# PHP2Shell: the October 2026 PHP Flaws, and the 15-Minute Check for Your Website

> Amen Security Team · 2026-10-24T13:51:55.862Z · security

On October 21, 2026, the Canadian Centre for Cyber Security issued alert AL26-026 about two critical flaws in PHP — the programming language behind most of the web, including most WordPress sites, client portals and small-business websites. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell", are rated 9.2 out of 10 for severity. An attacker who can reach an unpatched, internet-facing PHP server does not need to log in to run code on it.
That last part is what makes this week different from a routine patch notice. A proof-of-concept exploit is public, the disclosure leaked a day early so attackers and defenders learned about the flaws at the same time, and Cloudflare reported millions of attempted exploits after the weaknesses became public. Governments took websites offline as a precaution — in the Netherlands, Finland and France, and closer to home, a Quebec school board interrupted service on several of its sites while technicians dealt with the problem.
If your business website runs on PHP — and if it is WordPress, it almost certainly does — this is a patch-now week, not a patch-someday week. The check below takes about fifteen minutes.
In 30 seconds
- Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619), disclosed October 21, 2026, let an unauthenticated attacker run code on an unpatched PHP server. Severity: 9.2 out of 10.
- You are affected if your site runs PHP below the fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch. PHP 8.1 and older no longer receive updates from the PHP project at all.
- The trap: updating WordPress, or installing a security plugin, does not update the PHP runtime underneath it. Ask your host whether the runtime itself has been patched — that is the question that matters.

What actually broke
Both flaws are described as critical Use After Free flaws in PHP. In plain terms: a flaw in how PHP handles memory lets a remote attacker, without any login, execute arbitrary code on the server. That is the worst combination a website flaw can have — no credentials needed, full control as the prize.
PHP underpins the majority of the web. WordPress, the most widely used website-building platform in the world, runs on it, as do an enormous share of client portals, booking tools and practice-management software that small businesses rely on daily. A flaw at this layer does not care how good your passwords are.
Are you affected? Check your branch
The PHP project released fixes on October 21, 2026. Find which branch your site runs, and compare:
Branch
Update to at least

PHP 8.5
8.5.12

PHP 8.4
8.4.27

PHP 8.3
8.3.36

PHP 8.2
8.2.35

If your site runs PHP 8.1 or older, there is no ordinary update waiting for you: those branches no longer receive updates from the PHP project. Some hosting providers and long-term support distributors supply their own fixes for older branches, so confirm your support arrangement with your host rather than assuming an update will arrive.
Why this one moved so fast
Most vulnerability stories move at the speed of IT departments. This one moved at the speed of the internet. Details leaked online a day before the planned disclosure, the fixes were rushed out on the morning of October 21, and attackers began targeting the flaws within hours of them becoming public.
The Cyber Centre said it had not identified active exploitation at the time of its alert — and added that this "can change quickly." That sentence is the whole story of this week: the window between disclosure and mass exploitation is measured in hours now, not weeks.
Note what the alert did not say, too. It did not recommend taking systems offline in general. The government shutdowns went further than the agency's published guidance — a precaution by organizations that decided they could not patch fast enough, not an instruction to everyone else.
The 15-minute check
Work through these five steps, in order. The in-article visual below is the same sequence — keep it beside you while you check.
- Find your PHP version. Your hosting panel usually shows it, or your developer or host can tell you in one message. Write down the branch and the full version number.
- Ask your host one exact question: has the PHP runtime itself been patched to the fixed version for our branch? Not "are we up to date" — that question gets answered about the wrong layer. You want the runtime version, confirmed.
- Update the site too — but know what that does and does not do. Update WordPress, your theme and your plugins. That closes other holes. It does not patch PHP.
- Review your logs for signs of suspicious activity. Your host can help here. You are looking for anything unusual around and after October 21 — unexpected requests, unfamiliar access patterns.
- If patching cannot happen right away, shrink the exposure. The Cyber Centre's guidance for that case is to consider isolating internet-facing applications from public networks until the patch lands. Do not just wait with the site fully exposed.

The 15-minute check: Version → Host question → Site updates → Log review → Isolate if you must wait.Attackers and defenders learned about these flaws at the same time. The only head start left is patching first.

