PHP2Shell is the nickname for two critical remote code execution flaws in the PHP core, tracked as CVE-2026-109618 and CVE-2026-109619. Their details leaked online on October 20, ahead of coordinated disclosure, and PHP shipped fixes on October 21, 2026. If your website, store or app runs on PHP, this affects you, and the safest move is to patch and restart PHP today.
Table of Contents
What is PHP2Shell?
PHP2Shell is not a bug in a plugin or a CMS. The flaw sits in the PHP runtime itself, not in application code, so even a well-maintained website can be exposed. The original discovery is credited to the Calif research team.
The security industry compares it to Log4Shell. Dark Reading describes it as another case of defenders racing to patch a major flaw in widely used open source software. PHP powers a very large share of the web, and attack attempts were reported around the time of disclosure, so it is wise to assume active exploitation.
The two CVEs at a glance
| CVE-2026-109618 | CVE-2026-109619 | |
|---|---|---|
| Impact | Remote code execution | Remote code execution |
| Cause | Out-of-memory state corruption | Stale global state |
| Severity | CVSS v4.0 9.2 (Critical) | CVSS v4.0 9.2 (Critical) |
| Authentication | None required | None required |
Which PHP versions are affected?
PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026. Any earlier release within those branches is vulnerable, and older branches receive no upstream fix at all.
| PHP branch | Vulnerable | Fixed in | Support status |
|---|---|---|---|
| 8.5 | Before 8.5.12 | 8.5.12 | Supported |
| 8.4 | Before 8.4.27 | 8.4.27 | Supported |
| 8.3 | Before 8.3.36 | 8.3.36 | Supported |
| 8.2 | Before 8.2.35 | 8.2.35 | Security fixes end December 31, 2026 |
| 8.1, 8.0, 7.x, 5.x | All versions | No upstream patch | End of life |
One catch: Linux distributions often backport fixes without changing the version number. For example, AlmaLinux published patched packages with numbers like php-8.2.33-1, which look older than 8.2.35 but include the fix. Always check your vendor’s advisory before assuming a lower version number means you are exposed.
How to fix PHP2Shell
- Inventory every PHP environment. Servers, containers, staging sites and forgotten legacy apps all count. As Sonatype explains, this event tests whether you can find, own and update the software running in your environment.
- Upgrade to a fixed release. Start with internet-facing systems.
- Restart PHP-FPM or your web server. Old workers keep running the old code until they are restarted.
- Rebuild containers. Pulling a new image is not enough if your pipeline pins an older base image.
- Apply a temporary mitigation if you cannot patch yet. The Qualys mitigation guidance disables PHP’s session upload-progress feature and hardens related session settings. Treat it as a stopgap only.
What if you are on end-of-life PHP?
This is the biggest problem. PHP 8.1 and older receive no security release from php.net, and TuxCare reports roughly 884,000 internet-facing hosts advertising an end-of-life version. Your realistic options, in order of preference:
- Migrate to a supported branch. This is the real fix. Test plugins, themes and custom code on a staging site first.
- Use an extended-support vendor that backports the fix to older branches.
- Use a community mitigation module only as a temporary bridge. Its own authors recommend installing the official release wherever possible.
- Isolate or take the system offline if none of the above is possible.
How to tell if you have been targeted
Patching closes the hole, but it does not tell you whether someone got in first. Look for:
- Unusual child processes spawned directly by PHP workers such as php-fpm, php-cgi, httpd or apache2.
- PHP-FPM or web server logs showing worker crashes, memory-exhaustion errors or unexplained empty 500 responses.
- Unknown PHP files in upload or cache directories, or recently modified core files.
- Unexpected outbound connections from the web server.
A note on tools: the public PHP2Shell scanner can report false positives on some configurations, so verify any result against your installed version and vendor backports.
PHP2Shell and WordPress or shared hosting
WordPress itself is not the vulnerable component, but it runs on PHP, so every WordPress site on an unpatched PHP version is exposed.
- Managed or shared hosting: you usually cannot patch PHP yourself. Open a ticket asking which PHP version you are on and whether the PHP2Shell fix or a vendor backport has been applied.
- cPanel: the PHP version is typically changed through MultiPHP Manager. Take a full backup and test on staging, because upgrading can break older plugins.
- VPS or dedicated server: you own the patching, so follow the steps above.
PHP2Shell FAQ
What is PHP2Shell?
Two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution.
Is PHP2Shell being actively exploited?
Attack attempts were reported around the disclosure, so assume it is and act accordingly.
Which PHP version is safe?
Use 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later, or a vendor build that confirms the backport.
Do I need to restart anything after updating?
Yes. Restart PHP-FPM or Apache so running workers load the patched code.
Does a WAF fix PHP2Shell?
A WAF can reduce exposure, but it is not a substitute for patching.
Final checklist
- List every PHP version across all environments
- Upgrade to a fixed release or confirm your vendor backport
- Restart PHP-FPM or the web server
- Rebuild containers from patched images
- Plan your migration off end-of-life PHP
- Review logs and processes for signs of compromise
Patching is step one. If you want to know whether your PHP stack was already compromised, or whether other weaknesses sit behind it, a professional VAPT assessment tests your real exposure before an attacker does.
