Blog

Security and engineering notes from the AtasAI team

Practical write-ups on PHP, Laravel, WordPress and penetration testing.

PHP2Shell: CVE-2026-109618 and CVE-2026-109619, how to patch

Article

October 23, 2026

PHP2Shell explained: who is affected, how to patch, and why updating WordPress is not enough

PHP2Shell (CVE-2026-109618, CVE-2026-109619) lets attackers run code on PHP servers with no login. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart.