PHP2Shell: what WordPress site owners in Canada need to do now

On 21 October 2026, the PHP project released emergency updates for two critical security flaws, nicknamed "php2shell." PHP is the language that runs WordPress, and roughly seven in ten websites whose technology is known. If your business website runs on WordPress, this applies to you, even if you updated WordPress yesterday.

This is serious, and it is also fixable. Most small businesses can deal with it in one email to their host and a few minutes of checking. Here is what happened and what to do, in plain language.

What happened

PHP's security team published fixes for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which both reach a severity score of 9.2 out of 10. In PHP's words, they "can allow unauthenticated remote code execution." In plain terms: an attacker who knows nothing about your site and has no password could, in the right conditions, run their own code on your server.

Three details make this unusual:

• The flaw is in PHP itself, not in WordPress or a plugin. Security firm Wiz demonstrated takeover of the latest WordPress, Drupal and Joomla, and says "even a simple 'Hello World' application running on an affected PHP version can be vulnerable."
• It reaches back a decade. Wiz says every PHP version released in the last ten years is affected by at least one of the flaws.
• It can leak secrets without a takeover. Wiz also showed attackers reading passwords, tokens and API keys from the server's memory.

PHP says every installation that serves web pages is at risk, whichever way it is set up, and considers the risk highest on servers using Apache with mod_php, a setup still found on some shared hosting, where a demonstrated attack works before any of your site's own code runs.

Is anyone actually attacking sites?

Yes, attempts are happening, though how many succeed is unclear. The honest picture, from the people closest to it:

• Amazon's threat intelligence saw a first exploitation attempt on 17 October, four days before the fix, and now describes the flaws as broadly exploited.
• Cloudflare says details leaked before the official release and it "observed attack traffic targeting our customers," with attackers changing their payloads to try to get around its rules.
• The Canadian Centre for Cyber Security issued alert AL26-026, saying organizations "should identify affected systems and apply the appropriate updates immediately." Global News reported that some Government of Canada websites were taken offline as a precaution.
• CISA, the US cyber agency, goes further: organizations that cannot update, or that still run PHP 8.1 or earlier, "should take PHP-based systems offline until they can be patched or updated."

On the calmer side, Rapid7 reviewed the public attack code and found each version works only for a specific combination of operating system, PHP version and web server, and that its own attempts succeeded only under narrow lab conditions. That is a reason not to panic. It is not a reason to wait.

Why updating WordPress does not fix it

WordPress is the software you log into. PHP is the engine underneath it, installed on your web server. Clicking "update" in your WordPress dashboard updates WordPress, your theme and your plugins. It does not touch PHP.

On shared or managed hosting, which is how most small businesses run, your hosting company owns the server and is the only one who can update PHP. That makes this the one security issue where the most useful thing you can do is ask the right question of the right company.

What to do this week

1. Find out which PHP version your site runs

In your WordPress dashboard, go to Tools → Site Health → Info and open the Server section. It lists your PHP version. Compare it with the fixed releases:

One caution: some hosts apply the fix through their operating system's own packages, which can leave the version number looking unchanged. So treat the number as a starting point and get confirmation from your host.

2. Ask your host to confirm in writing

Send something like this to your hosting company's support:

Please confirm that the server running our website has been patched for the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (php2shell), which PHP version and build it is now running, and that the PHP workers were restarted after the update.

Restarting matters: an update takes effect once PHP's worker processes restart. A reputable host will answer quickly. If yours cannot tell you, that answer is useful too.

3. Keep your firewall protection switched on

If your site uses Cloudflare, it switched on protection automatically for php2shell on all plans with its web application firewall, including the free plan. On paid plans, check that the Cloudflare Managed Ruleset is set to block, not just log. Cloudflare is clear that this is a second layer, not a substitute: "Customers should patch their PHP" even with the firewall in place.

4. Look for signs of trouble since 17 October

Amazon recommends starting any investigation from 17 October, not from the disclosure date. In WordPress, check for:

• administrator accounts you do not recognise, under Users;
• plugins or themes you did not install;
• unexpected redirects, pop-ups or spam pages on your site;
• warnings from your host, Google Search Console or your security plugin.

