Technology Desk | October 22, 2026. Website administrators have been urged to patch supported PHP installations after two critical vulnerabilities were disclosed. The issues, tracked as CVE-2026-109618 and CVE-2026-109619, could allow remote code execution or exposure of sensitive process memory in affected environments, according to an NHS England Digital security alert published October 21.
What is PHP2Shell?
PHP is a server-side programming language used by many websites and content-management systems. The name PHP2Shell refers to two vulnerabilities involving PHP’s memory and request state. Security researchers have demonstrated proof-of-concept exploitation, making prompt remediation important. However, a proof of concept is not proof that every affected website has been attacked.
Which PHP versions are affected?
The NHS advisory identifies affected installations running PHP versions earlier than 8.5.12, 8.4.27, 8.3.36 and 8.2.35 within their respective supported branches. PHP 8.1 and earlier releases are end-of-life and should be migrated to supported versions rather than relied upon for security fixes.
What are the vulnerabilities?
CVE-2026-109618 involves memory handling during an out-of-memory error. CVE-2026-109619 involves stale global state that can reference request memory after it has been released. Under exploitable conditions, these flaws may enable an unauthenticated attacker to execute code. The NHS lists a CVSS v4 score of 9.2 for each issue.
What should WordPress and other website owners do?
First, check the PHP version used by the hosting environment. If it is affected, arrange an update to a patched supported release with the hosting provider or administrator. Back up the site, test compatibility with themes and plugins, and verify normal operation after the upgrade. Keep WordPress core, themes and plugins updated as part of routine security hygiene, but do not assume a WordPress plugin update alone fixes a vulnerability in the underlying PHP runtime.
Administrators who cannot patch immediately should conduct a risk assessment and consider taking vulnerable services offline until remediation is possible, as the NHS advises. For official technical details, consult the PHP release archive and NHS security advisory.
Is every WordPress website compromised?
No. The advisory describes vulnerable PHP software and demonstrated exploit techniques, not a confirmed compromise of every WordPress, Drupal or Joomla installation. Exposure depends on the installed PHP version and deployment conditions. Administrators should verify their own environment rather than rely on generalized claims.
See more technology coverage on NewsNationOnline. Sources: NHS England Digital and PHP security releases, October 21, 2026.
Discover more from NewsNation Online
Subscribe to get the latest posts sent to your email.
आपके लिए सुझाव
Leave a Reply