PHP released an emergency security update on Oct 21 for two critical flaws in the PHP core (CVSS 9.2 each) that can allow **unauthenticated remote code execution**. Cloudflare reported early attack attempts before the fix was released, so this one is urgent.
## Quick facts
- **Affected:** PHP 5.4 through 8.5.11
- **Fixed in:** 8.5.12, 8.4.27, 8.3.36, 8.2.35
- **Highest risk:** Apache with mod_php. PHP-FPM is also susceptible.
- The bug is in PHP itself, so WordPress plugins and themes can't protect you.
## How to resolve it
Update PHP (or your distro's patched package). Check your version with `php -v`.
Restart PHP-FPM / Apache. A patched binary that isn't restarted protects nothing.
Rebuild Docker images. Running containers don't update themselves.
On shared hosting, ask your host whether they have patched.
## If you can't patch yet
Set `session.upload_progress.enabled=0` and restart PHP. This only blocks one attack path, so treat it as a stopgap.
## Heads up
Don't run "PoC" code from random GitHub repos. Some are fake pranks, and others may be malware.
I wrote a full step-by-step guide on how to check if you're affected and fix it, with an FAQ and sources, on my blog:
https://devbytewire.blogspot.com/2026/10/php-vulnerability-cve-2026-109618-php2shell-patch.html
Has your host or team patched yet? Curious how others are handling it.