Wordfence sees no confirmed WordPress compromises from PHP2Shell
Original title: PHP2Shell Update: Still No Confirmed WordPress Compromises, and Answers to the Questions We’re Hearing Most
From October 23 to 27 Wordfence logged about 77,600 PHP2Shell requests from more than 2,000 IPs and still urges a PHP update plus restart.
As of October 28, 2026, Wordfence says it knows of no WordPress site compromised through PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Monitoring from October 23 to 27 logged about 77,600 related requests from more than 2,000 IP addresses, treated as scanning and exploitation attempts rather than proof of success. Emergency PHP fixes remain 8.5.12, 8.4.27, 8.3.36 and 8.2.35; updating WordPress does not update PHP.
Unconfirmed: Dream’s firewall takeover and Morphisec’s IIS code-execution report are unverified by Wordfence and are not tied to WordPress.
- Fixed PHP builds named are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- About 77,600 requests came from more than 2,000 IP addresses.
- Wordfence has not verified Dream’s firewall report or Morphisec’s IIS case.
- Wiz said none of the attempts it observed completed successfully.
- Palo Alto reported PAN-OS management exploitation without linking it to Dream.
Impact: Site files, database and passwords if an attack succeeds
| Product | Affected | Fixed in |
|---|---|---|
| The PHP Group PHP | — | 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
- 1.Update server PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP.
- 2.Do not treat a WordPress update as a PHP update.
- Vendors
- The PHP Group
- Organizations
- WordfenceDreamPalo Alto NetworksWizMorphisec
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
From the original article
14 min read at wordfence.com
As of October 28, 2026, Wordfence knows of no WordPress site compromised through PHP2Shell. Update PHP to a fixed version and restart it, because updating WordPress does not update PHP. The post PHP2Shell Update: Still No Confirmed WordPress Compromises, and Answers to the Questions We’re Hearing Most appeared first on Wordfence.
By Brad Osborne · wordfence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.