PHP2Shell: Wordfence logs ongoing attacks, no confirmed compromises yet
Wordfence is tracking attacks against two critical PHP RCE vulnerabilities (CVE-2026-109618/109619): no confirmed compromises to date, but patching remains urgent.
UptimeMag editorial team · 23 October 2026 · 1 min read
Wordfence, in an update published on 22 October 2026, reports that attacks against the two critical PHP vulnerabilities known as PHP2Shell continue, but the organisation has not yet observed any confirmed compromises traceable to these attempts. This is useful operational intelligence for those prioritising patches across dozens of installations.
The two flaws, CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4.0 score of 9.2, were fixed by the PHP project on 21 October 2026 with the release of PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They allow unauthenticated remote code execution, affecting the PHP engine directly rather than application code: WordPress, Magento, Shopware and any PHP-FPM or mod_php stack are exposed even with up-to-date plugins and themes.
Wordfence had already alerted site administrators before patches were released and published a technical analysis after testing both vulnerable and patched versions. In the new advisory, the team notes that the absence of observed compromises suggests the difficulty of exploitation, particularly given that Wordfence protects over 5,000,000 WordPress sites—a large observation base from which no confirmed incidents have yet emerged.
This assessment is supported by other security sources: Patchstack, after initially reporting active exploitation cases flagged by hosting partners in the early hours, has revised its findings, noting that its telemetry shows only probing attacks, with no concrete evidence of breaches.
What this means for server administrators
No change to the corrected versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35 remain valid. Those still running PHP 8.2 should note that this branch reaches end of support on 31 December 2026: the emergency patch must be applied immediately, but migration to a longer-support version should also be scheduled. For earlier branches, 8.1 and older, the PHP project has not issued numbered updates, and upgrading remains the only complete mitigation recommended by the vendor.
Written with the help of artificial intelligence and checked by the editors (EU AI Act, art. 50). Source: Wordfence – vulnerabilità WordPress.