Your WordPress site might be one request away from becoming someone else's server. 🚨 This week PHP shipped emergency patches for two critical bugs nicknamed PHP2Shell. Not a plugin. Not a theme. PHP itself, the language running a huge share of the web. Here's what happened, why it's serious and what to do in the next hour 👇 ━━━━━━━━━━ 🔓 WHAT HAPPENED Oct 20: PHP's security team posted an unusual advance notice. A critical release was coming, details held back. The same day, details leaked online ahead of the planned Oct 22 disclosure. Oct 21: PHP rushed out the fix. The bugs: CVE-2026-109618 CVE-2026-109619 Both rated 9.2 (CVSS v4.0). Both allow unauthenticated remote code execution. No login. No account. No stolen password needed. ━━━━━━━━━━ 🧠 HOW THE BUGS WORK (PLAIN ENGLISH) Bug 1: The half-built box When PHP runs out of memory mid-request, it can stop halfway through setting up internal data. Then the cleanup code treats that half-built data as valid. An attacker who triggers this on purpose can turn the confusion into running their own code. Bug 2: The ghost of the last visitor PHP workers handle request after request. Some internal data from one request can outlive the memory behind it, and the next request on the same worker can pick up that stale leftover. Freed-but-still-used memory is a classic path to code execution. ⚠️ Apache mod_php users: PHP reports a working exploit that fires BEFORE your app code even runs. Your WordPress security plugin never gets a chance to see it. Researchers also showed these bugs can leak a PHP worker's memory, which can hold database passwords, API keys and session tokens. ━━━━━━━━━━ 🎯 WHO IS AFFECTED Anyone serving web requests with PHP: • PHP-FPM • Apache with mod_php • php-cgi • FrankenPHP • LiteSpeed That covers WordPress, WooCommerce, Drupal, Joomla, Magento, Laravel, Symfony and custom PHP apps. Hosts like DigitalOcean are telling customers to treat everything from PHP 5 onward as in scope until patched. Don't forget the PHP you forgot about: old staging sites, admin panels, that client site from 2019, Docker images you haven't rebuilt in a year. ━━━━━━━━━━ ✅ THE FIX Update to: 8.5.12 8.4.27 8.3.36 8.2.35 PHP says updating is the only complete protection. A WAF or firewall can buy time. It is not a fix. ━━━━━━━━━━ ⏱️ CHECK IN 30 SECONDS Server: run php -v WordPress: Tools → Site Health → Info → Server Managed hosting: check your host's status page, and confirm rather than assume. ━━━━━━━━━━ 🔁 THE STEP EVERYONE FORGETS After updating, RESTART PHP-FPM or your web server. Otherwise the old vulnerable code keeps running in memory. Your package manager says "patched." Your server isn't. ━━━━━━━━━━ 🪦 ON PHP 8.1 OR OLDER? You're on end-of-life PHP. No new official release for your branch. You're not patching. You're migrating. Upgrade to 8.2+ now. ━━━━━━━━━━ 🏃 WHY YOU CAN'T WAIT The details leaked before the patch, so attackers got a head start. Exploit attempts were reported within a day. No-login bugs in the language itself mean automated scanners sweep the entire internet. Some hosts say they may cut traffic to servers showing signs of compromise. Unpatched could also mean offline. ━━━━━━━━━━ 📌 TL;DR 1️⃣ Find every PHP install you run 2️⃣ Update to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 3️⃣ Restart PHP-FPM or your web server 4️⃣ On 8.1 or older? Upgrade to 8.2+ 5️⃣ Doesn't need to be public? Take it offline 🔁 Repost this. Someone you know is running a WordPress site they haven't touched in two years.