PHP2Shell: Secure Your Website Before You Get Hacked!

If you run a WordPress website or a WooCommerce store, you are used to seeing notifications for plugin updates and minor security patches. However, a newly disclosed, exceptionally severe security threat requires immediate infrastructure-level attention.

Two critical vulnerabilities have been discovered in PHP itself – the underlying programming language that powers WordPress, WooCommerce, and roughly 70% of the web.

Discovered by a joint research effort involving Wiz Research, OpenAI Codex Security, and Calif, this vulnerability family is nicknamed “PHP2Shell”. The Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert urging organizations to patch immediately, as these flaws allow unauthenticated attackers to execute code and expose sensitive server memory.

Here is a technical but accessible breakdown of what this means for your online store and steps to secure your business.

PHP2Shell comprises a family of memory-safety vulnerabilities in core PHP. Unlike a poorly coded plugin, the vulnerable code lives in the PHP engine itself. In turn, PHP resides on your server and runs your website, plugins, payment gateways, etc.

If an attacker sends a specifically crafted request to your server—often utilizing standard multipart data like file uploads—they can trigger one of two related bugs:

1. CVE-2026-109618 (Out-of-memory corruption): When PHP runs out of memory mid-request, it aborts the process. This can leave request-internal data half-initialized. The ensuing cleanup treats that corrupted data as valid, creating a pathway to execute malicious code.
2. CVE-2026-109619 (Stale global state): PHP retains references to request data after its backing memory has been freed. The next request on the same web worker can trip over that stale state, triggering a “use-after-free” exploit.

In cybersecurity, this results in Unauthenticated Remote Code Execution (RCE). It is the worst-case scenario for a website because:

• Unauthenticated: The attacker does not need an admin account, a customer login, or any passwords to breach your site.
• Code Execution: It allows the hacker to run commands directly on your server, giving them full control to steal customer databases, install malware, or read sensitive PHP process memory (including API keys and payment gateway tokens).

Both vulnerabilities carry a maximum CVSS severity score of 9.2 (Critical).

While PHP2Shell is not a WordPress bug, WordPress and WooCommerce sites are prime targets. The vulnerabilities can be triggered by how PHP processes “multipart” requests. In other words, triggerable by a customer submitting a contact form, uploading a file, or interacting with the checkout process.

Because e-commerce stores rely heavily on dynamic data submissions, WooCommerce sites are squarely in the crosshairs.

The PHP development team acted with exceptional speed to deliver comprehensive fixes, but these official patches are only available for active PHP versions.

The fixed PHP releases are:

• PHP 8.5: Fixed in 8.5.12
• PHP 8.4: Fixed in 8.4.27
• PHP 8.3: Fixed in 8.3.36
• PHP 8.2: Fixed in 8.2.35

If your server is running PHP 8.1 or older, your site is in grave danger. PHP 8.1 and older are considered “End of Life” (EOL). While the PHP security team published minimal source backports for PHP 7.4 through 8.1, many modern hosting control panels will not automatically apply these. If your site is stuck on an EOL version of PHP, the most reliable fix is migrating your web application to PHP 8.2 or higher immediately.

While there are temporary mitigations (such as Cloudflare deploying WAF rules or altering memory_limit and session.upload_progress settings), security vendors universally warn that these are strictly stopgaps.

Upgrading PHP is the only complete remediation.

1. Audit Your PHP Version: Verify the exact version of PHP your server is running.
2. Apply Security Patches: If you are on PHP 8.2, 8.3, 8.4, or 8.5, ensure your server infrastructure has pulled in the latest .x security release noted above.
3. Upgrade from EOL Versions: If you are on PHP 8.1 or older, you must safely migrate your WordPress site to PHP 8.2 or 8.3 immediately.
4. Restart Services: Updating the application is not enough; you must restart Apache, PHP-FPM, and any long-running PHP workers to ensure the patched engine is running.