{"id":11303,"date":"2026-10-26T13:34:36","date_gmt":"2026-10-26T12:34:36","guid":{"rendered":"https:\/\/hordanso.net\/?p=11303"},"modified":"2026-10-26T13:36:51","modified_gmt":"2026-10-26T12:36:51","slug":"php2shell-cve-2026-109618-109619","status":"publish","type":"post","link":"https:\/\/hordanso.net\/en-za\/php2shell-cve-2026-109618-109619\/","title":{"rendered":"Critical PHP Vulnerabilities CVE-2026-109618 &amp; CVE-2026-109619: What WordPress and WHMCS Owners Need to Do Now"},"content":{"rendered":"\n<style data-wp-block-html=\"css\">\n.hordanso-blog {\n  max-width: 850px;\n  margin: 0 auto;\n  font-family: 'Inter', Arial, sans-serif;\n  line-height: 1.75;\n  color: #1a1a1a;\n  padding: 20px;\n}\n.blog-header { margin-bottom: 8px; }\n.hordanso-blog .eyebrow {\n  display: inline-block;\n  font-size: 13px;\n  font-weight: 700;\n  letter-spacing: 0.06em;\n  text-transform: uppercase;\n  color: #fe5a53;\n  margin-bottom: 10px;\n}\n.hordanso-blog h1 {\n  font-size: 36px;\n  line-height: 1.25;\n  margin: 0 0 18px;\n  color: #111;\n  font-weight: 800;\n}\n.hordanso-blog .lead {\n  font-size: 18px;\n  color: #444;\n  margin-bottom: 28px;\n}\n.hordanso-blog h2 {\n  margin-top: 46px;\n  margin-bottom: 16px;\n  font-size: 24px;\n  font-weight: 700;\n  color: #111;\n  padding-bottom: 10px;\n  border-bottom: 2px solid #f1f1f1;\n}\n.hordanso-blog p {\n  margin-bottom: 16px;\n  font-size: 16px;\n  color: #2a2a2a;\n}\n.hordanso-blog a { color: #fe5a53; text-decoration: underline; }\n.hordanso-blog a:hover { color: #e94d46; }\n.hordanso-blog code {\n  background: #f6f6f6;\n  border: 1px solid #ececec;\n  border-radius: 5px;\n  padding: 1px 6px;\n  font-size: 14px;\n}\n\n.hordanso-blog ul,\n.hordanso-blog ol {\n  padding-left: 4px;\n  margin-bottom: 22px;\n  list-style: none;\n}\n.hordanso-blog .numbered-list {\n  counter-reset: step-counter;\n  padding-left: 0;\n}\n.hordanso-blog .numbered-list li {\n  counter-increment: step-counter;\n  position: relative;\n  padding-left: 44px;\n  margin-bottom: 14px;\n}\n.hordanso-blog .numbered-list li::before {\n  content: counter(step-counter);\n  position: absolute;\n  left: 0;\n  top: 0;\n  width: 28px;\n  height: 28px;\n  background: #fe5a53;\n  color: #fff;\n  border-radius: 50%;\n  font-size: 14px;\n  font-weight: 700;\n  display: flex;\n  align-items: center;\n  justify-content: center;\n}\n.hordanso-blog .check-list li {\n  position: relative;\n  padding-left: 30px;\n  margin-bottom: 12px;\n}\n.hordanso-blog .check-list li::before {\n  content: \"\\2713\";\n  position: absolute;\n  left: 0;\n  top: 1px;\n  width: 20px;\n  height: 20px;\n  background: #e8f7ee;\n  color: #1fa855;\n  border-radius: 50%;\n  font-size: 12px;\n  font-weight: 700;\n  display: flex;\n  align-items: center;\n  justify-content: center;\n  line-height: 1;\n}\n\n.table-wrap {\n  overflow-x: auto;\n  margin: 22px 0 32px;\n  border-radius: 12px;\n  border: 1px solid #ececec;\n}\n.hordanso-blog table {\n  width: 100%;\n  border-collapse: collapse;\n  font-size: 15px;\n  min-width: 480px;\n}\n.hordanso-blog th,\n.hordanso-blog td {\n  padding: 14px 16px;\n  text-align: left;\n  border-bottom: 1px solid #f0f0f0;\n}\n.hordanso-blog th {\n  background: #fafafa;\n  font-weight: 700;\n  color: #111;\n  font-size: 14px;\n}\n.hordanso-blog tbody tr:last-child td { border-bottom: none; }\n.hordanso-blog tbody tr:hover { background: #fcfcfc; }\n\n.compare-table .cell-good { color: #146c3f; }\n.compare-table .cell-bad { color: #8a2e2e; }\n.compare-table thead th:first-child { background: #eefaf3; color: #146c3f; }\n.compare-table thead th:last-child { background: #fdeeee; color: #8a2e2e; }\n\n.audit-table .q-col { width: 66%; }\n.audit-table .icon-col { text-align: center; width: 17%; }\n.audit-table th.icon-col { color: #444; font-size: 14px; }\n\n.icon {\n  display: inline-flex;\n  align-items: center;\n  justify-content: center;\n  width: 26px;\n  height: 26px;\n  border-radius: 50%;\n  font-size: 14px;\n  font-weight: 800;\n  line-height: 1;\n}\n.icon-yes { background: #e8f7ee; color: #1fa855; }\n.icon-no { background: #fdecec; color: #e54848; }\nth .icon { width: 18px; height: 18px; font-size: 11px; margin-right: 4px; vertical-align: middle; }\n\n.cta-inline { margin: 24px 0 8px; }\n.cta-box {\n  margin: 32px 0;\n  padding: 28px 24px;\n  border: 1px solid #f0e3e2;\n  background: #fff8f7;\n  border-radius: 14px;\n  text-align: center;\n}\n.cta-box p { margin-bottom: 14px; font-size: 17px; }\n\n.hordanso-blog .cta-button,\n.hordanso-blog .cta-button:visited {\n  display: inline-flex;\n  align-items: center;\n  gap: 8px;\n  padding: 14px 26px;\n  text-decoration: none !important;\n  font-weight: 700;\n  font-size: 15px;\n  border-radius: 8px;\n  background: #fe5a53 !important;\n  color: #ffffff !important;\n  border: 2px solid #fe5a53;\n  transition: all 0.2s ease;\n  white-space: nowrap;\n}\n.hordanso-blog .cta-button:hover {\n  background: #e94d46 !important;\n  border-color: #e94d46;\n  color: #ffffff !important;\n  text-decoration: none !important;\n  transform: translateY(-2px);\n  box-shadow: 0 8px 18px rgba(254, 90, 83, 0.28);\n}\n.hordanso-blog .cta-button .cta-arrow {\n  transition: transform 0.2s ease;\n}\n.hordanso-blog .cta-button:hover .cta-arrow {\n  transform: translateX(3px);\n}\n.hordanso-blog .cta-button.cta-outline {\n  background: #ffffff !important;\n  color: #fe5a53 !important;\n}\n.hordanso-blog .cta-button.cta-outline:hover {\n  background: #fff3f2 !important;\n  color: #e94d46 !important;\n}\n\n.multi-cta {\n  display: flex;\n  flex-wrap: wrap;\n  justify-content: center;\n  align-items: center;\n  gap: 16px;\n  margin: 40px 0;\n  padding: 28px 20px;\n  background: #fafafa;\n  border-radius: 14px;\n}\n.hordanso-blog .multi-cta .cta-button {\n  margin: 0;\n}\n\n.faq { margin-top: 24px; }\n.faq-item {\n  border: 1px solid #eee;\n  border-radius: 10px;\n  margin-bottom: 12px;\n  overflow: hidden;\n  transition: border-color 0.2s ease;\n}\n.faq-item.active { border-color: #fe5a53; }\n.faq-question {\n  width: 100%;\n  display: flex;\n  align-items: center;\n  justify-content: space-between;\n  gap: 16px;\n  text-align: left;\n  border: none;\n  background: #fff;\n  font-size: 16px;\n  font-weight: 600;\n  color: #111;\n  cursor: pointer;\n  padding: 18px 20px;\n  margin: 0;\n  transition: background 0.2s ease;\n}\n.faq-item.active .faq-question { background: #fff5f4; color: #d94840; }\n.faq-question:hover { background: #fafafa; }\n.faq-icon {\n  flex-shrink: 0;\n  position: relative;\n  width: 22px;\n  height: 22px;\n  border-radius: 50%;\n  background: #fe5a53;\n}\n.faq-icon::before,\n.faq-icon::after {\n  content: \"\";\n  position: absolute;\n  background: #fff;\n  top: 50%;\n  left: 50%;\n  transform: translate(-50%, -50%);\n}\n.faq-icon::before { width: 10px; height: 2px; }\n.faq-icon::after { width: 2px; height: 10px; transition: transform 0.25s ease; }\n.faq-item.active .faq-icon::after { transform: translate(-50%, -50%) rotate(90deg) scaleY(0); }\n.faq-answer {\n  max-height: 0;\n  overflow: hidden;\n  transition: max-height 0.3s ease;\n  background: #fff;\n}\n.faq-answer p {\n  padding: 0 20px 18px;\n  margin: 0;\n  color: #444;\n  font-size: 15px;\n}\n\n\/* ---------- Blog images ---------- *\/\n.hordanso-blog .blog-image {\n  margin: 26px 0 30px;\n  text-align: center;\n}\n.hordanso-blog .blog-image img {\n  max-width: 100%;\n  height: auto;\n  display: inline-block;\n  border-radius: 12px;\n  border: 1px solid #ececec;\n  box-shadow: 0 6px 18px rgba(0, 0, 0, 0.06);\n}\n.hordanso-blog .blog-image--narrow img {\n  max-width: 272px;\n}\n\n.map-section {\n  margin-top: 48px;\n  padding-top: 36px;\n  border-top: 2px solid #f1f1f1;\n}\n.map-section h2 { border-bottom: none; margin-bottom: 10px; }\n.map-wrap {\n  border-radius: 14px;\n  overflow: hidden;\n  border: 1px solid #ececec;\n  box-shadow: 0 6px 18px rgba(0,0,0,0.06);\n  position: relative;\n  padding-bottom: 56.25%;\n  height: 0;\n  margin-top: 18px;\n}\n.map-wrap iframe {\n  position: absolute;\n  top: 0;\n  left: 0;\n  width: 100%;\n  height: 100%;\n  border: 0;\n}\n\n@media (max-width: 600px) {\n  .hordanso-blog h1 { font-size: 27px; }\n  .hordanso-blog h2 { font-size: 21px; }\n  .multi-cta { flex-direction: column; }\n  .hordanso-blog .multi-cta .cta-button { width: 100%; justify-content: center; }\n  .audit-table .q-col { width: 60%; }\n  .hordanso-blog .blog-image img { border-radius: 10px; }\n}\n<\/style>\n\n<script data-wp-block-html=\"js\">\ndocument.addEventListener(\"DOMContentLoaded\", function () {\n  const items = document.querySelectorAll(\".faq-item\");\n\n  items.forEach((item) => {\n    const question = item.querySelector(\".faq-question\");\n    const answer = item.querySelector(\".faq-answer\");\n\n    question.addEventListener(\"click\", () => {\n      const isOpen = item.classList.contains(\"active\");\n\n      items.forEach((other) => {\n        other.classList.remove(\"active\");\n        other.querySelector(\".faq-question\").setAttribute(\"aria-expanded\", \"false\");\n        other.querySelector(\".faq-answer\").style.maxHeight = null;\n      });\n\n      if (!isOpen) {\n        item.classList.add(\"active\");\n        question.setAttribute(\"aria-expanded\", \"true\");\n        answer.style.maxHeight = answer.scrollHeight + \"px\";\n      }\n    });\n  });\n});\n<\/script>\n\n<!-- Hordanso blog: php2shell. Add blog.css to your theme or Custom CSS, and blog.js to your site scripts. -->\n<article class=\"hordanso-blog\">\n  <header class=\"blog-header\">\n    <p class=\"eyebrow\">WordPress Security &amp; Maintenance<\/p>\n    <h4>\n      PHP2Shell: Critical PHP Vulnerabilities (CVE-2026-109618 &amp;\n      CVE-2026-109619) and What They Mean for Your WordPress and WHMCS Sites\n    <\/h4>\n    <p class=\"lead\">\n      On 21 October 2026, the PHP project released emergency security updates\n      for two critical flaws that can let an attacker run commands on your\n      server without logging in. If your website runs on WordPress, WHMCS,\n      Laravel, Joomla, Magento or any other PHP application, this affects you,\n      even if your software is fully up to date.\n    <\/p>\n    <p>\n      This guide explains what happened in plain language, what you need to do\n      right now, and how Hordanso&#8217;s WordPress Maintenance service keeps your\n      site patched so you never have to chase these updates yourself.\n    <\/p>\n  <\/header>\n\n  <div class=\"cta-inline\">\n    <a class=\"cta-button\" href=\"https:\/\/hordanso.net\/en-za\/wordpress-maintenance\/\">\n      Get WordPress Maintenance\n    <\/a>\n  <\/div>\n\n  <h2>The Short Version<\/h2>\n  <ul class=\"check-list\">\n    <li>\n      Two critical vulnerabilities, <strong>CVE-2026-109618<\/strong> and\n      <strong>CVE-2026-109619<\/strong> (nicknamed &#8220;php2shell&#8221;), were found in\n      PHP itself, not in WordPress or any single plugin.