PHP2Shell is the name for two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow an attacker to run code on a server without logging in. WordPress and WooCommerce run on PHP, so website owners should confirm their host has installed a patched PHP build.
https://thriveweb.com.au/blog/php-security-vulnerabilities-cve-2026-109618/
A race condition during core updates that could lead to remote code execution
WordPress 7.1.4 has been released containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7
https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html
Our server were patched within minutes of the fixes being available.
