PHP2Shell (CVE-2026-109618 and CVE-2026-109619): What It Means for WordPress and HubSpot Sites
On 21 October 2026, the PHP project released emergency updates for two critical vulnerabilities, known together as PHP2Shell. PHP runs a large share of the web, including WordPress, Drupal, Joomla and Magento, so this one matters to almost everyone who runs a website.
This post explains what the two bugs are and who has to act. It also looks at why sites on centrally managed platforms like HubSpot CMS and Vercel have nothing to patch, and why we'll see more news like this as AI changes how bugs are found.
Short answer: if your website runs on PHP that you or your agency manage, update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now, or ask your host whether they already have. If your site runs on HubSpot CMS, or on Vercel with one of its official runtimes, it doesn't run PHP that you manage, and there's nothing for you to patch.
What are CVE-2026-109618 and CVE-2026-109619?
Both are flaws in PHP itself, not in a plugin or a theme. According to the PHP security advisory, either one can let an unauthenticated attacker run code on the web server with crafted HTTP requests.
| CVE-2026-109618 | CVE-2026-109619 | |
|---|---|---|
| Type | Memory corruption after an out-of-memory error | Use of stale state after memory was freed |
| What happens | If PHP runs out of memory while request data is only partly set up, cleanup can treat invalid data as valid | Internal state from one request can survive, and the next request on the same worker can use it |
| Severity | Critical, CVSS 4.0 score 9.2 | Critical, CVSS 4.0 score 9.2 |
| Fixed in | PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 | PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
Some reports quoted a score of 10.0 before the release. That number didn't come from PHP; the PHP security team rates both bugs 9.2.
Who is at risk: PHP says every installation that serves web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers the risk highest for mod_php.
Older versions: the affected code goes back to PHP 5.4. PHP 8.1 and older don't get official releases from the PHP project any more. The PHP security team published minimal source fixes for 7.4, 8.0 and 8.1, and some Linux distributions and long-term support vendors ship their own fixes.
Is it being exploited? Reports differ. According to Tenable, Amazon saw an attempt on a honeypot four days before the release, and security firms have reported attacks since. Others say the public exploit code doesn't work against a default installation. Either way, PHP's own advice is clear: updating is the only complete fix.
Who has to do something
You need to act if your website runs on PHP that someone manages for you specifically:
- your own server, VPS or cloud machine with PHP installed
- a hosting panel such as Plesk or cPanel where you choose the PHP version
- a Docker image with a fixed PHP version
- a WordPress, Drupal, Joomla, Magento or other PHP site on any of the above
What to do:
- Check your PHP version. Your hosting panel shows it, or ask your host.
- Update to a fixed version: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor's patched package.
- Restart every PHP worker after the update, so no old process keeps running.
- On PHP 8.1 or older, upgrade to a supported version, or get a backported fix from your distribution or support vendor.
- If you can't update right away, apply the interim settings in PHP's advisory. PHP is explicit that they reduce exposure but don't make an installation safe.
On managed hosting, much of this happens for you: many hosts patch PHP once for every site on their servers. If you're not sure, ask your host.
Why HubSpot CMS and Vercel sites aren't exposed
PHP2Shell is a bug in PHP. A website that doesn't run PHP can't be exposed to it.
HubSpot CMS: a HubSpot website doesn't run PHP that you manage. Pages are rendered with HubL, HubSpot's own template language, on HubSpot's servers, and serverless functions are written in JavaScript and run on Node.js. There's no PHP version for you to check and nothing for you to update.
Vercel: Vercel's official runtimes are Node.js, Bun, Python, Rust, Go, Ruby, Wasm and Edge, plus a container runtime for custom code. PHP isn't one of them. A Next.js, React or static site on Vercel doesn't run PHP. If you've deployed PHP there yourself, through a container or a community runtime, you'd update that PHP like on any other server.
The same logic applies to other managed platforms that don't run PHP for you. What matters isn't the brand. It's who runs the software stack under your website, and whether that stack includes PHP.
Bugs like this can appear anywhere
It would be easy to turn PHP2Shell into a story about one technology being bad. That's not the lesson. PHP is mature, widely used and maintained by a capable security team that shipped fixes for four release lines, plus source fixes for older ones, in one coordinated release.
Every large codebase has bugs like these: web servers, JavaScript runtimes, databases, browsers and operating systems all do. These two had sat unnoticed for over a decade. The question isn't whether a platform will ever have a critical vulnerability. It's how quickly the fix reaches every site that needs it.
In the age of AI, we'll see more of them
What's new about PHP2Shell is how it was found. According to The Hacker News, researchers at Wiz, Calif and OpenAI found and reported the flaws. AI models helped turn long-standing bugs into working exploits, so that one researcher could do in about a week what would otherwise have taken a team months.
That cuts both ways. Defenders can now find and fix old bugs much faster, which is good for everyone. But the same tools are available to attackers, and the time between a fix and the first attack keeps shrinking.
So expect more advisories like this, for every technology, not just PHP. Fewer people will ask whether bugs exist and more will ask how fast a fix reaches your site.
Why centrally managed platforms help
This is where centrally managed platforms shine. Compare the two ways a fix can travel:
- Dedicated instances: every server, hosting account and container has its own PHP version. Each one has to be checked, updated and restarted by someone: the owner, the agency or the host. Most are patched within days. Some are forgotten for months.
- Centrally managed platforms: the provider runs one stack for all customers. When a fix is needed, they apply it once, and every site on the platform has it. Customers don't have to check versions, plan maintenance or remember an old staging server.
That's true for HubSpot CMS and Vercel, and it's also true for good managed WordPress hosting, which patches PHP for all its customers at once. The CMS matters less than who carries the patching work, and how many separate places a fix has to reach.
For a marketing team, that shift is valuable. Time that would go into emergency patch days goes into the website instead.
What this means if you're planning a relaunch
If PHP2Shell left you checking servers this week, it's worth asking how much patching your website should need at all.
- Moving to HubSpot CMS: our migration wizard scans your current site, from WordPress, Drupal, Joomla, TYPO3 or any other CMS, and rebuilds it as a native HubSpot theme. Read how a migration to HubSpot works in three steps.
- Staying on WordPress: transjt also builds native WordPress themes without a page builder, from Figma or an AI build. Fewer moving parts make updates easier, and a managed host keeps PHP patched for you.
- Building something new: whether your design comes from Figma or an AI builder, transjt turns it into a theme on a centrally managed platform.
Whatever you choose, update PHP today wherever you run it yourself.
Frequently asked questions
PHP2Shell is the name for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. Either one can let an unauthenticated attacker run code on a web server that runs an unpatched PHP version.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official release; upgrade to a supported version or use a backported fix from your distribution or support vendor.
The flaws are in PHP, not in WordPress, but WordPress runs on PHP. A WordPress site is exposed if its server runs an unpatched PHP version. Updating PHP, or confirming that your host has, fixes it.
A website on HubSpot CMS doesn't run PHP that you manage: pages render with HubSpot's own HubL language and serverless functions run on Node.js. There's no PHP version for you to update.
Vercel's official runtimes don't include PHP, so a Next.js, React or static site there doesn't run PHP. Only if you deploy PHP yourself, for example in a container, do you need to update it.
Only partly. PHP lists interim settings that reduce exposure to known attack paths, but says they don't make an installation safe. Updating is the only complete fix.
Very likely. AI tools help researchers find and exploit old bugs much faster, in every technology. What protects a website best is how quickly fixes reach it, which is where centrally managed platforms help.