On Monday, October 20, 2026, the secret got out early. Details of two critical PHP flaws leaked before the planned disclosure. The PHP team moved its security release up a day and shipped the fixes on Wednesday, October 21.

That rushed week has a name now: PHP2Shell. It is not a WordPress plugin bug. It is not a theme bug. It is a flaw in PHP itself, the runtime underneath all of those things.

If you run anything on PHP, this one is worth understanding properly, because the usual advice, update your app, does not fix it.

What PHP2Shell actually is

PHP2Shell is the name researchers gave to two flaws in PHP core:

CVE-2026-109618, rated 9.2 out of 10 under CVSS v4.0

CVE-2026-109619, also rated 9.2

Both can let an attacker who is not logged in run code on a vulnerable web server by sending a crafted HTTP request. No username. No password. No click from a victim.

A quick glossary, because the rest only makes sense with it:

Runtime: the program that runs your code. Your app is the recipe.…