On October 21, 2026 PHP, the language WordPress and a large share of websites run on, released an emergency patch for two critical flaws: CVE-2026-109618 and CVE-2026-109619, known as php2shell. With a crafted web request, an attacker can run code on the server without logging in. Both score 9.2 out of 10.
What happened
The details leaked on social media a day before the official announcement. Real attacks started on October 21 itself, public exploits were circulating the next day, and on the 26th the US cybersecurity agency (CISA) added both flaws to its list of actively exploited vulnerabilities. In Europe, some governments took their sites down as a precaution while they updated.
What it means in Chile
Chile's national CSIRT, part of the cybersecurity agency ANCI, issued an alert on October 21 and published a mitigation guide on the 26th. The guide names WordPress, Joomla and Drupal among the affected applications and is clear about old versions: systems on PHP 8.1 or lower are vulnerable and will not get a patch.
No Chilean sites have been reported compromised so far. But in Chile many business, shop and brand websites are built on PHP, several of them WordPress on shared hosting, and in my experience a lot of them have gone years without anyone checking which version they run. These attacks are automated and probe any unpatched server, whether it belongs to a large company or a small shop.
If someone gets into your server and there is customer data on it, the problem is also a legal one: once Law 21.719 takes effect, you will have to protect the personal data you collect and report leaks.
Which version you need
The fixed versions are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
The last number is what matters: a site on "PHP 8.3" can be on 8.3.30 and still be vulnerable. In WordPress you can see it under Tools, Site Health, Info, Server. Updating WordPress or plugins does not fix this, because the flaw is in PHP. On shared hosting, the hosting company installs PHP: you pick the version and they apply the patch. If you see a lower number, write to them today.
PHP published some configuration changes as a stopgap, but it says they reduce the risk without removing it. Updating is the only complete fix.
If your site runs PHP 8.1 or older
PHP 8.1 and earlier have no official fixed release. If you cannot upgrade, both the Chilean CSIRT and CISA recommend taking the site offline until you do.
PHP 8.2 did get the patch, but its support ends on December 31, 2026. If you are upgrading anyway, go straight to 8.3 or 8.4, which is what WordPress recommends today.
Why switching the version is not enough
On most hosts the change is a dropdown. What can break is everything on top: old themes, abandoned plugins or custom code written for PHP 7. After the upgrade, those can throw errors or leave pages blank.
This is how I do it:
- Copy the site to a staging environment running the new PHP version.
- Check the error logs and the pages that matter most: home, forms, cart and payments.
- Fix what breaks, or replace abandoned plugins with ones that are still maintained.
- Back up and switch the version in production, with a plan to roll back if something goes wrong.
