Skip to content
Atas
AI
How it works
What we build
Engagements
Blog
Book a working session
Talk to us
Blog
Security and engineering notes from the AtasAI team
Practical write-ups on PHP, Laravel and WordPress.
Article
October 23, 2026
PHP2Shell explained: who is affected, how to patch, and why updating WordPress is not enough
PHP2Shell (CVE-2026-109618, CVE-2026-109619) lets attackers run code on PHP servers with no login. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart.