| Security Alert
Critical PHP Flaws ("php2shell"): Is Your Website Patched?
Hi there,
On October 21, 2026, the PHP project released urgent security updates, and CISA (the U.S. Cybersecurity and Infrastructure Security Agency) urged organizations to patch immediately. I want to make sure this is on your radar, because PHP is likely running somewhere in your business even if you've never heard of it.
| What Happened
PHP is the programming language behind a huge share of the web, including every WordPress site. Two critical flaws, nicknamed “php2shell,” were found in PHP itself:
CVE-2026-109618: remote code execution through out-of-memory corruption
CVE-2026-109619: remote code execution through stale internal data left over between requests
In plain English, an attacker who doesn't need a password could send specially crafted web requests to a vulnerable site and run their own code on the server. On a server that stores or processes ePHI, that could mean a data breach. Both flaws are rated Critical (CVSS 9.2 out of 10).
As of October 21, CISA had not seen these flaws being used in attacks. That gives you a window to patch, and it's best to use it now.
| Who's Affected
According to the PHP project, the flaws affect all PHP installations that serve web requests, whatever the server setup. That includes:
WordPress websites, including your main website, booking pages, and online courses or learning portals
Patient portals, intake forms, and web apps built on PHP
Hosting providers and managed IT (MSP) environments that run sites for you
Software you bought that uses PHP behind the scenes. CISA notes that PHP is often built into other products, so you may not be able to tell it's there.
| What to Do
Update to a fixed PHP version. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Anything older on those lines is vulnerable. Linux distributions received the fixes ahead of time, so updated packages may be available from your vendor.
Ask your web host or MSP to confirm in writing that they've patched. Ask: “Are all PHP servers hosting our sites and applications updated to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or to a vendor package that includes the fixes for CVE-2026-109618 and CVE-2026-109619?” Save their answer.
Check your WordPress and plugin hosting. Updating WordPress or its plugins doesn't fix this. The fix is to the PHP version underneath, which is usually controlled by your hosting company. Look in your hosting dashboard or ask your host which PHP version each site runs.
Retire PHP 8.1 and older. These versions no longer get updates from the PHP project. CISA says systems that can't be updated right away, or that still run PHP 8.1 or earlier, should be taken offline until they're patched or upgraded. Note that PHP 8.2 reaches end of life on December 31, 2026, so plan that upgrade as well.
Inventory your PHP apps. List every website, portal, form, and web app you run or pay for, and patch internet-facing systems first. A web application firewall may give some protection while updates are underway, but only an update fully fixes the problem.
Watch for warning signs. Ask your IT provider to monitor for suspicious activity, such as web server processes launching command shells or downloading tools.
Document it. Record the vulnerability, the systems you checked, vendor confirmations, and the dates you patched in your HIPAA Security Rule risk analysis and vendor management records. If a business associate hosts or manages a PHP system that touches ePHI, their confirmation belongs in their file.
| Sources
PHP security advisory: php.net
NVD: CVE-2026-109618 and CVE-2026-109619
We Can Help
Not sure where PHP is running in your business, or what to ask your vendors? We'll help you build the inventory, get vendor confirmations, and update your risk analysis. Just reply to this email or book a time below.
Rob Van Buskirk
VanRein Compliance
Compliance, Elevated.
