PHP2Shell (CVE-2026-109618): What SMEs need to do now

On 21 October 2026, the PHP project fixed two critical vulnerabilities that became known as PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS 9.2 and let attackers run their own code on a web server without a password. Because PHP powers WordPress, WooCommerce, Joomla and many other systems, this affects a large number of websites and online shops run by Swiss SMEs.

This article explains in plain words what happened, how to check in one minute whether your website is affected, and which message you can send to your hosting provider. At the end, we explain why Saldio deliberately does without WordPress.

What is PHP2Shell?

PHP is the programming language behind a large share of all websites, including WordPress. PHP2Shell refers to two bugs in the PHP core that can be combined into one attack:

• CVE-2026-109618: when PHP hits its memory limit during a request, internal data is left half-initialised. During cleanup, PHP still treats it as valid. According to Sansec, the bug sits in the upload-progress unserializer and allows memory disclosure up to code execution.
• CVE-2026-109619: internal request data survives after its memory has been freed. A later request on the same worker can still use it.

Technically, both are use-after-free bugs. For an SME, the outcome is what counts: a single crafted request is enough for an attacker to take over the server. No login is needed, and the attack fires before your website’s own code even runs. That is why a well-maintained WordPress with all plugin updates is not enough on its own.

The usual setups are affected, namely Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, in their default configuration. According to Sansec, the faulty code goes back to PHP 5.4.

Timeline

Because the details were circulating before the fix, hosting providers had almost no lead time. Some public authorities, universities and hospitals took services offline as a precaution. The UK NCSC explicitly advises taking offline any system that cannot be updated right away. Better briefly offline than customer data at risk.

Is my website affected? The one-minute check

You don’t need to install anything. You only need to know what your website is built with.

A note on WordPress: according to Sansec, the attack was demonstrated on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4 and Nextcloud 35.0.1, among others. A WordPress update does not solve the problem. What matters is the PHP version on the server.

A message you can send to your host

Copy this text into an email to your hosting provider or web agency:

Subject: PHP update against PHP2Shell

Hello

Has the PHP update against PHP2Shell (CVE-2026-109618 and CVE-2026-109619) already been installed on our hosting? At least PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 is required.

Many thanks for a short confirmation.

If your website still runs on PHP 8.1 or older, there is no official update. The PHP project has published minimal backports for 7.4, 8.0 and 8.1, but moving to a supported version is safer. Ask your host about that too.

For anyone running their own server: interim measures

If you run your own servers, update PHP now or install your Linux distribution’s packages. Ubuntu and other distributions have published updates. Users of Remi’s repository should switch to distribution packages, as no updates were available there on the day of release.

If an update is not possible right away, Sansec lists these interim measures:

1. Block multipart/form-data requests at the web server. This breaks file uploads, so test your shop checkout afterwards.
2. Take the PHP server offline or serve a static maintenance page, or only allow GET and HEAD requests.
3. In the PHP configuration, turn off session.upload_progress.enabled and set memory_limit to -1. This is only a partial measure: watch memory usage and restore the limit after patching.

Cloudflare has enabled Web Application Firewall rules for known attack paths, including on free plans. The maintenance mode of WordPress or Magento does not protect you. The only complete fix is the PHP update.

Why Saldio does not use WordPress

Is Saldio affected? The short answer: no. The longer answer comes down to a decision we made right at the start.

WordPress is a great tool. It runs a huge part of the web, and the PHP team delivered the updates quickly under a lot of pressure. But for accounting software you trust with your numbers, we wanted as few moving parts as possible. These reasons tipped the balance:

1. No software running on every request. The saldio.ch website is built with Astro into finished HTML files once, and then served as plain files. There is no PHP server waiting for requests, and so nothing a flaw like PHP2Shell could exploit.
2. No third-party plugins. A typical WordPress site has dozens of plugins, each with its own code and update cycle. Each one is a potential back door. Our website has none.
3. No database and no admin login behind the website. Where there is no /wp-admin, nobody can try passwords.
4. Less patch stress. Instead of keeping server, PHP version, core and plugins up to date, we check a single build with every change. We’d rather spend that time on accounting.
5. Faster for you. Finished files from a CDN load faster than pages rebuilt on every request.

And PHP? We have nothing against PHP. But we deliberately chose a setup in which the public website needs no server logic at all and the application is strictly separate from it. The Saldio app itself is not written in PHP either and is not affected by PHP2Shell.

What this means for Saldio customers

You don’t need to do anything. Your accounting keeps running as usual. Independently of PHP2Shell, Saldio offers:

• Hosting in Switzerland, your data stays in the country.
• Sign-in with MFA and passkey via AWS Cognito, tokens stay on the server.
• Every change in the audit log, retention according to GeBüV.

The features overview shows what else belongs to security and the platform.

Conclusion

PHP2Shell is serious, but easy to fix: have the PHP version checked, install the update, done. Share this article with anyone who looks after a website or online shop. Maybe this one click prevents a bigger problem.

And if you’d like to move your accounting to a solution without patch stress while you’re at it: try Saldio free for 7 days, no payment method required, then from CHF 15 per month according to our pricing. Until 31.01.2027, the year-end special gives you a one-time 50 % off the first year.

Take care.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the name for two critical flaws in the PHP core, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. Combined, they let attackers run code on a web server without a password.

Is WordPress affected by PHP2Shell?

Yes, if the server uses an unpatched PHP version. The flaw is in PHP itself, so a WordPress or plugin update alone does not help. What matters is the PHP update on the server.

Which PHP versions close the flaw?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For PHP 7.4, 8.0 and 8.1 there are only minimal backports, moving to a supported version is safer.

Do I need to do anything on Wix, Squarespace or Shopify?

No. With site builders you don't run your own PHP server, the provider is responsible for the infrastructure.

Is Saldio affected by PHP2Shell?

No. The saldio.ch website consists of static files without PHP and without WordPress, and the Saldio app does not run on PHP either. Saldio customers don't need to do anything.