PHP2Shell: Critical PHP vulnerabilities and what Nexus Digital has done
In October 2026 two critical security vulnerabilities were identified in PHP, the programming language that powers WordPress and many other websites. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and are commonly referred to as "PHP2Shell". This article explains what PHP2Shell is, who it affects, and the steps Nexus Digital has taken to protect our customers.
What is PHP2Shell?
PHP2Shell is the name given to two remote code execution (RCE) vulnerabilities in PHP. A remote code execution vulnerability allows an attacker to run their own code on a web server over the internet, without needing a username or password. Once an attacker can run code on a server they can change or delete website files, steal data, install malware, or use the website to send spam and attack other sites.
Both vulnerabilities are rated 9.2 on the CVSS scale (the Common Vulnerability Scoring System, which rates security issues from 0 to 10), placing them in the critical category.
Which PHP versions are affected?
PHP2Shell affects PHP versions from 5.4 onwards, including PHP 5, 6, 7 and 8. Details of the vulnerabilities leaked before the planned disclosure date, so the PHP security team brought forward an emergency security release, which was scheduled for 21 October 2026.
Supported versions of PHP (PHP 8.2 and later) receive the official security patches. PHP 5 and PHP 7 are end-of-life, which means the PHP team no longer releases security updates for them and they will not be patched.
Who is affected?
For Nexus Digital customers, PHP2Shell only affects websites running WordPress, as these sites rely on PHP. Websites and services that do not use PHP are not affected.
What Nexus Digital has done
On 21 October 2026 we notified all customers of the vulnerabilities and began working closely with our software vendors while monitoring developments in the security community. The official security updates were released on 21 October 2026, and we patched all of our PHP servers on the same day.
Nexus Digital updated all of its PHP servers on 21 October 2026, the same day the patches were released. All of our PHP servers running supported PHP versions have been patched against CVE-2026-109618 and CVE-2026-109619, and no action is required from customers whose websites run on a supported PHP version.
We also reviewed the temporary mitigations recommended by the security community, such as disabling file uploads, while waiting for the official patches.
Websites running PHP 5 or PHP 7
Because PHP 5 and PHP 7 will not receive official patches, websites still running on these versions remain at risk. These websites have all moved to a supported PHP version.
What you should do
- If your website runs on a supported PHP version, no action is needed. We have taken care of the patching.
- If your website runs on PHP 5 or PHP 7, upgrade to the latest PHP version or ask your developer to do it for you.
- Keep WordPress, your theme and your plugins up to date. For more tips, read our article on securing a WordPress website.
- Keep an eye out for communications from Nexus Digital, WordPress and PHP about future updates.
Need help?
If you are not sure which PHP version your website uses, or you would like help upgrading, please contact our support team on 1300 301 302.
