WordPress websites at risk from severe PHP flaws: emergency patch issued
If you can’t patch flawed websites, then take them offline now, CERT-EU urges.
Image by Cybernews
Follow us
- Two critical RCE flaws – dubbed PHP2Shell – could let attackers run malicious code on vulnerable servers.
- PHP powers almost 70% of websites, but the vulnerable count remains unclear.
- PHP plans to release patches and administrators should prepare to update affected systems immediately.
- CERT-EU says organizations should isolate public-facing apps if they cannot patch quickly.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Administrators of WordPress websites, online shops, and business applications were urged late Tuesday to prepare for emergency security updates after 2 critical flaws raised fears of widespread cyberattacks.
The flaws affect PHP, the programming language behind some of the internet’s biggest website platforms, including WordPress, Drupal, Joomla and Magento.
Both are classed as remote code execution (RCE) flaws, potentially allowing hackers to run malicious code on vulnerable servers, stealing customer data, installing malware, or taking websites offline.
The issue could be widespread as, according to web technology tracker W3Techs, PHP powers almost 70% of websites whose server-side programming language is known.
It remains unclear how many installations are vulnerable although a Censys report, published earlier this year, revealed that only 14% of publicly visible WordPress websites were on the latest security patch.
When will the PHP security patches be released?
The PHP security team has confirmed that patches for 2 vulnerabilities, each rated 9.2 out of 10 for severity, will be released at 3 p.m. (UK time) on Wednesday October 21st.
“All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available,” PHP said.
System administrators, hosting providers and developers are being urged to identify their PHP installations, check software versions and prepare to deploy fixes immediately.
The European Union’s Computer Emergency Response Team, CERT-EU, has advised organizations unable to patch vulnerable websites to consider taking them offline.
In its advisory issued on Tuesday CERT said:
“At this time, no technical details have been made public. CERT-EU advises organizations to prepare to patch affected assets immediately.
Where immediate patching is not feasible, organizations should consider isolating internet-facing applications from public networks until a fix is available,warns European Union’s Computer Emergency Response Team advisory.
What can WordPress website owners do now?
The vulnerabilities, identified in leaked reports as CVE-2026-109618 and CVE-2026-109619, emerged ahead of their planned disclosure, with security company watchTowr sharing its intelligence on its website.
The flaws are being dubbed "PHP2Shell" by some security researchers.
Developers have meanwhile been discussing temporary protections on X.
Security researcher Andrew Dorman @acd421 suggested disabling PHP’s session.upload_progress feature and restricting unnecessary file uploads, based on this own source-code analysis.
However, he stressed that his assessment was “moderate confidence, NOT officially confirmed,” warning administrators to prioritize official guidance when released.
Another developer, posting as Mostly Gino, urged teams to find forgotten PHP installations, including old Docker images, vendor appliances, and neglected WordPress subdomains.
“...anything on 8.1 or older is already end of life, so nothing official is coming for it,” they posted on X.
Saeed Abbasi, head of Threat Research Unit at security firm Qualys is also tracking this issue in a blog.
“Organizations should prepare for expedited patching and monitor PHP’s official security announcements to apply updates promptly once available,” he told Cybernews.
The guidance is to inventory PHP installations and identify end-of-life software, and prioritize internet-facing systems for review and remediation once affected versions are confirmed,says Saeed Abbasi, head of Threat Research Unit at Qualys.
"PHP 8.1 and earlier are no longer supported by the upstream PHP project, making these systems a priority for upgrade planning," he added.
PHP, first released in 1995, remains deeply embedded in most web infrastructure, meaning a sever flaw could affect organizations ranging from small businesses to large corporations.
The flaws follow last month’s critical vulnerabilities in Citrix NetScaler network security systems, which are used by businesses to manage and protect internet traffic.
In this case, attackers were already exploiting 2 zero-days, whereas in PHP, active exploits have yet to be established.
While a PHP proof of concept has been circulating on social media, Cybernews has chosen not to share the link until a patch is issued.
The UK's National Cyber Security Center has now issued its own alert, advising orgs to prepared for immediate PHP updates and to consider taking affected systems offline if they cannot be secured.
We will update this story once the patch details have been released.
Recent updates:
