TL;DR: As of October 28, 2026, Wordfence is not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We continue to see PHP2Shell-related requests across the more than 5 million sites we protect. Those requests show ongoing scanning and exploitation attempts; they do not show whether an attempt succeeded.
PHP2Shell Update: Still No Confirmed WordPress Compromises, and Answers to the Questions We’re Hearing Most
About this summary. This is a short excerpt from the description that Wordfence published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.wordfence.com/blog/2026/10/php2shell-update-still-no-confirmed-wordpress-compromises-and-answers-to-the-questions-were-hearing-most/
Source attribution: headline and facts are from Wordfence (wordfence.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found
On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP…
CVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE Attacks
IntroductionOn October 21, 2026, two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as “PHP2Shell,”…
PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now
The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow…
Widespread PHP Flaw May Cause Many Site Outages Today
Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that…
U.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalog. The U.S.
Discover and remediate PHP2Shell exposure with Tenable
Learn how to use Tenable solutions to find vulnerable PHP versions, prioritize remediation, and patch the critical PHP2Shell vulnerabilities (CVE-2026-109618 and…