Two critical PHP flaws (CVE-2026-109618/109619) put unpatched websites at risk. Find your PHP version, check your host, and patch — the 15-minute check.
On October 21, 2026, the Canadian Centre for Cyber Security issued alert AL26-026 about two critical flaws in PHP — the programming language behind most of the web, including most WordPress sites, client portals and small-business websites. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell", are rated 9.2 out of 10 for severity. An attacker who can reach an unpatched, internet-facing PHP server does not need to log in to run code on it.
That last part is what makes this week different from a routine patch notice. A proof-of-concept exploit is public, the disclosure leaked a day early so attackers and defenders learned about the flaws at the same time, and Cloudflare reported millions of attempted exploits after the weaknesses became public. Governments took websites offline as a precaution — in the Netherlands, Finland and France, and closer to home, a Quebec school board interrupted service on several of its sites while technicians dealt with the problem.
If your business website runs on PHP — and if it is WordPress, it almost certainly does — this is a patch-now week, not a patch-someday week. The check below takes about fifteen minutes.
In 30 seconds
Both flaws are described as critical Use After Free flaws in PHP. In plain terms: a flaw in how PHP handles memory lets a remote attacker, without any login, execute arbitrary code on the server. That is the worst combination a website flaw can have — no credentials needed, full control as the prize.
PHP underpins the majority of the web. WordPress, the most widely used website-building platform in the world, runs on it, as do an enormous share of client portals, booking tools and practice-management software that small businesses rely on daily. A flaw at this layer does not care how good your passwords are.
The PHP project released fixes on October 21, 2026. Find which branch your site runs, and compare:
Branch | Update to at least |
|---|---|
PHP 8.5 | 8.5.12 |
PHP 8.4 | 8.4.27 |
PHP 8.3 | 8.3.36 |
PHP 8.2 | 8.2.35 |
If your site runs PHP 8.1 or older, there is no ordinary update waiting for you: those branches no longer receive updates from the PHP project. Some hosting providers and long-term support distributors supply their own fixes for older branches, so confirm your support arrangement with your host rather than assuming an update will arrive.
Most vulnerability stories move at the speed of IT departments. This one moved at the speed of the internet. Details leaked online a day before the planned disclosure, the fixes were rushed out on the morning of October 21, and attackers began targeting the flaws within hours of them becoming public.
The Cyber Centre said it had not identified active exploitation at the time of its alert — and added that this "can change quickly." That sentence is the whole story of this week: the window between disclosure and mass exploitation is measured in hours now, not weeks.
Note what the alert did not say, too. It did not recommend taking systems offline in general. The government shutdowns went further than the agency's published guidance — a precaution by organizations that decided they could not patch fast enough, not an instruction to everyone else.
Work through these five steps, in order. The in-article visual below is the same sequence — keep it beside you while you check.
Attackers and defenders learned about these flaws at the same time. The only head start left is patching first.
When Amen Security looks at a website after an alert like this, the pass is deliberately boring: the PHP version on every environment (production, staging, and the forgotten subdomain), third-party products and containers that bundle their own PHP installations, the log review, and a test of the important site functions after the patch — because a patch that breaks checkout or booking is a patch that gets rolled back. That verification step is part of the job, not an afterthought.
That read-only first look is what our free assessment opens with — the version inventory and the exposure, in writing, before anything changes.
Is my WordPress site affected?
If it runs on PHP below the fixed versions above, yes — WordPress runs on PHP, so the flaw sits underneath the whole site, whatever theme and plugins you use.
Does updating WordPress fix it?
No. Updating the content management system or installing a security plugin does not update the PHP runtime underneath it. Both layers need their own update.
My host says we are fine. Is that enough?
Ask for the runtime version number in writing. "Fine" without a version is not an answer to this alert.
We are on PHP 8.1. What now?
Talk to your host about their long-term support arrangement, or plan the upgrade to a supported branch. There is no PHP-project patch coming for 8.1.
How do I know if we were already hit?
Review logs for suspicious activity around and after October 21, and preserve the records before changing anything. A matching suspicious event is a reason to investigate, not proof by itself — bring it to someone who can read it properly.
Related reading:
The teams that came out of this week best did three things, in this order: they found their version, they got the runtime patched (or isolated the site until it was), and they verified the site still worked afterwards. That is the whole playbook, and it fits on an index card.
If your host cannot tell you your PHP version, or cannot say whether the runtime is patched, that non-answer is itself the answer — it tells you where your website's security actually stands. Fix that gap this week, while the story is still fresh enough that every host is paying attention.
Same week, different runtime, same lesson: Node2Shell, the Brotli flaw in Node, Python, and everything that bundles it — the layer underneath your code needs its own patch, and this one hides in the Brotli decoder bundled into Node, Python, and the proxies in between.
Sources & review
Your comment will be published after our team reviews it.
Keep reading
A backup app's stolen credential opened Microsoft 365 tenants in October 2026. This Canadian SMB checklist audits app access, permissions and restores.
Unused licences, departed staff accounts, and Microsoft 365 security settings nobody finished turning on: what a cleanup fixes for Canadian SMBs in practice.
Cybersecurity costs in Canada, line by line for a 30–80 seat business: licences, monitoring, assessments and insurance readiness, with published 2026 ranges.