\n    <\/li>\n    <li>\n      They can allow\n      <strong>unauthenticated remote code execution (RCE)<\/strong>. An attacker\n      does not need a username or password.\n    <\/li>\n    <li>\n      Fixed versions are <strong>PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35<\/strong>,\n      released 21 October 2026.\n    <\/li>\n    <li>\n      <strong\n        >Updating WordPress, WHMCS or your plugins does not fix this.<\/strong\n      >\n      The fix lives at the server level, where PHP is installed.\n    <\/li>\n    <li>\n      Sites on PHP 8.1 or older receive no official fix and need a vendor\n      backport or an upgrade.\n    <\/li>\n  <\/ul>\n\n  <h2>What Is PHP, and Why Does This Matter?<\/h2>\n  <p>\n    PHP is the programming language that powers a huge share of the web.\n    WordPress is built on it. So are WHMCS (the billing and client management\n    system used by hosting companies), Laravel, Joomla, Drupal, Magento,\n    PrestaShop, phpBB and thousands of custom business applications.\n  <\/p>\n  <p>\n    Because PHP sits underneath all of these, a flaw in PHP is a flaw in every\n    site running on it. A fully patched WordPress install on an unpatched PHP is\n    still exposed.\n  <\/p>\n\n  <h2>What Are CVE-2026-109618 and CVE-2026-109619?<\/h2>\n  <p>\n    Both were announced in the official PHP security advisory on 21 October\n    2026.\n  <\/p>\n  <p>\n    <strong>CVE-2026-109618<\/strong> is a memory-handling flaw. When PHP runs\n    out of memory while processing a request, it can be interrupted while\n    internal data is only partly set up. PHP&#8217;s cleanup then treats that\n    incomplete data as valid, which can be abused to corrupt memory.\n  <\/p>\n  <p>\n    <strong>CVE-2026-109619<\/strong> is a stale-state flaw. Request-related\n    internal data can survive after the memory behind it has been freed. A later\n    request handled by the same worker may then use that stale data before PHP\n    resets it.\n  <\/p>\n  <p>\n    In simple terms, both bugs let a crafted web request confuse PHP&#8217;s internal\n    bookkeeping, and under the right conditions that can be turned into running\n    an attacker&#8217;s commands on your server.\n  <\/p>\n\n  <h2>Who Is Most at Risk?<\/h2>\n  <p>\n    PHP&#8217;s advisory says all PHP installations that serve web requests are\n    affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and\n    LiteSpeed. The risk is considered highest for\n    <strong>Apache with mod_php<\/strong>, where a demonstrated exploit can\n    trigger before any application code runs. That means a WordPress security\n    plugin or a login page may not stop it.\n  <\/p>\n\n  <h2>A Third Issue to Watch: Session Upload Progress<\/h2>\n  <p>\n    On 23 October 2026, the PHP team published an informational advisory about a\n    related, unlikely attack route involving the session upload progress\n    feature. It needs an unusual combination of settings and application code,\n    so the full advisory (CVE-2026-115560) will come with the next regular PHP\n    release.\n  <\/p>\n  <p>\n    Until then, PHP recommends setting\n    <code>session.upload_progress.enabled=0<\/code>. WordPress core does not use\n    this feature, so turning it off is low risk for most sites.\n  <\/p>\n\n  <h2>Why Updating WordPress Is Not Enough<\/h2>\n  <p>\n    WordPress updates itself, and many people assume that means their site is\n    always safe. But WordPress cannot update the PHP version on your server.\n    That is controlled by your hosting provider or whoever manages your server.\n    If nobody is responsible for it, it simply does not get done.\n  <\/p>\n  <p>\n    The same applies to WHMCS, Laravel and every other PHP application. Updating\n    the application does not update the language underneath it.\n  <\/p>\n\n  <div class=\"table-wrap\">\n    <table class=\"compare-table\">\n      <thead>\n        <tr>\n          <th>Protected site<\/th>\n          <th>Exposed site<\/th>\n        <\/tr>\n      <\/thead>\n      <tbody>\n        <tr>\n          <td class=\"cell-good\">PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35<\/td>\n          <td class=\"cell-bad\">\n            Older PHP builds, or 8.1 and below with no vendor backport\n          <\/td>\n        <\/tr>\n        <tr>\n          <td class=\"cell-good\">\n            Session upload progress turned off at server level\n          <\/td>\n          <td class=\"cell-bad\">Session upload progress left on by default<\/td>\n        <\/tr>\n        <tr>\n          <td class=\"cell-good\">WordPress 6.8.6, 6.9.5, 7.0.2 or newer<\/td>\n          <td class=\"cell-bad\">WordPress core behind on security releases<\/td>\n        <\/tr>\n        <tr>\n          <td class=\"cell-good\">\n            Someone clearly responsible for server-level PHP updates\n          <\/td>\n          <td class=\"cell-bad\">\n            Nobody owns PHP updates, so they never happen\n          <\/td>\n        <\/tr>\n        <tr>\n          <td class=\"cell-good\">Fresh backups and monitoring in place<\/td>\n          <td class=\"cell-bad\">\n            No recent backup, no alerts if something changes\n          <\/td>\n        <\/tr>\n      <\/tbody>\n    <\/table>\n  <\/div>\n\n  <h2>Is WordPress Facing Any Other Critical Flaws Right Now?<\/h2>\n  <p>\n    Yes. Separately from the PHP issue, WordPress core had its own pair of\n    serious flaws in July 2026, known as\n    <strong>WP2Shell<\/strong> (CVE-2026-63030 and CVE-2026-60137). Together they\n    can allow unauthenticated takeover of a vulnerable site. The fixed versions\n    are <strong>WordPress 6.8.6, 6.9.5 and 7.0.2<\/strong>.