PHP2Shell: two critical PHP flaws get an emergency patch today and stolen UpdraftCentral keys backdoor WordPress: check the website of your Mexico operation

On October 20 the PHP project warned of two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. Emergency patches ship today, October 21, at 14:00 UTC (8:00 a.m. in Mexico City). BleepingComputer broke the news, and it already has a name: PHP2Shell.

Remote code execution means someone on the internet can make your server run whatever they want. The same day, a second story landed: stolen UpdraftCentral keys are being used to plant backdoors in WordPress sites. If your Mexico operation has a local website, an online store or a system a local vendor built in PHP, this one is yours.

Where PHP runs in your Mexico operation

PHP powers a big share of the web. WordPress is the obvious one. In our experience, the surprise is everything else a Mexico site collects over the years:

Where	Typical example	Who patches it
Shared hosting or cPanel	The local Spanish-language site, the marketing blog	The hosting provider
Online store	WooCommerce, PrestaShop, Magento	You or your agency
Internal systems	CRM, intranet, CFDI invoicing portal, quoting tool	Whoever built it
Devices with a web panel	NAS, some camera recorders and phone systems	The manufacturer, via firmware

That quoting tool a local freelancer built five years ago, the one the sales team uses every day, very likely runs on PHP. And headquarters often has no idea it exists. Among sysadmins, today’s question is exactly that: how do you find the PHP you don’t know you’re running?

What protects you before the patch, and what does not

The Hacker News published a breakdown of what actually protects you before the 14:00 UTC patch. Our take, in short:

• A WAF (web application firewall, like Cloudflare or your host’s) helps if it already has rules for these flaws. It helps. It does not seal anything.
• Disabling risky PHP functions limits the damage, but it can break the site if done blindly.
• Running an old version does not save you. If your PHP branch is out of support, a patch may never come for it.
• Hiding the version number in the site headers protects nothing.

What to ask your hosting provider today

If the site sits on shared hosting, the patch depends on your provider. Do not wait for their email. Send them these three questions today, in English or Spanish:

1. Which PHP version runs on our account, and when will you install the release that fixes CVE-2026-109618 and CVE-2026-109619?
2. Does our version still receive patches? If not, which one can we move to without breaking the site?
3. Is a WAF with PHP2Shell rules active in the meantime?

In cPanel you can check the version in MultiPHP Manager. If the system runs on your own server or a VPS in Mexico, the patch is on you or your IT provider. Today, not next week.

UpdraftCentral: check WordPress keys and plugins

UpdraftPlus is a popular WordPress backup plugin, and UpdraftCentral is its dashboard for managing several sites in one place. According to BleepingComputer, attackers are using stolen keys from that dashboard to install backdoors: hidden ways back in whenever they want.

Check today, even if nobody at your company has heard of UpdraftCentral:

• In UpdraftPlus, UpdraftCentral tab: delete any key you do not recognize. If your agency does use it, have them issue new keys.
• Admin users: is there one nobody created?
• Plugins: anything installed recently that nobody asked for?
• Update every plugin and remove the ones you no longer use.

Let’s talk

What about your Mexico operation?

If nobody can tell you how many PHP systems your Mexico site runs, start there. A list of where each one lives, who patches it and which version it runs already puts you ahead of most.

ProcessBi builds that inventory of PHP sites and systems, applies the patch and hunts for backdoors, as part of our IT support plans and our web development service. In English or Spanish, invoiced in MXN or USD.

Tell us what your Mexico site runs — we reply the same business day.