Because the flaws can expose secrets held in server memory, it is sensible to change your WordPress and hosting passwords and to rotate any keys your site uses, such as payment, email or API keys, once your host confirms the server is patched. If anything looks wrong, ask your host or a developer to investigate before you change anything else, so the evidence is not lost.

5. If you are on PHP 8.1 or older, plan the upgrade now

The PHP project no longer updates 8.1 and older. Some hosts and Linux vendors provide backported fixes, and PHP published minimal backports for people who build PHP themselves, but the lasting answer is moving to a supported version. Older themes and plugins can break on newer PHP, so test the upgrade on a copy of the site first. Our guide to changing a website without losing SEO covers doing that kind of change safely.

A note for whoever manages your server

If your site runs on a server you or a developer manage, the only complete fix is updating PHP to the releases above. PHP lists temporary measures for anyone who cannot update immediately, including disabling session upload progress and tightening request size limits, but says plainly that they "reduce exposure to specific attack paths but do not make an installation safe."

On 23 October PHP also published an informational advisory for a related issue, CVE-2026-115560, which affects even the patched releases but needs an unusual combination of settings and code. PHP and the Canadian Cyber Centre recommend setting session.upload_progress.enabled=0 until the next regular release; servers that already applied that setting need nothing further.

Why AI is part of this story

The flaws had been in PHP for more than a decade. What changed is that AI made them practical to find and exploit. Wiz says that with frontier AI models "a single researcher completed in a week what previously would have taken a world-class team months of work," and OpenAI says its models helped find the flaws before attackers did, a claim Cloudflare's leak report complicates.

The lesson for a business owner is not about AI. It is about time. The same tools that help defenders find old weaknesses help attackers turn them into working attacks, so the gap between a flaw becoming public and being used is shrinking. A website whose updates happen "when someone gets around to it" is carrying more risk than it used to.

Does this mean you should leave WordPress?

Not because of this. php2shell is a PHP problem, so it hit Drupal, Joomla, Magento and custom PHP sites just as much, and WordPress itself did nothing wrong. Moving platforms in a panic would cost more than patching.

The better question is who is responsible for keeping your website current, and whether you would know if they did not. WordPress gives you a general-purpose editor and a plugin for everything, which someone has to keep updated. That works well when the someone is clearly named. When we build on MOST CMS, there is one update path and we handle it. Our comparison of custom CMS, WordPress and page builders includes when WordPress is the better answer.

Our view

Do not panic, and do not wait. Most business owners can close this in a day: one version check, one email to the host, one look at the users list, and new passwords once the server is confirmed patched. The businesses most at risk are not the ones on WordPress. They are the ones running old PHP on a server nobody is clearly responsible for.

If you are not sure who looks after your site, or you want a second pair of eyes on it, that is part of the website work we do for businesses across Vancouver and Canada.

Sources

Technical facts are from PHP's advisories and the Canadian and US government alerts; exploitation reports are from the named security companies.

• PHP: Security advisory, critical remote code execution vulnerabilities, update now (21 October 2026) and informational advisory (23 October 2026)
• PHP security advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
• PHP security advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
• Canadian Centre for Cyber Security: AL26-026, critical vulnerabilities impacting PHP (updated 23 October 2026)
• Canadian Centre for Cyber Security: PHP security advisory AV26-1070
• CISA: Critical vulnerabilities in PHP require immediate patching
• Cloudflare: Cloudflare deploys protections against php2shell vulnerability
• Wiz Research: PHP2Shell, AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
• Tenable: php2shell (CVE-2026-109618, CVE-2026-109619) frequently asked questions
• Rapid7: CVE-2026-109618 and CVE-2026-109619, critical unauthenticated remote code execution in PHP
• Axios: Black October, why bugs discovered by OpenAI tech are creating a cyber emergency
• Global News: Ottawa taking down some federal websites over critical global vulnerability

Last reviewed: 24 October 2026. This is a developing security issue; check PHP's advisory and the Canadian Cyber Centre alert for the latest status.