- Patchstack reports two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, scored 9.2. Any site on a vulnerable PHP version is affected, whatever application it runs.
- Patchstack says hosting partners have reported live incidents. The PHP security team has scheduled a patch release for 21 October at 14:00 UTC.
- Find every PHP install, ask your host for its patch date, and treat any workaround as a stopgap.
The risk sits below the application
Most security reviews ask about the application: which CMS, which plugins, how current. This week's PHP flaws show the limit of that habit. The weakness is in the engine underneath, so every application running on it shares the same exposure.
Patchstack, which publishes WordPress security intelligence, released a report on two flaws in the PHP interpreter. That is the program that reads and runs a site's code. The report covers CVE-2026-109618 and CVE-2026-109619, two separate entries for the problem.
The PHP security team scored both 9.2 under CVSS v4.0, a standard severity scale. Some early reports put the figure at 10.0. Patchstack says 9.2 is the official rating.
Patchstack says the flaws are reported to allow remote code execution. In plain terms, an attacker could make the server run commands of their choosing.
Because the flaw is in PHP, the application does not matter. Patchstack lists WordPress, Drupal, Magento, Joomla and Laravel among the software affected when the PHP underneath is a vulnerable version.
What is known so far
Details leaked on 20 October, before the planned coordinated disclosure. The PHP security team then announced a release for 21 October at 14:00 UTC. The issue is being called "PHP2Shell". Patchstack reports that security firm watchTowr confirmed the flaws are real and reproduced one of them.
Hosting partners have told Patchstack about live incidents. Its timeline logs multiple incidents reported by hosting partners at 07:34 UTC. The report does not describe the technique used.
The same page opens with a separate item about stolen UpdraftCentral dashboard keys being used to install backdoors on WordPress sites. That activity depends on valid keys. Readers should not assume it is the same problem.
How the flaw works, as far as anyone can say
The suspected entry point is a PHP feature that tracks file uploads so a site can show a progress bar. It is switched on by default. Patchstack describes this as early analysis, not a final finding.
Some researchers suggest disabling the feature until the patch is installed. Patchstack says uploads still go through, but progress bars stop. It adds that the change is only a partial mitigation and does not stop exploitation. A PHP core developer has said that updating PHP is the only full fix.
Affected and fixed version numbers will be published with the release. Patchstack cautions that older, end-of-life PHP branches may not receive patches. That remains unconfirmed until the release.
Why a framework scorecard will not show this
WebPulse tracks the public vulnerability record of each framework it detects. That record covers flaws in the framework's own code. WebPulse's NIST NVD profiles, refreshed on 20 October, list 4 WordPress, 8 Drupal, 5 Magento and 2 Joomla entries in CISA's Known Exploited Vulnerabilities catalog. A runtime flaw is filed against PHP, so a site can look well maintained at the application layer and still be affected.
WebPulse's September 2026 scan of the Tranco top 10,000 domains detected a platform on 2,491 sites. WordPress accounted for 719 of them (28.9%) and Drupal for 188 (7.5%). The scan counts platforms, not PHP versions, so it cannot show how many of those sites are vulnerable.
For many organisations, the patch is not theirs to apply. A business on managed hosting depends on its provider's schedule. Patchstack's advice is to ask the host when it will apply the update.
What to ask your team this week
Patchstack's advice is to install the new PHP once it is released at 14:00 UTC. These questions turn that into a checklist.
First, do we have a complete list of PHP installs, including servers, containers and staging sites? Patchstack says this list is what tells you what needs updating.
Second, which PHP version does each one run, and is any of them end-of-life? If so, ask the host about upgrade options now.
Third, if we use managed hosting, what is the host's patch date in writing? Fourth, has anyone disabled the upload progress feature as a stopgap, and is it tracked as temporary?
Fifth, are staff being told to avoid unofficial "fix" plugins and copied snippets? Patchstack says they are unverified and can break a site.
The lesson is about dependencies. You may not run the code that fails, but you still answer for the sites that sit on it. Know what your sites run on, and who patches it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Patchstack.
