PHP2Shell Sparks Global Security Alert for Websites

By Suad Seferi · 21 October 2026 at 20:12

Two critical vulnerabilities in PHP have triggered emergency security updates worldwide. WordPress sites, online stores and institutional portals could be exposed, while AI-assisted research played a central role in uncovering the danger. Two critical security vulnerabilities in PHP, the programming language powering much of the internet, prompted an emergency security release on 21 October 2026. The flaws, collectively known as PHP2Shell, could allow attackers to execute malicious code on vulnerable web servers without needing a username or password. The PHP security team released fixes for both vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. Each received a critical severity score of 9.2 under CVSS v4.0. The warning extends well beyond one website platform. WordPress, Joomla, Drupal, Magento and many custom web applications depend on PHP. A vulnerable PHP installation can expose an application even when its own code is properly maintained. For the Western Balkans, where PHP-based content management systems are widely used by businesses, media organisations and public institutions, the incident raises an immediate operational question: who is responsible for updating the software running their websites? What is PHP2Shell? PHP is a server-side programming language. When someone opens a PHP-based website, the server uses PHP to process requests, retrieve information and generate the content displayed in the visitor's browser. PHP2Shell involves two separate weaknesses in how PHP manages computer memory and handles errors. The first vulnerability, CVE-2026-109618, concerns memory corruption during an out-of-memory condition. Under certain circumstances, PHP can mistakenly treat partially initialised memory as valid. The second, CVE-2026-109619, involves internal memory references that can remain accessible after the memory has been released. These weaknesses can create opportunities for attackers to execute commands on a vulnerable server. Researchers also demonstrated scenarios involving exposure of sensitive process memory, potentially including authentication tokens and other confidential information. An attacker does not necessarily need access to the website's administration panel. Depending on the vulnerable configuration and exploitation method, specially crafted web requests may be sufficient. The PHP security team considers Apache installations using mod_php particularly exposed because researchers demonstrated an attack that could execute before an application's own code runs. Other configurations, including PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, also require attention. Is this a WordPress vulnerability? Not exactly. This distinction matters. WordPress is built using PHP, but the newly disclosed vulnerabilities exist in PHP itself, rather than WordPress's core software, themes or plugins. On 21 October, WordPress published an official security notice urging website owners to update PHP immediately. It confirmed that no WordPress update was required or planned specifically to address these vulnerabilities. Researchers nevertheless demonstrated successful attacks against WordPress, Drupal and Joomla applications running on vulnerable PHP installations. This means a website can be running the latest WordPress release, with updated plugins and strong administrative passwords, while remaining exposed because its underlying PHP runtime has not been patched. The same principle applies to WooCommerce stores, PHP-based learning platforms, custom institutional portals and applications developed using frameworks such as Laravel. There is also an important distinction between self-hosted WordPress websites and managed services. Automattic confirmed that sites hosted on WordPress.com, WordPress VIP, WP Cloud, Pressable and Tumblr were already protected as of 21 October. Owners of independently hosted WordPress websites should verify their hosting provider's PHP patch status rather than assuming they received the same protection. How widely are PHP and WordPress used in the Balkans? The scale of PHP adoption makes this incident particularly relevant to regional website operators. According to W3Techs measurements from October 2026, PHP is used by approximately 69% of websites whose server-side programming language can be identified. WordPress powers approximately 40% of surveyed websites globally. The regional figures reveal substantial dependence on these technologies. PHP and WordPress usage across selected Balkan domain markets Domain market WordPress share PHP share North Macedonia (.mk) 85.1% 82.6% Serbia (.rs) 83.7% 90.0% Croatia (.hr) 79.8% 85.1% Slovenia (.si) 76.9% 86.5% Montenegro (.me) 54.5% 58.4% Source: W3Techs, observations from September and October 2026. How to interpret the figures: WordPress percentages describe its share among websites with an identifiable content management system. PHP percentages describe usage among websites with an identifiable server-side programming language. These are different statistical populations. The measurements cover country-code domains, not every website operated within each country, and the figures are not estimates of vulnerable websites. The distinction is especially important for Montenegro because .me is widely used internationally and does not exclusively represent Montenegrin organisations. Additional data from BuiltWith illustrates the regional presence of WordPress. Its October-accessed country reports identify approximately 10,400 WordPress websites associated with North Macedonia, 10,100 with Bosnia and Herzegovina, and 9,900 with Albania. These are technology-detection estimates, not complete national website inventories. Comparable recent figures could not be independently established for every Western Balkan economy, including Kosovo. There is also no verified regional count of PHP installations that remain unpatched. Still, the available measurements establish the central point: PHP and WordPress are i…