PHP2Shell and WP2Shell: Is Your Site Advertising a Vulnerable Version? Check in One Click

On October 21, 2026, the PHP project shipped an emergency release for two flaws in PHP itself, now known as PHP2Shell. One unauthenticated web request can be enough to run code on the server. Details leaked before the patch, and exploitation attempts were seen before the fix was public. In July, WordPress went through the same thing with WP2Shell, a pair of core bugs that let anyone create an admin and install a web shell without logging in.

WordPress runs on PHP, so a WordPress site can be exposed to either one. This post covers both: what they are, which versions are affected, and how to check what your site is telling the world about the software it runs.

PHP2Shell: Two Flaws in PHP Itself

PHP2Shell is two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The first is triggered when PHP runs out of memory partway through setting up a request and leaves request data half-initialized. The second involves internal state that outlives the request it belongs to, so the next request handled by the same PHP worker can act on leftover data. Chained, they give remote code execution with no login and no user interaction. Researchers also showed the same bugs can leak a PHP worker’s memory, which can include passwords, session tokens and API keys.

Because the bugs are in the engine, the application on top does not matter. WordPress, Drupal, Joomla, Laravel or a hand-written script are all in scope. Every way of serving PHP is affected, including PHP-FPM, php-cgi, LiteSpeed and FrankenPHP. Apache with mod_php is the most exposed, because the attack can land before any of the application’s own code runs.

The PHP project says no configuration change fully mitigates these flaws. If a server cannot be updated right away, restrict who can reach it until it can.

What Happened, in Order

WP2Shell: The WordPress Version

WP2Shell chains two WordPress core bugs: CVE-2026-63030, a route confusion flaw in the REST API batch endpoint, and CVE-2026-60137, a SQL injection. Together they let an attacker who is not logged in create an administrator account and install a web shell. No plugin is needed; a stock install was enough.

The full chain affects WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1. It is fixed in 6.9.5 and 7.0.2. WordPress forced the update through auto-updates, so most sites patched themselves within days. The ones that did not are sites with auto-updates turned off, pinned versions, or managed hosts that hold core updates back. Those are exactly the sites worth checking.

What the Check Can and Cannot See

The scanner looks at your site from the outside, the same way an attacker’s first request does. It reads the versions your site discloses on its own: the X-Powered-By header that often carries the PHP version, the WordPress generator tag, and the version numbers WordPress appends to its script and style URLs. It matches those against a local copy of the National Vulnerability Database and against end-of-life dates.

• If your site advertises an affected version, you get an Exposure finding naming PHP2Shell or WP2Shell by CVE, with the fixed version. WP2Shell is marked actively exploited.
• If your site hides its versions, the check cannot tell whether you are patched, and it will not pretend to. A clean result means you are not advertising a vulnerable version. It does not prove the server underneath is patched. Check that from the inside with php -v and your WordPress dashboard.
• Hiding the version is part of the fix. Bots scan for version strings and pick targets from them. Turning off expose_php in php.ini removes the PHP version from the header.

What to Do

• Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your distribution’s patched package. Restart PHP-FPM or Apache afterwards, because a running worker keeps the old engine loaded.
• On PHP 8.1 or older, treat it as a migration, not a patch. Upstream no longer ships releases for those branches.
• Update WordPress to 6.9.5, 7.0.2 or later, and turn core auto-updates back on if you had them off.
• If you were exposed, look for signs of use. Unexpected admin accounts in WordPress, unfamiliar PHP files in uploads or theme folders, and new scheduled tasks are the usual traces of a web shell.
• Turn off expose_php so the next scanner, ours or anyone else’s, does not get your version for free.
• Rescan. The Exposure finding should clear.

Patched Today? Watch for the Next One

Every domain in an InternetSecure account is scanned daily. When a version your site discloses gets a new CVE, reaches end of life, or turns up in CISA’s exploited list, the change lands in your alert digest, Slack, JIRA or Linear the same day, with the version to move to. When it clears, you hear about that too.

Create a free account to monitor your domains, or run a one-off check from the homepage scanner.