CISA added the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog on October 26, after honeypots caught attackers running code on an unpatched PHP server. The flaws are in the PHP runtime itself, so updating WordPress or Joomla does not close them.
Attackers have achieved confirmed remote code execution through PHP2Shell, two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. PHP shipped fixes on October 21. The catch for PHP2Shell shared hosting customers: the bug sits beneath WordPress and Joomla, so only your host can install the fix.