What is PHP2Shell?
PHP2Shell is the name given to two security vulnerabilities in PHP, the software that runs WordPress and many other websites and applications.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect how PHP handles memory during and between web requests. Under certain conditions, an attacker could send specially crafted requests that cause PHP to execute unauthorised code or expose sensitive information.
The problem is within PHP itself. A website could therefore be affected even if its application, plugins and themes were up to date. PHP’s security advisory explains the vulnerabilities and their fixes.
Risk and severity
Both vulnerabilities have an official severity rating of critical, scoring 9.2 out of 10 under CVSS v4.0.
Successful exploitation can occur without an attacker logging in or a website visitor taking any action. Depending on the server configuration and the permissions available to PHP, potential consequences include website disruption, changes to website files and access to application data or credentials.
The likelihood of a successful attack varies between hosting configurations. Security researchers have demonstrated working attacks, and exploitation attempts have been reported publicly. This made prompt patching important. These reports do not establish that a Tervani website was compromised. Read the PHP advisories and Wiz’s findings for technical details.
What Tervani has done
We have completed PHP security updates across our hosting platform to address both vulnerabilities.
The PHP project announced patched releases on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hosting suppliers may also apply the necessary fixes to maintained packages through backports, which means a displayed version number does not always tell the whole story. See PHP’s release announcement.
Updating PHP addresses these specific vulnerabilities. It remains important to maintain website software and follow normal account-security practices.
What customers should check
If your website uses PHP managed by Tervani, you do not need to install the PHP security update yourself. This update is applied to the hosting environment.
Please take a moment to check that your website is working normally, particularly:
- Your main pages and administration login.
- Contact forms and file uploads.
- Checkout and payment journeys, if you run an online shop.
Continue keeping WordPress, plugins and themes up to date. Those updates protect a different part of your website and remain necessary alongside server maintenance.
There is no need to reset every password or restore your website solely because PHP2Shell has been disclosed. If an investigation identifies a specific issue affecting your service, the appropriate response should follow those findings.
If you manage PHP yourself
If you manage a separate server, container or PHP installation, check that it has received fixes for both CVE-2026-109618 and CVE-2026-109619. Do not assume that an update to your Tervani-managed hosting also covers systems you maintain elsewhere.
Older PHP versions require particular attention. PHP 8.1 and earlier no longer receive normal upstream security releases, so any continued use requires confirmation of appropriate fixes from the supplier or migration to a supported version.
Support and further reading
If you notice unexpected errors following the updates, please open a support ticket through the Tervani Portal. Include the affected website address, what you were doing and any error message you received. Please keep passwords and other sensitive information out of your initial message.
For further technical information, read PHP’s official security announcement and the original PHP2Shell research from Wiz.