actually pick up the new build. PHP 8.1 and older are no longer maintained by the PHP project. Some vendors have published their own backports; where that is not available, a currently supported release is the safe place to be. Official guidance is on the links below.
What you should do
- Sites hosted with us. Nothing further for this update. The PHP version shown in the control panel will be one of the patched builds.
- Servers you look after yourself. Install one of the releases listed above and restart PHP. Firewall rules reduce exposure during the update window. The new PHP build is what closes the issue.
- Anything that looks unusual. A PHP process starting a shell, or a site downloading tools it has never used, is worth a ticket. We are watching our side of the platform.
Where this comes from
- PHP project security advisory, 21 October 2026
- CISA alert: critical vulnerabilities in PHP
- UK NCSC notice
- PHP Foundation: today’s security release
Questions are welcome. If something on your account looks off, contact us and we will look with you.