What we check when we look
When Amen Security looks at a website after an alert like this, the pass is deliberately boring: the PHP version on every environment (production, staging, and the forgotten subdomain), third-party products and containers that bundle their own PHP installations, the log review, and a test of the important site functions after the patch — because a patch that breaks checkout or booking is a patch that gets rolled back. That verification step is part of the job, not an afterthought.
That read-only first look is what our [free assessment](https://amensecurity.ca/en/contact) opens with — the version inventory and the exposure, in writing, before anything changes.
Questions businesses are asking this week
Is my WordPress site affected?
If it runs on PHP below the fixed versions above, yes — WordPress runs on PHP, so the flaw sits underneath the whole site, whatever theme and plugins you use.
Does updating WordPress fix it?
No. Updating the content management system or installing a security plugin does not update the PHP runtime underneath it. Both layers need their own update.
My host says we are fine. Is that enough?
Ask for the runtime version number in writing. "Fine" without a version is not an answer to this alert.
We are on PHP 8.1. What now?
Talk to your host about their long-term support arrangement, or plan the upgrade to a supported branch. There is no PHP-project patch coming for 8.1.
How do I know if we were already hit?
Review logs for suspicious activity around and after October 21, and preserve the records before changing anything. A matching suspicious event is a reason to investigate, not proof by itself — bring it to someone who can read it properly.
Reading that sits next to this one
Related reading:
- [Your Microsoft 365 backup can be attacked too](https://amensecurity.ca/en/blog/microsoft-365-backup-security-checklist) — the same lesson from a different layer: what a connected app could reach, and the ten checks that followed.
- [Microsoft 365 cleanup: licences, security settings, and the tenant you forgot](https://amensecurity.ca/en/blog/microsoft-365-cleanup-licences-security-settings) — the tenant-hygiene pass that belongs beside any security week.
- [What does cybersecurity actually cost a small business in Canada?](https://amensecurity.ca/en/blog/cybersecurity-cost-small-business-canada) — once the urgent patch is done, the budget conversation for staying patched.

Patch first, then verify
The teams that came out of this week best did three things, in this order: they found their version, they got the runtime patched (or isolated the site until it was), and they verified the site still worked afterwards. That is the whole playbook, and it fits on an index card.
If your host cannot tell you your PHP version, or cannot say whether the runtime is patched, that non-answer is itself the answer — it tells you where your website's security actually stands. Fix that gap this week, while the story is still fresh enough that every host is paying attention.
Same week, different runtime, same lesson: [Node2Shell, the Brotli flaw in Node, Python, and everything that bundles it](https://amensecurity.ca/en/blog/node2shell-nodejs-brotli-rce-october-2026) — the layer underneath your code needs its own patch, and this one hides in the Brotli decoder bundled into Node, Python, and the proxies in between.
Sources & review
- Canadian Centre for Cyber Security — Alert AL26-026, October 21, 2026: the two flaws (CVE-2026-109618, CVE-2026-109619), fixed versions 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, PHP 8.1 and older no longer receiving PHP-project updates, proof-of-concept available, no active exploitation identified at alert time with the note that this "can change quickly", and the guidance to update immediately, identify bundled PHP, review logs, and consider isolation if patching is not possible right away.
- PHP project security release, October 21, 2026: the fixed versions above.
- Cloudflare observations reported after disclosure: millions of attempted exploits.
- News reports, October 21–23, 2026: government and institutional websites taken offline as a precaution in the Netherlands, Finland, France and Quebec (Centre de services scolaire Marie-Victorin); disclosure details leaked a day before the planned date; severity rating 9.2 out of 10.
- Reviewed: October 24, 2026.
- Amen Security is a Winnipeg-based managed IT (MSP) and website & custom apps provider: on-site support across Manitoba, remote support across Canada and the US, and a free assessment before any contract.

## Topic: Cybersecurity & compliance
- [Main guide](https://amensecurity.ca/en/services/cybersecurity.md)
- [Managed IT vs Break-Fix: Side-by-Side Comparison](https://amensecurity.ca/en/guides/msp-vs-break-fix.md)

---
Source page: https://amensecurity.ca/en/blog/php2shell-critical-php-vulnerability-canada-2026
Markdown version for AI agents · Amen Security
Email: info@amensecurity.ca
Phone: +1 (204) 514-3536