\n  <\/p>\n  <p>\n    So a healthy WordPress site today needs two things: a patched WordPress core\n    <strong>and<\/strong> a patched PHP. Missing either one leaves a door open.\n  <\/p>\n\n  <h2>What You Should Do Right Now<\/h2>\n  <ol class=\"numbered-list\">\n    <li>\n      <strong>Find out your PHP version.<\/strong> Ask your host, check your\n      hosting control panel, or in WordPress go to Tools, Site Health, Info,\n      Server. With command-line access, run <code>php -v<\/code>.\n    <\/li>\n    <li>\n      <strong>Update PHP to a patched version.<\/strong> Target 8.5.12, 8.4.27,\n      8.3.36 or 8.2.35. If your host uses distribution packages, confirm the\n      package status, because patches may be backported under older version\n      numbers.\n    <\/li>\n    <li>\n      <strong>Turn off session upload progress.<\/strong> Set\n      <code>session.upload_progress.enabled=0<\/code> in php.ini or your PHP-FPM\n      pool settings and restart PHP workers. Do not rely on\n      <code>ini_set()<\/code> or <code>.user.ini<\/code> for this.\n    <\/li>\n    <li>\n      <strong>Update WordPress core and plugins.<\/strong> Make sure WordPress is\n      on 6.8.6, 6.9.5, 7.0.2 or newer, and that all plugins and themes are\n      current.\n    <\/li>\n    <li>\n      <strong>If you cannot update immediately,<\/strong> PHP lists partial\n      measures such as a low <code>post_max_size<\/code> and request limits at\n      the web server or proxy. These only reduce exposure and do not make a\n      server safe. Treat them as a short-term bridge.\n    <\/li>\n    <li>\n      <strong>Back up and monitor.<\/strong> Take a fresh backup before changing\n      PHP versions, then watch for unusual admin accounts, unknown files in\n      <code>wp-content<\/code>, unexpected redirects and spikes in server load.\n    <\/li>\n  <\/ol>\n\n  <div class=\"cta-box\">\n    <p>\n      Not sure who manages PHP on your server, or whether your site is exposed?\n      We will check it for you.\n    <\/p>\n    <a class=\"cta-button\" href=\"https:\/\/hordanso.net\/en-za\/wordpress-maintenance\/\">\n      Talk to Us About WordPress Maintenance\n    <\/a>\n  <\/div>\n\n  <h2>What About WHMCS and Other PHP Applications?<\/h2>\n  <p>\n    <strong>WHMCS<\/strong> runs on PHP and requires a supported PHP version. If\n    your WHMCS server is on an unpatched PHP, your billing data, client records\n    and API credentials sit behind the same exposure. Before upgrading PHP on a\n    WHMCS server, confirm that your WHMCS version supports the target PHP\n    version and that your ionCube Loader is compatible.\n  <\/p>\n  <p>\n    <strong>Other PHP applications<\/strong> such as Laravel, Joomla, Drupal,\n    Magento, PrestaShop, custom portals and legacy scripts should be inventoried\n    too. Old internal tools on forgotten servers are often the weakest link.\n  <\/p>\n\n  <h2>The End-of-Life Problem<\/h2>\n  <p>\n    This incident is a reminder of why running old PHP is risky. Here is where\n    each PHP branch stands under the official support policy.\n  <\/p>\n\n  <div class=\"table-wrap\">\n    <table>\n      <thead>\n        <tr>\n          <th>PHP version<\/th>\n          <th>Security support ends<\/th>\n          <th>Latest patched release<\/th>\n        <\/tr>\n      <\/thead>\n      <tbody>\n        <tr>\n          <td>8.5<\/td>\n          <td>31 December 2029<\/td>\n          <td>8.5.12<\/td>\n        <\/tr>\n        <tr>\n          <td>8.4<\/td>\n          <td>31 December 2028<\/td>\n          <td>8.4.27<\/td>\n        <\/tr>\n        <tr>\n          <td>8.3<\/td>\n          <td>31 December 2027<\/td>\n          <td>8.3.36<\/td>\n        <\/tr>\n        <tr>\n          <td>8.2<\/td>\n          <td>31 December 2026<\/td>\n          <td>8.2.35<\/td>\n        <\/tr>\n        <tr>\n          <td>8.1 and older<\/td>\n          <td>Already ended<\/td>\n          <td>No official fix (source backports or vendor patches only)<\/td>\n        <\/tr>\n      <\/tbody>\n    <\/table>\n  <\/div>\n\n  <p>\n    If you are on 8.2 or older, plan your upgrade now rather than waiting for\n    the next emergency.\n  <\/p>\n\n  <h2>How Hordanso Keeps Your Site Safe<\/h2>\n  <p>\n    Patching PHP, WordPress core, plugins and themes is exactly the kind of work\n    that gets forgotten until something breaks. Our\n    <a href=\"https:\/\/hordanso.net\/en-za\/wordpress-maintenance\/\"\n      >WordPress Maintenance and Website Care<\/a\n    >\n    service takes it off your plate.\n  <\/p>\n  <ul class=\"check-list\">\n    <li>Server-level PHP version management and security updates<\/li>\n    <li>\n      WordPress core, plugin and theme updates, tested before they go live\n    <\/li>\n    <li>Regular off-site backups and easy restores<\/li>\n    <li>Security monitoring and malware scanning<\/li>\n    <li>Uptime and performance monitoring<\/li>\n    <li>Fast help when something goes wrong<\/li>\n  <\/ul>\n\n  <div class=\"multi-cta\">\n    <a class=\"cta-button\" href=\"https:\/\/hordanso.net\/en-za\/wordpress-maintenance\/\">\n      WordPress Maintenance\n    <\/a>\n    <a class=\"cta-button cta-outline\" href=\"https:\/\/hordanso.net\/en-za\/web-hosting\/\">\n      Explore Web Hosting Plans\n    <\/a>\n  <\/div>\n\n  <h2>Frequently Asked Questions<\/h2>\n  <div class=\"faq\">\n    <div class=\"faq-item\">\n      <button class=\"faq-question\" aria-expanded=\"false\">\n        <span>What are CVE-2026-109618 and CVE-2026-109619?