PHP2Shell – Security Blog

PHP2Shell on Shared Hosting: Check Your Host, Then Rotate Secrets

siteguarding2 — Wed, 28 Oct 2026 16:54:49 +0000

PHP2Shell is a pair of remote code execution flaws in the PHP interpreter, so on shared hosting a WordPress or Joomla update leaves you exactly as exposed as before. If attackers reached your server before your host patched, the passwords and keys that server could read are the loss that matters. Key takeaways No. PHP2Shell is a flaw in PHP itself: the interpreter that runs WordPress...

Source

PHP2Shell Vulnerabilities Exploited: Patch PHP Before Oct 29

siteguarding2 — Wed, 28 Oct 2026 00:01:16 +0000

CISA added the PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog on October 26, after honeypots caught attackers running code on an unpatched PHP server. The flaws are in the PHP runtime itself, so updating WordPress or Joomla does not close them. Key takeaways PHP2Shell covers CVE-2026-109618 and CVE-2026-109619, two critical flaws in...

Source

PHP2Shell on Shared Hosting: Now Exploited, and Only Your Host Can Patch It

siteguarding2 — Mon, 26 Oct 2026 15:32:59 +0000

Attackers have achieved confirmed remote code execution through PHP2Shell, two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. PHP shipped fixes on October 21. The catch for PHP2Shell shared hosting customers: the bug sits beneath WordPress and Joomla, so only your host can install the fix. Key takeaways PHP2Shell names two critical remote code execution flaws in the PHP runtime...

Source