On October 21, 2026, the PHP project announced two critical vulnerabilities and released fixed versions. A single crafted request from an unauthenticated attacker can be enough to run code on the server. The press has started calling the pair "PHP2Shell."

PHP powers WordPress and a large share of small business websites, as well as many self-hosted newsletter tools. Here is what that means if you send a newsletter, and what to check today.

What is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?

According to PHP's official advisory:
Vulnerabilities CVE-2026-109618 (memory corruption during out-of-memory handling) and CVE-2026-109619 (internal state that survives after its memory is freed)
Severity Both rated 9.2 (critical) on CVSS v4.0
Impact Unauthenticated remote code execution as the web server's user
Who is affected Any PHP installation that serves web requests. Apache with mod_php is described as the highest risk
Fixed versions PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (released October 21)
Older versions PHP 8.1 and earlier are out of official support; minimal backports were published for 7.4, 8.0 and 8.1

PHP says updating is the only complete fix. Configuration changes only reduce the risk.

Exploitation attempts were seen before the public announcement, and exploit code is circulating, according to security researchers and press reports.

How PHP2Shell affects your newsletter

There are two separate risks for anyone who sends a newsletter.

1. Your website gets taken over

If attackers take over your WordPress or other PHP site, they can plant fake announcements or links to malicious sites in your news and blog posts.

If you then build a newsletter from those posts, your own newsletter sends readers to a dangerous site. You lose readers' trust, and spam complaints will make your future emails harder to deliver.

2. Your sending system gets taken over

If you run a PHP-based newsletter tool or a WordPress newsletter plugin on your own server, attackers could:

  • Steal your subscriber list (email addresses and names)
  • Use your server to send spam or phishing in bulk
  • Damage your domain's reputation, so even your legitimate emails stop reaching inboxes

If you use WordPress or a newsletter plugin

WordPress and its newsletter plugins run on top of PHP. Updating WordPress and your plugins does not fix this vulnerability if PHP itself is out of date. Check your PHP version in your hosting control panel or in your host's announcements.

Checklist for today

What to do How to check
Check your PHP version Look in your hosting control panel or your host's notices. If it isn't one of the fixed versions above, ask your host or administrator to update
If you can't update right away Discuss PHP's interim settings with your administrator (they reduce, but don't remove, the risk). The UK's NCSC recommends taking systems offline if they can't be fixed promptly
Update WordPress and plugins Not a fix for this issue, but it closes other ways in
Review recent site content Look for posts or links you don't recognize
Watch your sending volume Look for sends you didn't schedule or sudden spikes
Watch spam complaints and bounces A sudden jump can point to a compromise
Read your DMARC reports Check whether unknown servers are sending mail as your domain

If your subscriber list may have leaked

Most privacy laws require you to act quickly when personal data may have been exposed by unauthorized access. In the EU and UK, GDPR generally requires notifying the data protection authority within 72 hours of becoming aware of a breach that poses a risk to people, and telling the people affected when the risk is high. In the US, most states have breach notification laws with their own rules. If you think subscriber data was exposed, check the rules where you and your subscribers are, and get advice.

Not hosting your own sending system

When you run your newsletter system on your own server, patching vulnerabilities like this one is your job. With a hosted newsletter service, keeping the sending infrastructure updated is the provider's responsibility.

Newsletter Ready does not use PHP, so it isn't affected by this vulnerability. The website your newsletter draws from is still yours to keep safe, so check its PHP version too.

Sources