<\/span>\n        <span class=\"faq-icon\" aria-hidden=\"true\"><\/span>\n      <\/button>\n      <div class=\"faq-answer\">\n        <p>\n          They are two critical security flaws in PHP itself, fixed on 21\n          October 2026. They can allow unauthenticated remote code execution,\n          meaning an attacker may be able to run commands on a vulnerable server\n          without logging in.\n        <\/p>\n      <\/div>\n    <\/div>\n\n    <div class=\"faq-item\">\n      <button class=\"faq-question\" aria-expanded=\"false\">\n        <span>Is my WordPress site affected?<\/span>\n        <span class=\"faq-icon\" aria-hidden=\"true\"><\/span>\n      <\/button>\n      <div class=\"faq-answer\">\n        <p>\n          If your site runs on an unpatched PHP version, yes. WordPress is not\n          the source of the flaw, but it runs on PHP, so the server underneath\n          it is what needs fixing.\n        <\/p>\n      <\/div>\n    <\/div>\n\n    <div class=\"faq-item\">\n      <button class=\"faq-question\" aria-expanded=\"false\">\n        <span>Will WordPress automatic updates fix this?<\/span>\n        <span class=\"faq-icon\" aria-hidden=\"true\"><\/span>\n      <\/button>\n      <div class=\"faq-answer\">\n        <p>\n          No. WordPress updates its own core, plugins and themes, but it cannot\n          change the PHP version installed on your server. That update must be\n          done by your hosting provider or server administrator.\n        <\/p>\n      <\/div>\n    <\/div>\n\n    <div class=\"faq-item\">\n      <button class=\"faq-question\" aria-expanded=\"false\">\n        <span>Which PHP versions fix the problem?<\/span>\n        <span class=\"faq-icon\" aria-hidden=\"true\"><\/span>\n      <\/button>\n      <div class=\"faq-answer\">\n        <p>\n          PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP project also provided\n          minimal source backports for 7.4, 8.0 and 8.1 for people building from\n          source. Many Linux vendors backport fixes to older packages, so check\n          with yours.\n        <\/p>\n      <\/div>\n    <\/div>\n\n    <div class=\"faq-item\">\n      <button class=\"faq-question\" aria-expanded=\"false\">\n        <span>How do I check my PHP version?<\/span>\n        <span class=\"faq-icon\" aria-hidden=\"true\"><\/span>\n      <\/button>\n      <div class=\"faq-answer\">\n        <p>\n          In WordPress, go to Tools, then Site Health, then Info, then Server.\n          In cPanel or a similar panel, look for MultiPHP Manager or Select PHP\n          Version. From the command line, run php -v.\n        <\/p>\n      <\/div>\n    <\/div>\n\n    <div class=\"faq-item\">\n      <button class=\"faq-question\" aria-expanded=\"false\">\n        <span>Does this affect WHMCS?<\/span>\n        <span class=\"faq-icon\" aria-hidden=\"true\"><\/span>\n      <\/button>\n      <div class=\"faq-answer\">\n        <p>\n          Yes, if your WHMCS server runs an unpatched PHP version. Update PHP at\n          the server level, but first confirm your WHMCS version and ionCube\n          Loader support the new PHP version, and test on a staging copy if\n          possible.\n        <\/p>\n      <\/div>\n    <\/div>\n\n    <div class=\"faq-item\">\n      <button class=\"faq-question\" aria-expanded=\"false\">\n        <span>What if I am running PHP 8.1 or older?<\/span>\n        <span class=\"faq-icon\" aria-hidden=\"true\"><\/span>\n      <\/button>\n      <div class=\"faq-answer\">\n        <p>\n          The PHP project does not release official updates for these versions.\n          Ask your hosting provider or Linux vendor whether they provide a\n          backported fix, or upgrade to a supported version such as 8.3, 8.4 or\n          8.5.\n        <\/p>\n      <\/div>\n    <\/div>\n\n    <div class=\"faq-item\">\n      <button class=\"faq-question\" aria-expanded=\"false\">\n        <span>Can a security plugin or firewall protect me?<\/span>\n        <span class=\"faq-icon\" aria-hidden=\"true\"><\/span>\n      <\/button>\n      <div class=\"faq-answer\">\n        <p>\n          It can help, but it is not a complete fix. PHP&#8217;s advisory notes that\n          the most serious attack path can run before application code loads, so\n          WordPress security plugins may not catch it. A web application\n          firewall can reduce risk, but patching PHP is the only complete\n          solution.\n        <\/p>\n      <\/div>\n    <\/div>\n\n    <div class=\"faq-item\">\n      <button class=\"faq-question\" aria-expanded=\"false\">\n        <span>Is turning off session upload progress safe?<\/span>\n        <span class=\"faq-icon\" aria-hidden=\"true\"><\/span>\n      <\/button>\n      <div class=\"faq-answer\">\n        <p>\n          For most sites, yes. WordPress core does not use it. Only applications\n          that rely on upload progress bars tied to PHP sessions might notice a\n          change. Apply it in your server configuration, then restart PHP.\n        <\/p>\n      <\/div>\n    <\/div>\n\n    <div class=\"faq-item\">\n      <button class=\"faq-question\" aria-expanded=\"false\">\n        <span>How do I know if my site has already been compromised?