PHP2Shell on WordPress, Drupal and Joomla: Your CMS Is Current. Is Your PHP?

Every update button is green, and it does not matter

Picture the Thursday morning ritual. An office manager logs into WordPress, sees zero pending updates, and closes the tab with a small sense of virtue. The virtue is real. It is also beside the point this week. WordPress, Drupal and Joomla are programs written in PHP. PHP2Shell is a pair of flaws in the program that runs them, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 by the PHP project. Updating the CMS repaints the house. The crack is in the slab.

Wiz Research, which found the bugs, makes the point bluntly: an app as trivial as "Hello World" can be exposed on an affected PHP, and the upload-progress route needs no session_start() call from your code at all. The PHP project agrees on scope. Any installation answering web requests is at risk, whatever runs it, and Apache with mod_php most of all. Your theme choice, your plugin list and your password policy do not change that sentence.

Updating the CMS repaints the house. The crack is in the slab.

What Wiz showed on all three platforms

The timeline is short and a little humbling. Wiz found the first bug on August 19, 2026. It confirmed unauthenticated code execution against Drupal on August 20 and against WordPress on August 21, reported the issue to the PHP security team on August 24, and the fixed releases shipped with public disclosure on October 21. In its research post, Wiz describes one exploit script that ran code on the newest official container image for each of the three CMSs, as published when it tested. No login. No vulnerable plugin. A stock install.

Wiz also showed a quieter attack: remote disclosure of process memory without running any code. For a CMS that matters, because the PHP process holds what the site needs to work. Leaked memory can include passwords, tokens and API keys, which on a typical site means the database password, a mail service key, perhaps a payment gateway's credentials. The flaws had been sitting in PHP for more than a decade, back to roughly PHP 5.4, and Wiz says AI models helped one researcher do in about a week what would have taken a team months.

A security plugin is a guard standing on the cracked floor

Security plugins are useful. They block brute-force logins, scan files for known malware and alert you when something changes. Every one of them is written in PHP and runs after PHP has accepted and parsed the request. The PHP project describes a demonstrated exploit on mod_php in which an unauthenticated request triggers the attack before any application code runs. Before WordPress loads. Before the plugin loads. The guard has not clocked in yet.

Cloudflare, which sells firewalls for a living, says in its advisory that updating website code or plugins alone does not fix these flaws. That is the honest answer for every CMS. A plugin that says "security" on the box can still help you afterward, by spotting files that should not be there. It cannot patch the interpreter. Neither can a Drupal module or a Joomla extension.

• A security plugin can: flag new or changed files, notice unknown admin accounts, block repeated logins and alert you to some kinds of tampering.
• A security plugin cannot: change how PHP parses an upload, fix memory handling inside the interpreter, or run before the request reaches PHP.
• A web application firewall in front of the site can: drop many attack requests before they arrive, which buys time. The temporary mitigations page covers what it misses.
• Only a PHP update can: remove the flaw. Everything else is a delay or a cleanup.

WordPress, Drupal and Joomla, side by side

Each CMS shows its PHP version somewhere in the admin, and each has its own floor for how old a PHP it will accept. That floor matters, because a site that needs an old PHP is a site that cannot take the update without other work. The requirements below come from each project's own documentation as of October 2026.

The plugins that fall over when PHP moves up

For sites already on PHP 8.2 or later, the fix is a point release, and point releases rarely break anything. The trouble is the sites on 7.4, 8.0 or 8.1, where the safe move is a jump of one or more branches. Each jump retires old habits. PHP 8.0 removed functions such as each() and create_function(), which older plugins still call. PHP 8.2 deprecated dynamic properties, so code that worked silently now fills the error log. A theme with a builder bundled inside it is the classic casualty, because the builder only updates when the theme does.

The symptoms are familiar: a white screen, a fatal error naming a plugin file, a layout that half loads, a WPBakery page full of PHP 8 errors. Genesis child themes have their own set of PHP errors after an upgrade. None of this is a reason to stay on vulnerable PHP. It is a reason to test first.

1. 1

   Copy the site to staging

   Most hosts offer a one-click staging copy. If yours does not, a full backup restored to a subdomain does the same job.

2. 2

   Switch staging to the patched PHP

   Pick 8.3 or 8.4 where the CMS supports it, so this jump lasts more than a few months.

3. 3

   Click through what earns money

   Home page, contact form, checkout, member login, search. Then read the PHP error log for warnings and fatals.

4. 4

   Update or replace the offenders

   Update what has an update. Replace what was abandoned. Patch custom code that calls removed functions.

5. 5

   Switch the live site and watch

   Change PHP on production, repeat the click-through, and keep the old version selectable for an hour in case something was missed.

Stores, member sites and anything with an upload form

WooCommerce stores, membership sites, job boards and anything that accepts files have more to lose and fewer easy settings. The PHP project's interim advice includes a small post_max_size of 8M for sites with no uploads and 32M for sites that need them, with upload_max_filesize below it. A store that takes product photos or a member site that takes résumés will feel that limit. That is fine for a week. It is not a plan.

Stores also hold the most valuable secrets in memory: payment gateway keys, shipping and tax service tokens, customer session data. Because the memory-disclosure attack can expose that kind of thing without leaving much trace, a store that ran unpatched PHP after October 21 should rotate those keys after updating, not before. If checkout breaks after the PHP update, the WooCommerce checkout fix is the first stop; if renewals stop, see subscriptions not renewing. For what to look for in the logs, read signs of compromise.

Who fixes this, and for how much

If the site runs on shared or managed hosting, the host installs the patched PHP and you choose it for your site. If it runs on your own server, you or your developer do the update. Either way, the update comes first, a test comes second, and a check for intruders comes third. If the update has to wait, the interim settings fill the gap for days, not weeks. Sites still on PHP 7.4 or 8.0 should read the end-of-life page before anything else.

For WordPress, Fix It Now sells repairs at a set price, paid at checkout. Work begins within one business day of payment, and if we cannot fix it, the whole fee comes back. Drupal, Joomla and hand-built PHP sites get a price once we have looked, free, because the work varies too much to quote blind.

The full emergency service, update, testing and a compromise check together, is on the emergency fix page. For the long run, our hosting and maintenance plans keep PHP current with tested updates. And if this week has you questioning PHP itself, moving to Next.js can keep WordPress as a private editor behind pre-rendered pages, or replace it with Athena CMS. Call (210) 346-0848.