PHP2Shell patches address critical WordPress server risk
PHP2Shell is the collective name for two critical PHP vulnerabilities publicly disclosed on October 21, 2026. PHP is the server-side programming language on which WordPress runs. The flaws, CVE-2026-109618 and CVE-2026-109619, could allow an attacker to execute malicious code on an affected server without authentication, meaning without first providing a valid account or signing in. Both received a critical score of 9.2 under CVSS 4.0, the Common Vulnerability Scoring System used to rate the severity of security flaws.
The vulnerabilities involve the way PHP handles memory while processing requests. Successful exploitation could compromise websites and the data stored on the same server. Any WordPress installation using an affected PHP version therefore faced potential exposure, but the problem was not in WordPress itself. PHP2Shell affected the PHP runtime, the underlying server software that interprets and runs PHP code, rather than WordPress core, a plugin or a theme. Updating those WordPress components would not correct the vulnerable PHP software.
The PHP development team issued emergency security updates for PHP 8.2, 8.3, 8.4 and 8.5 on October 21. Security fixes for older PHP releases came from third-party maintainers. Kinsta says its engineering and security teams had started preparing before the official corrections, commonly called patches, became available. The provider initially introduced measures intended to reduce the opportunity for exploitation while it validated and deployed the corrected PHP builds.
One temporary layer came from Cloudflare’s Web Application Firewall (WAF), a service that examines incoming web requests and blocks traffic matching malicious patterns. Cloudflare had deployed protections designed to identify PHP2Shell exploitation attempts before the public disclosure, according to Kinsta. Kinsta enabled the relevant protections throughout its hosting infrastructure, allowing traffic to be filtered before it reached hosted websites. These edge-level controls, meaning protections applied at the outer boundary of the hosting network, remained active while the PHP updates were being installed.
Kinsta also changed PHP configuration settings across its hosting environments to limit potential exposure. During the response, it exchanged information about observed threats and attack patterns with its vulnerability-protection partner, Patchstack. Kinsta stressed that the firewall and configuration measures were interim safeguards, not replacements for correcting the PHP runtime itself.
After the PHP team published its fixes, Kinsta validated and deployed patched PHP packages, or installable builds of the server software, across the platform. The rollout covered PHP 7.4 through PHP 8.5, including older-version patches supplied by its PHP package provider, Freexian. Because PHP was managed centrally at the hosting level, customers did not have to install a separate fix or switch versions manually. The rollout covered both live sites and staging environments, which are test copies used to check changes before placing them on a public website.
Kinsta marked the incident resolved on its public status page at 08:26 UTC on October 22, 2026. It said all sites had received the necessary protections and security updates. During the incident, its teams monitored suspicious activity, manually examined sites that appeared to have been targeted and performed additional spot checks for evidence of compromise. Kinsta reported finding no evidence of successful PHP2Shell breaches on its platform. That statement describes the evidence available from its own monitoring rather than proving that no exploitation occurred elsewhere.
Kinsta customers do not need to take their websites offline, install another patch or change PHP versions because of PHP2Shell, according to the provider. Environments suspended as a precaution may be reactivated, as Kinsta says it also updated suspended environments. Customers should continue updating WordPress core, plugins and themes as routine maintenance, but those updates address a different security layer and do not replace the server-level PHP fixes.
Customers can see the configured PHP version by opening Sites in MyKinsta, selecting the website and going to Tools, then PHP settings. However, the displayed version alone may not reveal whether a correction is present. Some maintainers use backported security fixes, which add a security correction to an older software release without changing it to the newest official version number. Site owners who remain uncertain can ask Kinsta’s 24/7 support team through MyKinsta to confirm the patch status of a specific environment. Agencies can also share Kinsta’s public incident report with clients because it records the rollout and resolution.
For owners reviewing where responsibility for server security should sit, AEU Hosting provides managed WordPress hosting secured end to end. PHP2Shell demonstrates why that distinction matters: a WordPress dashboard update cannot repair a flaw in the PHP runtime, so confirmation must come from whoever manages the server’s PHP software.