On 21 October 2026, the PHP project released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 , now known as PHP2Shell . They let an attacker run commands on a web server with a single crafted request, without an account and without touching your site's own code.

If your website, shop or admin panel runs on PHP, and that includes most WordPress, WooCommerce, Laravel, Drupal and Magento sites, this is worth ten minutes of your time today.

Short version: update the PHP runtime that serves your site to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or your vendor's patched package), then restart PHP. Updating WordPress or your plugins does not fix this. The widely shared session.upload_progress.enabled=0 setting is not a complete fix.

Last checked: 24 October 2026. This is a fast-moving story; follow PHP's official advisories for changes.

What PHP2Shell is, in plain words

Both flaws are in the PHP engine itself, not in WordPress, Laravel or any plugin.…