{"id":3018,"date":"2026-10-23T00:55:12","date_gmt":"2026-10-22T15:55:12","guid":{"rendered":"https:\/\/onepress.co.kr\/?post_type=briefing&p=3018"},"modified":"2026-10-23T00:57:01","modified_gmt":"2026-10-22T15:57:01","slug":"2026-10-23-php2shell-en","status":"publish","type":"briefing","link":"https:\/\/onepress.co.kr\/index.php\/briefing\/2026-10-23-php2shell-en\/","title":{"rendered":"PHP emergency fixes: updating WordPress alone may leave the runtime exposed"},"content":{"rendered":"

2026-10-23 00:55:12 KST<\/strong><\/p>\n

On October 21, the PHP project released emergency fixes for two vulnerabilities that can allow code execution without a login.<\/p>\n

Exposure depends on configuration and execution paths; this does not mean every PHP website has been breached.<\/p>\n

The problem sits beneath the application<\/h2>\n

Services such as WordPress run on the PHP runtime. PHP2Shell concerns memory management and error handling in that underlying software. When processing fails, PHP can mishandle unfinished data or memory that has already been released. Updating a theme, plugin or WordPress installation therefore does not necessarily update PHP itself.<\/p>\n

Which releases contain the fixes?<\/h2>\n

The first fixed versions in the supported branches are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The identifiers are CVE-2026-109618 and CVE-2026-109619. Distributors may backport fixes while retaining an older version number. Ask the hosting provider for the security advisory covering both identifiers and the PHP runtime actually serving web requests.<\/p>\n

\"PHP
AI-generated explanatory illustration, not an actual site, warehouse, exhibited artwork or observation photograph; architecture, water levels and orbits are not reproduced to scale.<\/figcaption><\/figure>\n

A firewall provides an additional layer<\/h2>\n

Cloudflare says it observed attack attempts in its customer traffic and deployed mitigations. Observing hostile traffic does not establish that every attempt succeeded. Cloudflare also participated in coordinated disclosure, so it is not wholly unrelated to the research. Its own observations provide a separate check, while its firewall does not replace the PHP patch.<\/p>\n

What administrators should verify next<\/h2>\n

Administrators should check compatibility, take backups, install the fixed packages and restart the relevant web server, PHP-FPM and long-running workers. Command-line PHP can differ from the web runtime. Ordinary visitors cannot establish patch status by opening a page. Follow PHP\u2019s official advisory and the host\u2019s package changelog; this briefing does not determine whether any particular site has been compromised.<\/p>\n

Primary sources and independent checks<\/h2>\n

Primary: PHP Foundation announcement covering fixed releases, conditional exposure, both CVEs and disclosure: PHP Foundation \u00b7 2026-10-21<\/a><\/p>\n

Separate check: observations in its own customer traffic and mitigation; a disclosure participant, not an unrelated institution: Cloudflare \u00b7 2026-10-21<\/a><\/p>\n

Research advisory: first fixed releases and runtime updates\/restarts; exploit instructions are not reproduced: PHP2Shell \u00b7 research advisory<\/a><\/p>\n

Read in other languages<\/h2>\n

\ud55c\uad6d\uc5b4<\/a> \u00b7 English<\/a> \u00b7 Espa\u00f1ol<\/a> \u00b7 \u65e5\u672c\u8a9e<\/a> \u00b7 Ti\u1ebfng Vi\u1ec7t<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

PHP2Shell affects PHP itself. Check the runtime actually serving the website and the distributor\u2019s security fixes.<\/p>\n","protected":false},"featured_media":0,"template":"","meta":[],"class_list":["post-3018","briefing","type-briefing","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/onepress.co.kr\/index.php\/wp-json\/wp\/v2\/briefing\/3018","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/onepress.co.kr\/index.php\/wp-json\/wp\/v2\/briefing"}],"about":[{"href":"https:\/\/onepress.co.kr\/index.php\/wp-json\/wp\/v2\/types\/briefing"}],"wp:attachment":[{"href":"https:\/\/onepress.co.kr\/index.php\/wp-json\/wp\/v2\/media?parent=3018"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}