PHP2Shell Exploits Critical PHP Flaws, Countries Issue Alerts: Free WordPress Alternative for Business Websites

On October 21, 2026, PHP shipped an emergency security update fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Without logging in, an attacker can send a single request and run arbitrary code on the server.

Wiz Research, which found the flaws, chained them into an exploit script called PHP2Shell and demonstrated unauthenticated remote code execution on the latest versions of WordPress, Drupal and Joomla (Wiz).

WordPress runs on PHP. This time the bug is in PHP itself, so updating WordPress and its plugins to the latest version does not stop it. Every WordPress business website has to deal with it.

Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 and the PHP2Shell exploit, CVSS 9.2

PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 at a glance

From the official PHP security announcement:

Item	Details
IDs	CVE-2026-109618, CVE-2026-109619
Official names	RCE via OOM corruption, RCE via stale global state
Score	CVSS 4.0, 9.2
Impact	Unauthenticated remote code execution (RCE)
Affected	Any PHP that handles web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed
Highest risk	Apache mod_php, where the attack lands before any site code runs
Fixed in	PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35
No official fix	PHP 8.1 and earlier

CVE-2026-109618: when PHP runs out of memory (OOM), it can stop with request data only half initialized, and the later request cleanup then treats the invalid data as valid.
CVE-2026-109619: after a request ends and its memory is freed, some internal state lingers, and the same worker process may use that stale state when it handles the next request.

Countries issue alerts, websites taken offline

All times below are on October 21, 2026.

CERT-EU (NL Times), the UK NCSC (Patchstack), the Dutch NCSC (Sansec), and Japan’s National Cybersecurity Office and IPA (Impress Watch) issued alerts one after another urging people to patch as soon as possible. The EU, the UK and Japan also advised taking websites offline if they could not be patched in time.

Attacks have already started

From the live updates of WordPress security company Patchstack:

07:34 UTC: several hosting companies report sites under attack.
07:43 UTC: Cloudflare’s CTO says early attacks have been seen and firewall rules have been deployed.
13:52 UTC: PHP releases the fixed versions.
13:57 UTC: Patchstack still sees only probing attacks and expects more once details of the fix are public.

Wiz Research's PHP2Shell exploit attacking WordPress, detecting the target automatically and running commands

The Dutch National Cyber Security Centre (NCSC) said at the time that it had not confirmed any real attacks. For reference: after PHP vulnerability CVE-2024-4577 was disclosed in June 2024, Akamai saw exploitation attempts within 24 hours (The Hacker News).

Dutch and Finnish government sites go offline

The website of the Dutch House of Representatives (Tweede Kamer) was temporarily taken offline. So were the sites of football club Fortuna Sittard, police union ACP, the Royal Dutch Pharmacists Association KNMP and transport company EBS, as well as parts of the IT network shared by Dutch universities and research institutions (NL Times).
The Dutch NCSC’s own website, tech site Tweakers and security news site Security.NL went offline (Sansec).
The Dutch government login system DigiD and the government portal MijnOverheid were suspended (Patchstack).
Valtori, the Finnish government’s IT center, shut down public websites of several state agencies, including the National Land Survey of Finland and the Helsinki Expo and Convention Centre (Pasquale Pillitteri).

Japan: PM Takaichi’s late-night appeal, emergency maintenance at pixiv, DMM and more

At 21:55 Japan time, Prime Minister Sanae Takaichi posted on X (quoted by Impress Watch):

皆様に、今夜に対応して頂きたい大至急のお願いです。（中略）公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。

In short: check tonight whether your website uses PHP, and apply the patch as soon as it is released at 23:00 Japan time; if you cannot patch in time, consider suspending the website for now.

Japan’s National Cybersecurity Office and IPA also issued alerts, and some local governments announced temporary system shutdowns. Services listed in the same report:

Online store platform BASE and childcare service CoDMON went into maintenance from the afternoon;
pixiv, DMM.com, niconico and Sakura Internet put some services into emergency maintenance, and many services were suspended after 20:00;
Games such as Granblue Fantasy and Umamusume: Pretty Derby were suspended.

WordPress maintenance mode won’t stop it

Sansec points out that the built-in maintenance modes of WordPress and Magento do not help: PHP parses the request before the application checks the maintenance switch. What works is stopping PHP-FPM and having the web server return a static maintenance page directly.

So that night, a WordPress website had only two options: someone logs in to the server and upgrades PHP, or the whole site goes down. Sites nobody looks after just stayed online and waited.

Why WordPress business websites are most at risk

A PHP-level flaw is out of reach for WordPress plugins. With mod_php, the attack happens before any site code runs, so security plugins, CAPTCHAs and hidden admin URLs are useless. Sansec also says the only fix is upgrading PHP on the server; if you don’t manage your own server, all you can do is press your host.

Many servers still run end-of-life PHP. On October 20, security company Mallory used Shodan to count about 884,000 public hosts whose response headers show PHP 8.1 or earlier, 59% of the hosts that report a version number (about 1.5 million). This is based on response headers and does not mean all of them are affected (The Hacker News). These versions get no official patch; you can only ask your host for a backported patch or upgrade PHP, and old themes and plugins often break on upgrade.

It costs money every year. Hosting renewals, maintenance fees, premium plugin subscriptions, plus cleanup costs when something goes wrong. A website that only presents the company, its services, case studies, news and job openings has to keep running PHP + MySQL, and someone has to watch the server on nights like October 21.

My approach: Astro + Cloudflare / GitHub / Vercel / Netlify

Two years ago I stopped recommending WordPress and PHP to clients, and I have since moved all my clients’ websites to Astro combined with Cloudflare, GitHub, Vercel and Netlify. The free plans of these platforms are more than enough for a business website, hosting costs nothing, and the result is faster, more secure and less hassle than the old WordPress site.

During this PHP vulnerability, these clients’ websites needed no action at all and stayed online that night as usual. My own blog, zhaojian.net, is built the same way and is available in 12 languages.

It’s simple:

Astro generates every page at build time, so only HTML, CSS, JS and images go live;
The source lives on GitHub; edit text or add news, then commit;
Cloudflare Pages / Vercel / Netlify build and deploy automatically on each commit; changes go live in minutes and pages are served from a global CDN.

More secure: there is no PHP, no database and no admin login page on the server, so exploits like PHP2Shell have nothing to attack. Future PHP, WordPress or plugin vulnerabilities have nothing to do with the site.

Faster: pages are ready-made files served from the CDN node closest to each visitor, so they load fast in Japan, China, Europe and the Americas.

Free and maintenance-free: no hosting or server to renew, only the domain fee. No server to log in to, no software to upgrade.

WordPress vs. an Astro static website

	WordPress website	Astro static website
What runs	PHP + MySQL + theme + plugins	Nothing, only static files
This PHP vulnerability	Affected; upgrade overnight or take the site down	Not affected
Hosting cost	Yearly hosting / server renewal	Free
Routine maintenance	Regular WordPress, plugin and PHP upgrades	None
Speed	Depends on server performance and caching	Served directly from a CDN
Updating content	Log in to the admin panel	Automatic build and deploy on commit
Multilingual	Relies on a multilingual plugin	Pages for each language generated at build time

Features that read and write data in real time, such as online stores, member logins and booking systems, need separate planning. Contact forms, news, case studies, job openings and multiple languages, the features business websites usually need, can all be done with a static site plus a third-party form service.

How to migrate from WordPress to Astro

Inventory the site: list every page, post, image and form.
Export content: export posts and pages to Markdown and download the images.
Keep URLs: reuse the original URLs where possible and set up 301 redirects for any that change, so search rankings don’t drop.
Redo the design: recreate the original look or switch to a new design, mobile-friendly either way.
Replace features: switch forms to a third-party form service and analytics to a serverless option.
Switch the domain: once everything checks out, point the domain to the new platform and let the old server expire.

FAQ

Can PHP2Shell attack WordPress sites?

Yes. The vulnerabilities are in PHP itself. Unless the server’s PHP is 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a version patched by your host, it is affected, regardless of the WordPress version.

Does WordPress maintenance mode protect the site?

No. PHP processes the request before maintenance mode kicks in. Either upgrade PHP, or stop PHP-FPM and serve a static maintenance page instead.

What about PHP 8.1 or earlier?

PHP no longer provides updates for them. Ask your host for a backported patch, or upgrade to PHP 8.2 or later; if your theme and plugins are incompatible, consider moving straight to a static website.

Is a static website really free?

The free plans of Cloudflare Pages, Vercel, Netlify and GitHub Pages are enough for a business website. You only pay for the domain.

Want to replace your WordPress website? Contact me

I can help if:

Your business website runs on WordPress and on the night of October 21 you didn’t know whether to take it down or who to ask for the patch;
Your server still runs PHP 8.1 or earlier;
You pay every year for hosting, servers and maintenance;
The person who built the site can’t be reached and nobody looks after it;
You target Japan or other overseas markets and need a multilingual website in Japanese, English and more.

I can move your WordPress business website to an Astro static website: faster and more secure, with no yearly hosting or server renewals, automatic build and deploy on commit, and no need to hire someone for maintenance.

Reach me via WeChat (757118) or X (@zhaoJianNet) listed on my About page. Send me your website URL and what you need, and I’ll give you a concrete migration plan.