Two critical vulnerabilities in PHP recently triggered an urgent round of security updates across hosting providers, server administrators and businesses responsible for PHP-based websites.
The vulnerabilities, now widely referred to as PHP2Shell, could allow an unauthenticated attacker to execute code remotely on an affected server. Both received a critical CVSS score of 9.2.
For WordPress website owners, the most important point is that this was not a WordPress plugin problem. PHP is the software that runs WordPress on the server, so the issue sat beneath the website itself.
That distinction explains why updating WordPress from the dashboard was not enough and why active server management matters.
What happened?
On 21 October 2026, the PHP project issued out-of-band security releases for two critical vulnerabilities:
- CVE-2026-109618, involving unsafe handling of an out-of-memory condition.
- CVE-2026-109619, involving internal request state being carried across reused workers.
In the wrong circumstances, either flaw could allow a remote attacker to execute arbitrary code without first signing in.
The affected component is part of the PHP runtime used by many websites and applications. WordPress was not the cause, but a WordPress website running on an affected PHP installation could still be exposed through the server underneath it.
The PHP project stated that there was no complete configuration workaround. Installing a corrected PHP release was the safe response.
Which PHP versions contain the fixes?
The PHP project released the following corrected upstream versions:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
Linux distributions can backport security fixes into their own packages, so the number shown by a server may not always match an upstream PHP release exactly. The reliable check is whether the operating system or package provider confirms that its installed build contains the relevant fixes.
Ubuntu published security notices and updated packages for supported releases, along with updates for several older Ubuntu releases available through its extended security channels.
Why updating WordPress was not enough
A WordPress website depends on several layers:
- WordPress core
- The active theme and plugins
- PHP and its extensions
- The web server
- The operating system
- The database and wider hosting environment
Keeping WordPress, themes and plugins updated is essential, but it only protects part of that stack.
PHP2Shell was a useful reminder that a website can be fully updated inside WordPress while the server running it still needs urgent attention. The relevant PHP packages had to be patched and the PHP service restarted so that the corrected code was actually in use.
Why older hosting environments create more risk
Urgent security events become more difficult when a website is running on an outdated operating system or an unsupported PHP branch.
On a current, supported server, the response can be relatively direct: confirm the advisory, install the security packages, restart the affected services and verify the result.
On a legacy server, the required packages may depend on extended support, a third-party repository or infrastructure that can no longer be upgraded safely in place. In those cases, the responsible option may be to provision a current server and migrate the website rather than trying to preserve an ageing environment.
This is why routine lifecycle planning matters. Replacing old infrastructure before an emergency is less disruptive than discovering its limitations while responding to a critical vulnerability.
How Black Hive responded
Once the official advisories and corrected packages became available, we reviewed the hosting environments under our management and prioritised them according to exposure, operating system support and PHP version.
The work included:
- Auditing PHP and operating system versions across managed servers.
- Applying corrected packages to supported environments.
- Restarting PHP services and verifying the running versions.
- Provisioning current Ubuntu servers where legacy environments could not be retained responsibly.
- Migrating WordPress files, databases, uploads and configuration.
- Checking SSL, DNS, forms, scheduled tasks and important user journeys after each change.
- Monitoring the migrated websites following their cutover.
For clients on managed hosting, this happened as part of the service. They did not need to interpret a CVE, work out which server packages were affected or organise an emergency migration themselves.
What should a website owner ask their hosting provider?
You do not need to become a server administrator, but you should know who is responsible for the infrastructure supporting your website.
Useful questions include:
- Which PHP version is the website currently using?
- Is the server operating system still receiving security updates?
- Has the provider applied the fixes for CVE-2026-109618 and CVE-2026-109619?
- Are PHP services restarted and verified after security updates?
- Are tested backups available before substantial server work begins?
- Is the website monitored after an update or migration?
- Who takes responsibility when an urgent vulnerability is announced?
A vague assurance that everything is automatic is not always enough. Good hosting should make responsibility, maintenance and escalation clear.
What this incident teaches us
Website maintenance is broader than installing WordPress updates.
A dependable maintenance and hosting arrangement should cover the complete environment: application updates, PHP, the operating system, backups, security monitoring and a plan for replacing infrastructure before it reaches the end of its useful life.
That work is often invisible when everything is running well. Its value becomes obvious when a critical issue is disclosed and the response needs to be accurate, fast and controlled.
Does your WordPress hosting have a clear maintenance plan?
If you are unsure which PHP version your website uses, whether its server is still supported or who would respond to the next critical advisory, it is worth finding out before an emergency.
Black Hive Digital provides managed WordPress hosting, maintenance and ongoing support for organisations that want one accountable partner looking after both the website and the infrastructure behind it.
Talk to Black Hive Digital about WordPress hosting and support.