PHP2Shell is the name being used for two critical flaws in the PHP runtime, CVE-2026-109618 and CVE-2026-109619. The PHP security team released emergency patches on 21 October 2026, and the flaws are rated critical because they can allow unauthenticated remote code execution.
This is a security story, not an email-marketing one, but it reaches email programmes quickly. Sign-up forms, landing pages, preference centres, tracking-link redirectors, WordPress newsletter plugins and self-hosted tools such as phpList, Mautic or Sendy commonly run on PHP. A compromised server can steal your list, send spam from your domain and wreck your sender reputation.
This post was written on the night of 21 October. Details are still developing, so check the primary sources linked below for updates.
What you will learn:
- What PHP2Shell is and which versions the PHP team says to install
- Which email marketing assets are likely to run PHP
- A step-by-step checklist for tonight and this week
- How to protect sender reputation and spot patch-themed phishing
The Short Version
- Two critical PHP flaws were patched on 21 October 2026.
- Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on PHP 8.x servers; older versions need vendor backports or migration.
- Mitigations exist but do not fully protect; patching is the real fix.
- Inventory every PHP-powered asset connected to your email programme.
- Watch for phishing emails pretending to offer a PHP patch.
Direct answer: if you or your agency host any PHP software tied to your list, forms or tracking links, find out which PHP version it runs on, ask your host to apply the fixed release, and review logs and sender reputation after patching.
What We Know So Far
Based on the PHP security team's announcement and reporting by BleepingComputer:
- Both vulnerabilities stem from PHP leaving memory in a corrupted state when a request ends abnormally.
- CVE-2026-109618 can lead to remote code execution as the web worker account via out-of-memory corruption.
- CVE-2026-109619 involves stale global state and can allow memory disclosure, heap use-after-free and remote code execution with the worker's privileges.
- The flaws affect PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers risk highest for mod_php.
- The issues were reported by researchers at Calif, OpenAI and Wiz.
- The UK National Cyber Security Centre has urged organisations to update or take affected systems offline until they can be patched.
- Cloudflare reported early attack attempts and deployed temporary web application firewall rules, while stressing they are not a substitute for patching.
Do not rely on this summary alone; read the PHP announcement and your host's advisories.
Which Email Assets Might Run PHP?
| Asset |
Why it matters |
Who to ask |
| WordPress or WooCommerce site with newsletter sign-up |
Holds forms, customer data and plugin code |
Host or developer |
| Landing pages and lead-capture forms |
Collect addresses and personal data |
Agency or developer |
| Preference centres and unsubscribe pages |
Handle consent and list changes |
Developer |
| Link-tracking or redirect scripts |
Used in campaign links |
Developer or ESP |
| Self-hosted tools (phpList, Mautic, Sendy, others) |
May store subscribers and send mail |
System administrator |
| Custom subscriber APIs |
Connect forms to your ESP |
Developer |
Hosted email platforms operate their own infrastructure. Ask the vendor for its security statement rather than assuming.
Checklist for Tonight
- List every PHP-powered property touching your email programme.
- Find the real PHP version each one runs. Control panels and CMS dashboards can show different versions from the web server in production.
- Check your host's advisory. Many shared hosts will patch centrally; confirm in writing.
- Install the fixed release or an equivalent vendor backport. If you cannot patch immediately, apply the PHP team's temporary mitigations and plan the upgrade.
- Rotate secrets after patching if compromise is possible: ESP API keys, SMTP credentials, database passwords and admin tokens.
- Review access and error logs for unusual requests, new files or unexpected admin accounts.
- Back up data before changes, and test forms after upgrading.
The temporary mitigations published by the PHP team include setting session.upload_progress.enabled=0 and restarting workers, setting a low post_max_size and setting memory_limit=-1 in a way applications cannot override. The team and developers have stated these do not fully protect, so use them only as a stopgap.
Protect Your Sender Reputation
A compromised site can damage email performance even if your ESP is untouched.
Worked example: estimating exposure
Suppose a WordPress site stores 48,000 subscribers and collects about 600 new sign-ups a week. If the site stays unpatched for one extra week and a breach exposes every record, that is 48,000 + 600 = 48,600 contacts affected. If notification and clean-up cost an illustrative $2.50 per record, the cost is 48,600 × $2.50 = $121,500. A planned maintenance window costing a few hundred dollars is small by comparison. The figures are illustrative, but the arithmetic shows why subscriber data is a liability as well as an asset.
Beware Patch-Themed Phishing
Attackers often exploit news cycles. Expect fake emails claiming to be from PHP, your host or an email vendor urging you to download a patch or log in.
- Do not download patches from email links; use official package repositories or your host's panel.
- Verify sender domains and check authentication results.
- Report suspicious messages to your security contact.
Communicate Carefully
If you find evidence that subscriber data was exposed, involve your legal or data protection contact promptly. Data-breach notification duties can apply in many jurisdictions, with strict timeframes. This article is not legal advice. If nothing was exposed, a brief internal note is usually enough; avoid alarming subscribers with unverified claims.
Common Mistakes
- Assuming the ESP's security covers your website.
- Trusting a dashboard version number without checking the running service.
- Relying only on mitigations.
- Forgetting forgotten subdomains, old landing pages and test servers.
- Skipping credential rotation after possible exposure.
- Clicking “patch now” emails.
Your email programme is only as secure as the least-patched PHP page connected to it.
Key Takeaways
- PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was patched on 21 October 2026.
- Patch PHP 8.x to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or use vendor backports for older versions.
- Inventory forms, landing pages, redirects and self-hosted tools.
- Rotate keys, review logs and watch deliverability signals.
- Treat patch-themed emails as suspicious.
Sources and Further Reading
Related Articles
Related tools: authentication health check, DMARC record generator, blacklist checker, sender reputation checker, link verifier.
Disclaimer: This article is general information, not security, legal or financial advice. It reflects information available on 21 October 2026 and may change; follow your host's and the PHP project's guidance. Example figures are illustrative.
