What is PHP2Shell?
On Wednesday, October 21, 2026, the PHP project released emergency fixes for two critical security flaws, nicknamed PHP2Shell, in PHP itself. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, could let attackers run code remotely on web servers without logging in. PHP is the programming language behind a very large share of the web, including WordPress and many other site platforms. PHP rated both flaws 9.2 out of 10 for severity.
Who found it, and is it being exploited?
The flaws were found and reported by researchers at Wiz, Calif and OpenAI, and they affect nearly every PHP version back to PHP 5.4. The underlying code had been in PHP for more than a decade. Details leaked before the planned disclosure date. The two CVE IDs began circulating on forums and social media on October 20, so the PHP project moved its announcement up. Cloudflare reported early exploit attempts, but there have been no confirmed breaches.
Are Pioneer Media websites safe?
The good news is that these bugs are now fixed on Pioneer Media web servers. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. We have confirmed that the servers hosting our websites run a patched version, and our reviews found no sign that our hosted sites were affected or accessed maliciously.
If you are not a Pioneer Media client, and you are curious whether you were affected by this 9.2/10 severe flaw, send us a message – we would be happy to help you.
About the author
Leighton Smith is Pioneer Media’s website designer, web developer and webmaster, based in East Tennessee. As a solopreneur, he is each client’s one point of contact and has built hundreds of websites since learning to code in 2006.
