What’s New
PHP2Shell is the name given to two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) disclosed on 21 October 2026. They allow unauthenticated remote code execution on any unpatched web server running PHP, including most WordPress, Drupal and Magento sites. The only complete fix is upgrading to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor backport. Squarespace websites are not affected, because Squarespace is a fully managed platform that does not expose a PHP runtime to site owners. DWHQ, a Singapore branding consultancy and Squarespace Gold Partner, builds client websites exclusively on Squarespace so that server patching, runtime security and platform updates are handled centrally rather than by the business.
Key facts at a glance
Disclosed: 21 October 2026, with exploitation attempts recorded four days earlier
Severity: CVSS v4.0 score 9.2, unauthenticated remote code execution
Affected: nearly every PHP version since 5.4, across PHP-FPM, mod_php, LiteSpeed and FrankenPHP
Discovered by: Wiz Research, Calif and OpenAI’s Codex Security team, using AI-assisted code analysis
Squarespace sites: no action required
Action for PHP sites: confirm patched version with your host in writing; review logs from 15 October
8 credits
Project Manager
SGD200 per credit
Whenever you need, buy it one time.
SGD4,250 | 25 credits
I like it; It works well for me!
SGD7,500 | 50 Credits
More you buy, more you save.