<\/span>\n        <span class=\"faq-icon\" aria-hidden=\"true\"><\/span>\n      <\/button>\n      <div class=\"faq-answer\">\n        <p>\n          Warning signs include unknown admin users, unfamiliar files or\n          plugins, unexpected redirects or pop-ups, sudden slowdowns, spam\n          emails sent from your domain, and security warnings from Google. If\n          you suspect a compromise, restore from a clean backup, change all\n          passwords and keys, and get professional help.\n        <\/p>\n      <\/div>\n    <\/div>\n\n    <div class=\"faq-item\">\n      <button class=\"faq-question\" aria-expanded=\"false\">\n        <span>Should I upgrade PHP myself?<\/span>\n        <span class=\"faq-icon\" aria-hidden=\"true\"><\/span>\n      <\/button>\n      <div class=\"faq-answer\">\n        <p>\n          It is possible, but a badly handled upgrade can break themes, plugins\n          or billing systems. If you are not comfortable with servers, backups\n          and rollbacks, it is safer to have a maintenance provider do it.\n        <\/p>\n      <\/div>\n    <\/div>\n\n    <div class=\"faq-item\">\n      <button class=\"faq-question\" aria-expanded=\"false\">\n        <span>Does Hordanso handle this for maintained sites?<\/span>\n        <span class=\"faq-icon\" aria-hidden=\"true\"><\/span>\n      <\/button>\n      <div class=\"faq-answer\">\n        <p>\n          Sites on our maintenance plans get server-level PHP updates and\n          security monitoring as part of the service.\n          <a href=\"https:\/\/hordanso.net\/en-za\/wordpress-maintenance\/\"\n            >See our WordPress Maintenance page<\/a\n          >\n          or contact us to have your site checked.\n        <\/p>\n      <\/div>\n    <\/div>\n  <\/div>\n\n  <h2>Glossary: Terms You Will See in PHP and WordPress Security News<\/h2>\n  <div class=\"table-wrap\">\n    <table>\n      <thead>\n        <tr>\n          <th>Term<\/th>\n          <th>Meaning<\/th>\n        <\/tr>\n      <\/thead>\n      <tbody>\n        <tr>\n          <td><strong>CVE<\/strong><\/td>\n          <td>\n            Common Vulnerabilities and Exposures. A unique ID, such as\n            CVE-2026-109618, given to a publicly known security flaw so everyone\n            can refer to the same issue.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>CVSS<\/strong><\/td>\n          <td>\n            Common Vulnerability Scoring System. A 0 to 10 score of how severe a\n            vulnerability is. Scores of 9.0 and above are critical.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>RCE<\/strong><\/td>\n          <td>\n            Remote Code Execution. A flaw that lets an attacker run their own\n            commands on your server from afar.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Unauthenticated<\/strong><\/td>\n          <td>\n            Requiring no login. An unauthenticated flaw can be exploited by\n            anyone on the internet.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Zero-day<\/strong><\/td>\n          <td>\n            A vulnerability that attackers know about or exploit before a patch\n            is available.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Exploit<\/strong><\/td>\n          <td>Code or a technique that takes advantage of a vulnerability.<\/td>\n        <\/tr>\n        <tr>\n          <td><strong>PoC<\/strong><\/td>\n          <td>\n            Proof of Concept. A demonstration that a vulnerability can be\n            exploited. Public PoCs make attacks easier, so patching quickly\n            matters.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Patch<\/strong><\/td>\n          <td>A software update that fixes a bug or vulnerability.<\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Backport<\/strong><\/td>\n          <td>\n            A fix from a newer version applied to an older version, usually by a\n            Linux vendor, so the old version stays safe without a full upgrade.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Bug fixes (active support)<\/strong><\/td>\n          <td>\n            The phase of a PHP version&#8217;s life when it receives regular bug fixes\n            and security patches.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Security fixes (security support)<\/strong><\/td>\n          <td>\n            The phase after active support, when only critical security issues\n            are fixed and releases happen only when needed.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>EOL<\/strong><\/td>\n          <td>\n            End of Life. The date after which a software version gets no more\n            updates of any kind, including security fixes.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>LTS<\/strong><\/td>\n          <td>\n            Long-Term Support. A version supported for longer than usual, often\n            by a vendor, with security patches continuing for years.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>PHP<\/strong><\/td>\n          <td>\n            A widely used server-side programming language that powers\n            WordPress, WHMCS and many other web applications.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>PHP-FPM<\/strong><\/td>\n          <td>\n            A common way of running PHP for websites, handling requests through\n            a pool of worker processes.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>mod_php<\/strong><\/td>\n          <td>\n            A way of running PHP inside the Apache web server itself. It carries\n            the highest risk in this incident.