PHP2Shell and UpdraftCentral Keys: Two PHP Threats to Fix Now

This blog was originally published by Jason Taylor on the Raxis blog October 21, 2026

Two separate threats hit PHP websites this week, one in PHP itself and another affecting a popular WordPress plugin developer. On October 21, the PHP project released emergency patches for two remote code execution flaws in the PHP runtime, nicknamed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS v4.0 score of 9.2 and let an unauthenticated attacker run code on a web server. Because the bugs live in PHP itself, a site can be exposed even when its own application code is secure.

The second threat targets WordPress. Attackers breached TeamUpdraft, the developer of the UpdraftPlus backup plugin, and are now using stolen UpdraftCentral connection keys to send signed commands that install backdoor plugins on connected sites. Those plugins create hidden accounts that stay in place even after the plugin is deleted.

PHP2Shell: Check Your Versions and Patch

According to The Hacker News, nearly every PHP version back to 5.4 is affected, including servers running Apache mod_php or PHP-FPM. Apache mod_php carries the highest risk, since a single request can trigger the attack before any application code runs. Researchers also showed the flaws can leak live worker memory, which may expose passwords and API keys from other users’ requests. Cloudflare reported exploit attempts before the patch was public.

To see whether you are exposed, run php -v on each server and compare the result against the fixed releases: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Some Linux distributions backport fixes under older version numbers, so search the package changelog for the CVE numbers instead of relying on the version string. Include container images and appliances that bundle their own PHP. If your site runs on shared hosting, ask your provider whether they have applied the update. The Dutch NCSC maintains a PHP2Shell GitHub page with operational guidance.

In the short term, patch and then restart every web server and PHP worker process so the new runtime actually loads. If you cannot patch right away, The Hacker News describes interim settings such as disabling session.upload_progress and enforcing request size limits at the web server or proxy. These stopgaps reduce exposure but do not make a server safe. The patch also adds a hard memory limit, so review memory_limit and post_max_size against your application’s needs.

The long term issue is version support. PHP 8.1 and older receive no fix from the PHP project, and PHP 8.2 reaches end of life on December 31, 2026. Moving to PHP 8.3 or newer and keeping an inventory of where PHP runs will make the next emergency release a routine update.

UpdraftCentral Keys: Review Every Connected Site

The Hacker News reports that Wordfence considers a site possibly affected if UpdraftPlus was active while a compromised UpdraftCentral key was present. Self-hosted UpdraftCentral is not affected. TeamUpdraft still advises every site owner to look for unexpected plugins and new administrators.

For immediate cleanup, follow the steps on the TeamUpdraft incident page. Log in to each site directly instead of through UpdraftCentral and update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium) or later. Next, delete the connection key under Settings > UpdraftPlus > Advanced Tools > UpdraftCentral. Then review your Users list and your Plugins, including the Must-Use tab. Patchstack counted 99 different backdoor plugin names, and each sample carries the description “Small maintenance toolkit: keeps option storage tidy.” Change administrator passwords, and, if anything looks wrong, restore from a backup taken before October 17. Account holders should also change their teamupdraft.com password.

Over the long term, treat any remote management key that can install plugins as an administrator credential. Remove connections you no longer use, and require two factor authentication on administrator logins. The backdoor account can sign in through the normal login form unless 2FA is enabled.

How Raxis Can Help

Raxis sent an overview of both issues to our newsletter subscribers today. Customers of our Penetration Testing as a Service (PTaaS) offering were notified directly as part of that service, and we contacted those we believe may be affected.

An external network penetration test shows which internet-facing servers still run vulnerable or unsupported PHP versions. A web application penetration test looks at your WordPress sites the way an attacker would, including unexpected accounts and management connections that grant more access than they should.

To get alerts like for critical issues like that this as the news breaks, sign up for the Raxis newsletter. As always, the Raxis team is available if we can help in any way, so contact us with any questions.