PHP2shell Vulnerabilities Patched

Incident Report for PaymentWorks

Resolved

PaymentWorks statement on extent of PHP2shell Vulnerabilities:

On October 21, 2026, PaymentWorks became aware of two PHP vulnerabilities affecting public websites throughout the internet. Our internal security review confirmed that the PHP toolchain used by our public WordPress marketing website (www.paymentworks.com) was affected. These specific vulnerabilities:

1. CVE-2026-109618: Memory exhaustion can corrupt PHP's internal state and allow remote code execution (detail: https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)
2. CVE-2026-109619: Improper cleanup between PHP requests can allow remote code execution (https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)

We immediately took steps to determine our exposure, implement a patch and verify all our Production WordPress servers that same day.

Our use of PHP is limited to our public marketing website, which contains no platform business logic. Our main customer workloads run in a separate PaymentWorks system that does not use PHP for any purpose.

A detailed review found no evidence of unauthorized access to, or exposure of, customer data or credentials related to these vulnerabilities.

Posted Oct 21, 2026 - 13:00 EDT