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>php.ini<\/strong><\/td>\n          <td>\n            The main configuration file for PHP, where settings like memory\n            limits and upload sizes are set.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>memory_limit<\/strong><\/td>\n          <td>A PHP setting that caps how much memory a script can use.<\/td>\n        <\/tr>\n        <tr>\n          <td><strong>post_max_size<\/strong><\/td>\n          <td>\n            A PHP setting that limits the size of data sent to the server in a\n            request.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Session upload progress<\/strong><\/td>\n          <td>\n            A rarely used PHP feature that tracks file upload progress using\n            sessions. It is the confirmed attack route in this advisory.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Web server<\/strong><\/td>\n          <td>\n            Software such as Apache, Nginx or LiteSpeed that receives requests\n            from visitors and passes them to PHP.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>WAF<\/strong><\/td>\n          <td>\n            Web Application Firewall. A filter that blocks suspicious web\n            requests before they reach your site. Helpful, but not a replacement\n            for patching.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>WordPress core<\/strong><\/td>\n          <td>\n            The main WordPress software, separate from plugins and themes.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>WP2Shell<\/strong><\/td>\n          <td>\n            The nickname for two critical WordPress core flaws (CVE-2026-63030\n            and CVE-2026-60137) disclosed in July 2026.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>WHMCS<\/strong><\/td>\n          <td>\n            A billing, automation and client management platform widely used by\n            web hosting companies. It is built on PHP.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>ionCube Loader<\/strong><\/td>\n          <td>\n            A PHP extension required to run encoded PHP applications such as\n            WHMCS. It must be compatible with your PHP version.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Staging site<\/strong><\/td>\n          <td>\n            A private copy of your website used to test changes, such as a PHP\n            upgrade, before applying them to the live site.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Backup<\/strong><\/td>\n          <td>\n            A saved copy of your site&#8217;s files and database that lets you restore\n            after a failed update or an attack.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Hardening<\/strong><\/td>\n          <td>\n            Tightening server and application settings to reduce the chance of a\n            successful attack.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Malware<\/strong><\/td>\n          <td>\n            Malicious software, such as backdoors and web shells, planted on a\n            compromised site.\n          <\/td>\n        <\/tr>\n        <tr>\n          <td><strong>Web shell<\/strong><\/td>\n          <td>\n            A hidden script that gives an attacker remote control over a hacked\n            server.\n          <\/td>\n        <\/tr>\n      <\/tbody>\n    <\/table>\n  <\/div>\n\n  <h2>Final Thoughts<\/h2>\n  <p>\n    The php2shell vulnerabilities are a reminder that website security is not\n    only about WordPress or your plugins. It also depends on the PHP version\n    running underneath them, and on someone being responsible for keeping it\n    current.\n  <\/p>\n  <p>\n    If you would rather not track advisories, test upgrades and restart servers\n    yourself, let us handle it. Explore Hordanso&#8217;s\n    <a href=\"https:\/\/hordanso.net\/en-za\/wordpress-maintenance\/\"\n      >WordPress Maintenance and Website Care<\/a\n    >\n    service and keep your site secure, fast and online.\n  <\/p>\n\n  <div class=\"cta-box\">\n    <p>Keep your site secure, fast and online with Hordanso.<\/p>\n    <a class=\"cta-button\" href=\"https:\/\/hordanso.net\/en-za\/wordpress-maintenance\/\">\n      Get WordPress Maintenance\n    <\/a>\n  <\/div>\n\n  <p>\n    <em\n      >Sources: PHP.net security advisory (21 October 2026) and informational\n      advisory (23 October 2026), PHP release listings, VulnCheck analysis of\n      WP2Shell.<\/em\n    >\n  <\/p>\n\n  <script type=\"application\/ld+json\">\n    {\n      \"@context\": \"https:\/\/schema.org\",\n      \"@type\": \"FAQPage\",\n      \"mainEntity\": [\n        {\n          \"@type\": \"Question\",\n          \"name\": \"What are CVE-2026-109618 and CVE-2026-109619?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"They are two critical security flaws in PHP itself, fixed on 21 October 2026. They can allow unauthenticated remote code execution, meaning an attacker may be able to run commands on a vulnerable server without logging in.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Is my WordPress site affected?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"If your site runs on an unpatched PHP version, yes. WordPress is not the source of the flaw, but it runs on PHP, so the server underneath it is what needs fixing.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Will WordPress automatic updates fix this?