Critical PHP Vulnerability (PHP2Shell): How Levamo Is Protecting Your Site

Two critical vulnerabilities in PHP itself are being actively exploited right now. Not a plugin. Not a theme. The actual PHP engine that runs every WordPress site on the internet.

Here's what's happening, what we've already done about it, and what you need to know.

What's Happening

On 20 October 2026, the PHP Foundation disclosed two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS score of 9.2 (critical). Both allow remote code execution. The security community has dubbed this "PHP2Shell."

Here's why it's serious: these flaws exist in the PHP interpreter, not in any specific application or plugin. That means every PHP-based platform is potentially exposed, including WordPress, WooCommerce, Drupal, Magento, Laravel, and anything else running PHP.

The PHP team has scheduled an emergency release for 21 October 2026 at 14:00 UTC. CERT-EU has issued a formal advisory urging organizations to prepare for immediate patching.

Attacks are already underway. Cloudflare has confirmed active exploitation, and multiple hosting providers have reported incidents to Patchstack's emergency response team.

Timeline So Far

Here's what's happened, and when:

• 20 October. The PHP Foundation discloses two critical vulnerabilities and schedules an emergency release for the following day. Details leak ahead of coordinated disclosure. Security firm watchTowr confirms both vulnerabilities are real and reproduces one of them.
• 20 October (evening). CERT-EU publishes its formal advisory. Exploit details begin circulating in the security community.
• 21 October (early hours). Active exploitation confirmed. Patchstack enters emergency response mode. Multiple hosting providers report live attacks.
• 21 October (Levamo response). Our engineering team force-updates PHP configuration across all customer sites as a precautionary measure. Pre-built RPM packages staged for all PHP versions. Enterprise Cloudflare WAF filtering known exploit patterns as an additional layer. Direct coordination established with Patchstack and Monarx security teams.
• 21 October, 14:00 UTC (expected). The PHP team releases patched versions. Levamo begins recompiling, validating, and deploying updates across all customer environments.

How Levamo Is Responding

We didn't wait for the patch release. Our engineering team began preparing the moment the disclosure dropped.

Interim Protection (Already Live)

We've force-updated the PHP configuration across every customer site to disable session.upload_progress, the feature linked to the attack vector researchers have identified. This went out as a precautionary measure while the full fix is pending.

Important context: PHP core developers have stated that this configuration change alone does not fully mitigate the vulnerability. It reduces the attack surface, but it's not a replacement for patching. That's why we deployed it as one layer in a multi-layer response, not a standalone fix.

Enterprise Cloudflare WAF (Additional Layer of Defense)

Every Levamo plan includes Enterprise Cloudflare, and it's actively filtering known exploit patterns targeting this vulnerability across all customer sites right now. No extra configuration needed. No add-on to enable.

To be clear: no WAF is a substitute for patching PHP itself. The only complete fix is the updated PHP release. But having Enterprise Cloudflare between the internet and your site reduces your exposure while we wait for the patch, and it's one of the reasons we include it on every Levamo plan, even Starter at $35/mo. Your store, your membership site, your course platform: they all have that layer in front of them right now, at no additional cost. Learn more about our Enterprise Cloudflare CDN stack.

Patched PHP Builds (Ready to Deploy)

We've pre-built RPM packages for PHP 8.2 through 8.5 and staged them on our private build servers. The moment the PHP team releases the patched source code (expected 14:00 UTC today), we'll recompile, validate, and begin rolling out across every customer environment.

Our target: all PHP 8.2+ sites running patched builds within hours of the official release. Updates happen server-side, automatically. You won't need to click anything or schedule maintenance.

Security Partner Coordination

We're in active communication with both of our security partners:

Patchstack has entered emergency response mode, dedicating all engineering and security research resources to reducing the blast radius across the industry. We have a direct coordination channel with their team, and Advanced SiteShield (powered by Patchstack) is actively blocking known exploit patterns on protected sites. Learn about Advanced SiteShield.

Monarx, our server-level malware scanning partner, has their team on standby with resources ready to evolve detection rules as the situation develops. Their scanning stack continues monitoring for any malicious activity that could result from exploitation attempts, adding another layer of defense across every customer site.

The PHP 8.0 and 8.1 Challenge

Here's the part that has the entire hosting industry concerned.

PHP 8.0 and 8.1 reached end-of-life before this vulnerability was discovered. The PHP team has not yet confirmed whether they will release security patches for these versions.

If your WordPress site runs PHP 8.0 or 8.1, you're in a more exposed position. Not because Levamo isn't protecting you (the Cloudflare WAF and configuration changes apply to all sites), but because an official PHP patch may not arrive for your version.

What we're doing about it:

• Tracking the Remi repository team, who handle PHP backports and may release patches for end-of-life versions
• Preparing our own validated builds as a fallback if third-party backports aren't available
• Recommending that all customers on 8.0 or 8.1 upgrade to PHP 8.2 or newer

You can check your PHP version in your Levamo dashboard. If you need help upgrading, reach out to our support team. We'll handle it for you.

What You Should Do Right Now

If you're a Levamo customer on PHP 8.2 or newer, you don't need to do anything. We're handling everything server-side and will send a follow-up once patched PHP versions are deployed.

If you're on PHP 8.0 or 8.1, contact our support team to upgrade. It takes minutes, and it puts you on a version that will receive the official patch.

Regardless of your PHP version, keep these in mind:

• Do not install unofficial "fix" plugins from social media or forums. The PHP team has confirmed the only real mitigation is updating PHP itself.
• Do not paste .htaccess snippets or PHP configuration changes from unverified sources. Some of these can break your site or introduce new vulnerabilities.
• If you manage WordPress sites outside of Levamo (staging environments, local installs, other hosts), make sure those are patched too once the fixed versions are available.

Wrapping Up

PHP2Shell is a serious vulnerability, and the fact that exploits are already in the wild makes speed essential. But this is exactly the kind of situation where managed hosting earns its keep.

Your PHP configuration has already been hardened. Your Enterprise Cloudflare WAF is filtering known exploit patterns. And the real fix, patched PHP builds, will be deployed automatically the moment they're validated. None of these layers alone is a complete solution, but together they reduce your exposure significantly while the patch is finalized. You don't need to scramble for a fix, monitor security feeds, or wonder whether a random plugin will save you.

We'll send a follow-up once patching is complete. If you have questions before then, our support team is standing by 24/7.

Want WordPress hosting that handles security incidents for you? Try Levamo for $1 your first month and see what proactive managed hosting looks like.