- May 1, 2006
- 4,148
- 3,014
- Awards
- 13
- First Name
- Alex
On October 21, the PHP project released fixes for two serious security flaws in PHP itself. Researchers named them PHP2Shell (CVE-2026-109618 and CVE-2026-109619). WordPress runs on PHP. It also runs a lot of the landing pages, lead forms, and special pages dealers use every day.
An attacker does not need a login, a plugin bug, or a weak password. They send one specially built web request to a PHP page, and on an unpatched server that can be enough to run their own code on it.
Who is affected
Every PHP version from 5.4 through 8.5 that serves web pages, until it is updated. The fixed versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 7.4, 8.0, and 8.1 are past end of life and have no official releases, so sites still on those need to move.
What to do
One more thing we learned firsthand. Having Cloudflare or a firewall in front of your site does not stop this on its own. The attack looks like an ordinary form submission, so it passes straight through unless someone adds a rule for it.
What we did at DealerRefresh - thanks, @craigh, for the heads-up!
We checked every server the day after the announcement. Like most sites online since 2005, we had older PHP versions in the mix, so this applied to us.
That same day we added temporary blocks for the request patterns the attack depends on, and limited our test server to our own network. Then we built new servers on a current long-term-support release of Ubuntu with patched PHP 8.3, tested everything on staging, and moved the live forum over the next morning.
Our old WordPress blog was the pain. It has 1,784 articles going back to 2005, and nobody has posted there since 2023. Instead of upgrading WordPress and 48 plugins for a site we don’t use, we converted it to static pages. Every article still loads at the same address, and there is no PHP behind it anymore.
While we were in there, we also tightened database access, changed passwords, and added daily backups and uptime alerts.
If you’ve already asked your website provider about this, post what they told you below. Vendors, if you’ve patched your dealer clients, say so here. It will save many dealers a phone call.
Sources:
PHP2Shell: Critical PHP vulnerabilities patched, update now! - Help Net Security
php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ | Tenable®
An attacker does not need a login, a plugin bug, or a weak password. They send one specially built web request to a PHP page, and on an unpatched server that can be enough to run their own code on it.
Who is affected
Every PHP version from 5.4 through 8.5 that serves web pages, until it is updated. The fixed versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 7.4, 8.0, and 8.1 are past end of life and have no official releases, so sites still on those need to move.
What to do
- List every site with your dealership’s name on it. The main site, the blog, service and parts specials pages, old campaign microsites, the landing page an agency built in 2019. Forgotten sites are the ones that never get patched.
- Ask whoever hosts each one: “Which PHP version is this site on, and have you applied the October 21 PHP security update (CVE-2026-109618 and CVE-2026-109619)?” Get the answer in writing.
- If you’re on a managed WordPress host, they have most likely patched already. Confirm anyway.
- If the site sits on its own server or a VPS, someone has to update PHP. If the answer is PHP 7.4, 8.0 or 8.1, ask for a dated plan to move it.
- If nobody uses an old site, shut it down or turn it into plain HTML pages. A page with no PHP behind it can’t be hit by a PHP flaw.
One more thing we learned firsthand. Having Cloudflare or a firewall in front of your site does not stop this on its own. The attack looks like an ordinary form submission, so it passes straight through unless someone adds a rule for it.
What we did at DealerRefresh - thanks, @craigh, for the heads-up!
We checked every server the day after the announcement. Like most sites online since 2005, we had older PHP versions in the mix, so this applied to us.
That same day we added temporary blocks for the request patterns the attack depends on, and limited our test server to our own network. Then we built new servers on a current long-term-support release of Ubuntu with patched PHP 8.3, tested everything on staging, and moved the live forum over the next morning.
Our old WordPress blog was the pain. It has 1,784 articles going back to 2005, and nobody has posted there since 2023. Instead of upgrading WordPress and 48 plugins for a site we don’t use, we converted it to static pages. Every article still loads at the same address, and there is no PHP behind it anymore.
While we were in there, we also tightened database access, changed passwords, and added daily backups and uptime alerts.
If you’ve already asked your website provider about this, post what they told you below. Vendors, if you’ve patched your dealer clients, say so here. It will save many dealers a phone call.
Sources:
PHP2Shell: Critical PHP vulnerabilities patched, update now! - Help Net Security
php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ | Tenable®