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"No. WordPress updates its own core, plugins and themes, but it cannot change the PHP version installed on your server. That update must be done by your hosting provider or server administrator.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Which PHP versions fix the problem?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP project also provided minimal source backports for 7.4, 8.0 and 8.1 for people building from source. Many Linux vendors backport fixes to older packages, so check with yours.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"How do I check my PHP version?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"In WordPress, go to Tools, then Site Health, then Info, then Server. In cPanel or a similar panel, look for MultiPHP Manager or Select PHP Version. From the command line, run php -v.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Does this affect WHMCS?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"Yes, if your WHMCS server runs an unpatched PHP version. Update PHP at the server level, but first confirm your WHMCS version and ionCube Loader support the new PHP version, and test on a staging copy if possible.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"What if I am running PHP 8.1 or older?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"The PHP project does not release official updates for these versions. Ask your hosting provider or Linux vendor whether they provide a backported fix, or upgrade to a supported version such as 8.3, 8.4 or 8.5.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Can a security plugin or firewall protect me?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"It can help, but it is not a complete fix. PHP's advisory notes that the most serious attack path can run before application code loads, so WordPress security plugins may not catch it. A web application firewall can reduce risk, but patching PHP is the only complete solution.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Is turning off session upload progress safe?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"For most sites, yes. WordPress core does not use it. Only applications that rely on upload progress bars tied to PHP sessions might notice a change. Apply it in your server configuration, then restart PHP.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"How do I know if my site has already been compromised?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"Warning signs include unknown admin users, unfamiliar files or plugins, unexpected redirects or pop-ups, sudden slowdowns, spam emails sent from your domain, and security warnings from Google. If you suspect a compromise, restore from a clean backup, change all passwords and keys, and get professional help.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Should I upgrade PHP myself?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"It is possible, but a badly handled upgrade can break themes, plugins or billing systems. If you are not comfortable with servers, backups and rollbacks, it is safer to have a maintenance provider do it.\"\n          }\n        },\n        {\n          \"@type\": \"Question\",\n          \"name\": \"Does Hordanso handle this for maintained sites?\",\n          \"acceptedAnswer\": {\n            \"@type\": \"Answer\",\n            \"text\": \"Sites on our maintenance plans get server-level PHP updates and security monitoring as part of the service. See our WordPress Maintenance page or contact us to have your site checked.\"\n          }\n        }\n      ]\n    }\n  <\/script>\n<\/article>\n","protected":false},"excerpt":{"rendered":"<p>WordPress Security &amp; Maintenance PHP2Shell: Critical PHP Vulnerabilities (CVE-2026-109618 &amp; CVE-2026-109619) and What They Mean for Your WordPress and WHMCS Sites On 21 October 2026, the PHP project released emergency security updates for two critical flaws that can let an attacker run commands on your server without logging in. If your website runs on WordPress, [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":11304,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"two_page_speed":[],"footnotes":""},"categories":[88,83,84],"tags":[121,96],"class_list":["post-11303","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-server","category-web-hosting-and-domain","tag-server","tag-web-hosting"],"_links":{"self":[{"href":"https:\/\/hordanso.net\/en-za\/wp-json\/wp\/v2\/posts\/11303","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hordanso.net\/en-za\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hordanso.net\/en-za\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hordanso.net\/en-za\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/hordanso.net\/en-za\/wp-json\/wp\/v2\/comments?post=11303"}],"version-history":[{"count":1,"href":"https:\/\/hordanso.net\/en-za\/wp-json\/wp\/v2\/posts\/11303\/revisions"}],"predecessor-version":[{"id":11307,"href":"https:\/\/hordanso.net\/en-za\/wp-json\/wp\/v2\/posts\/11303\/revisions\/11307"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hordanso.net\/en-za\/wp-json\/wp\/v2\/media\/11304"}],"wp:attachment":[{"href":"https:\/\/hordanso.net\/en-za\/wp-json\/wp\/v2\/media?parent=11303"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hordanso.net\/en-za\/wp-json\/wp\/v2\/categories?post=11303"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hordanso.net\/en-za\/wp-json\/wp\/v2\/tags?post=11303"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}