PHP2Shell on Staatic Cloud: protection and patching
Updated October 21, 15:40 UTC: every site on Staatic Cloud now runs PHP with the fix: 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or our patched build of 7.4, 8.0 or 8.1. For your Staatic Cloud site there is nothing to do. If an origin rule forwards to your own server, or you run WordPress elsewhere, that PHP is yours to update (see below).
On October 21 the PHP project released fixes for CVE-2026-109618 and CVE-2026-109619, the two unauthenticated remote code execution bugs known as PHP2Shell. The background is in our insights article PHP2Shell: why updating WordPress will not fix it. This post covers sites on Staatic Cloud.
How your site is protected
Your published site is served as static files. A visitor’s request is answered with a file and does not reach PHP, except on paths you forward with an origin rule (see below).
Your WordPress origin, where you edit your site, does run PHP. It runs Apache with mod_php, the setup the PHP advisory rates as highest risk, so it needed the fix as much as any PHP server. Apart from the exceptions below, a request to the origin has to pass HTTP authentication at our proxy before it reaches PHP, and Apache checks it a second time.
There are two exceptions:
- Origin rules. If you have origin rules that forward paths to this site’s WordPress, our CDN lets those requests through to the origin without the login. Anyone visiting a forwarded path on your public site therefore reaches PHP, which is why those paths needed the fix too.
- Platform endpoints. On a few sites we have switched on endpoints that the platform itself uses. You cannot switch these on yourself.
What we patched
We updated the WordPress images for every PHP version we offer. Versions 8.2 to 8.5 run the PHP project’s new releases, which we compiled from the official sources rather than wait for the official Docker images. Versions 7.4, 8.0 and 8.1 run our own build with the backport patches published by the PHP security team. The update needed nothing from you.
Cloudflare’s managed rules and the request filter we added for the platform endpoints stay in place for now.
What you can do
If you use origin rules that forward paths to this site’s WordPress, those paths now reach patched PHP too. There is nothing to change.
If your site runs PHP 8.1 or older, our backported build already closes these two bugs. You can see the version under Environment on the site’s WordPress tab, or in WordPress under Tools → Site Health → Info → Server. The PHP project no longer fixes those versions, though, so the next bug may stay open. Moving to PHP 8.4 or 8.5 is the better long-term choice, after checking that your theme and plugins support it. PHP 8.2 loses security support at the end of 2026, so the same applies there. The PHP version is set on our side, so contact us and we will plan the switch with you.
If you run PHP elsewhere, you have to update it yourself. That includes servers your origin rules forward to and WordPress sites that use the Staatic plugin outside Staatic Cloud. The insights article lists what to check.
Questions about your site? Contact us.