PHP2Shell, the pair of critical PHP flaws fixed on 21 October, reaches the software most marketing teams publish on. Researchers confirmed attacks without a login against WordPress, Drupal, Joomla and Magento, and the fix has to be applied by whoever runs the server, which for many marketing sites is a host or an agency.
What was fixed, and what it reaches
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October to fix CVE-2026-109618 and CVE-2026-109619. The PHP Foundation says both flaws can, under the right conditions, let an unauthenticated attacker execute code on servers running PHP.
Calif, the security firm that first reported the root cause, lists the applications on which it confirmed remote code execution without a login in its research post: WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Magento 2.4.9, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1 and others. Calif says the earliest affected code path dates to PHP 5.4.0.
For a marketing team, that list covers the corporate site, the blog, landing page builds, regional microsites, the online store and often the internal wiki. Cloudflare’s post on its protections puts PHP’s reach at almost 70% of websites.
The fix sits below the CMS
The flaws sit in the PHP engine, beneath the CMS. Sansec, a firm that investigates attacks on online stores, says in its PHP2Shell guidance that Magento, Shopware and WooCommerce stores are affected even when their own code is clean, and that the fix cannot be applied from inside store code. Its advice for teams that do not run their own servers is to ask the hosting provider to apply the update.
That makes the question of ownership practical. Many marketing sites are built by an agency, hosted on managed WordPress or a cloud platform, and edited by the marketing team, with IT a step removed. WordPress’s Site Health screen shows a PHP version number, but Sansec notes that a patched distribution package keeps its old version number, so the number alone does not confirm the fix.
Ryan Austin of Calif, who researched and wrote up the flaws, puts the priority plainly: “Patch now. Upgrade to a fixed PHP release as soon as possible.”
How urgent, as of 22 October
The accounts from security firms differ on how fast attacks will spread. Amazon Threat Intelligence reported an exploit attempt against its honeypots on 17 October, four days before disclosure, and advises investigations to start from that date. Cloudflare says it saw attack traffic against its customers after the flaws leaked and that attackers were changing their payloads.
Sansec revised its view on 22 October. It now says mass exploitation is less likely than it expected on release day, because an attack needs specific knowledge of the target server and specific conditions on it, and the public exploits do not work against a default PHP installation. Sansec tells store owners they do not need to take their stores offline, and to update PHP anyway.
Some site owners chose to go offline. Sansec lists several Dutch sites that did so on 21 October, including Tweakers and the House of Representatives.
Stopgaps and their limits
Cloudflare says customers on its free and paid WAF plans have been protected by default since 03:02 UTC on 21 October, and recommends applying the PHP update while keeping the WAF rules on. A WAF rule only covers traffic that passes through it, so a site with an origin server that answers requests directly is still exposed.
Calif and Sansec both list temporary settings, such as disabling session upload progress or blocking multipart form uploads at the web server. Calif warns that these settings do not replace a patch. Sansec notes that every known trigger is a multipart form request, the format browsers use for file uploads, and that blocking it breaks file uploads such as product images in the Magento admin. On a marketing site the same rule can stop job applications, RFP uploads and user-generated content submissions, and some stores submit cart or checkout forms the same way.
What it means for marketing leaders
In our reading, PHP2Shell is a test of whether marketing knows who runs the servers behind its own sites. Sites added outside IT’s inventory, such as campaign microsites, event pages and old regional domains, are the ones most likely to be missed. We have covered CMS changes from the product side, including Liferay’s merge of content planning into its CMS and Google Site Kit’s new site goals dashboard for WordPress. This is the infrastructure side of the same stack.
- List every PHP property. Include the main site, blogs, microsites, landing page domains, the store and staging copies, with the agency or host responsible for each.
- Ask each host one question in writing. Which PHP build does this site run, and does it include the fix for CVE-2026-109618 and CVE-2026-109619? Distribution packages can carry the fix under an older version number, so ask for the build, then check the changelog.
- Plan for end-of-life PHP. PHP.net publishes no fixed release for 8.1 or older. Sansec lists paid and free backports, and a site still on an old branch needs a migration date as well as a patch.
- Test your forms after any stopgap. If the host blocks multipart uploads as a mitigation, check lead forms and file uploads the same day, and place a test order on any store, as Sansec advises.
Source: Calif Research, “php2shell”
