What is PHP2Shell?
PHP2Shell is the name of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), that let an attacker run code on a server with no username or password. PHP shipped the fixes on October 21, 2026, and real attacks were seen the same day. If your site or system runs on PHP, check your version today.
The first flaw shows up when PHP runs out of memory halfway through setting up a request and leaves internal data half-built. The second leaves stale state from one request that the next request handled by the same worker can abuse. Either way the outcome is the same: an outsider can run their own commands on your server, according to PHP's official notices.
Which PHP versions are affected?
Every branch that serves web requests is in scope, whether through PHP-FPM, Apache mod_php, php-cgi, LiteSpeed or FrankenPHP. PHP rates the risk highest for Apache mod_php, because the attack can succeed before your application code runs.
| Branch | Affected | Fixed release |
|---|---|---|
| 8.5 | before 8.5.12 | 8.5.12 |
| 8.4 | before 8.4.27 | 8.4.27 |
| 8.3 | before 8.3.36 | 8.3.36 |
| 8.2 | before 8.2.35 | 8.2.35 (end of life Dec 31, 2026) |
| 7.4, 8.0 and 8.1 | all | no official release: your distribution's package or PHP's minimal backport |
| 7.3 and older | all | no fix: upgrade |
The most common case we see is a system built years ago that still runs PHP 7.4 or 8.1 on shared hosting or a VPS. There, «updating PHP» from a control panel isn't enough: you need your distribution's fixed package, the backport, or a move to a supported branch.
How do I know if my server is exposed?
Three ways, from fastest to most thorough:
- From the outside, without touching anything: the free Security OS check reads only your homepage's public response and tells you whether it advertises a vulnerable or unsupported PHP version.
- On the server: «php -v» in a terminal, or «phpinfo()» on a temporary page you delete afterwards. Also check the PHP-FPM or Apache module version, which can differ from the command line.
- Full inventory: every server, container and hosting account running PHP, starting with the internet-facing ones. It's the step almost nobody has done.
What should I do today if my PHP is vulnerable?
- Update to the fixed release for your branch (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or to your distribution's updated package.
- Restart every PHP worker (PHP-FPM, Apache). Without a restart, the fix doesn't take effect.
- On 7.4, 8.0 or 8.1, use your distribution's package or an extended-support vendor, or apply PHP's minimal backport. And plan the upgrade.
- If you can't update today, restrict who can reach the server (firewall or WAF in front) while you sort it out.
PHP published temporary measures that reduce the risk but do not remove it: set «memory_limit=-1» and a low «post_max_size» in the pool or Apache config (not in the application), and turn off «session.upload_progress.enabled». They buy you hours, not a permanent state. PHP is explicit: the only complete fix is to update.
; php.ini or PHP-FPM pool — restart every worker afterwards memory_limit = -1 ; via php_admin_value so the app can't override it post_max_size = 8M ; 32M if your system accepts uploads session.upload_progress.enabled = 0
On October 23 PHP announced a third flaw, CVE-2026-115560, which only applies to an unusual session setup and will be fixed in the next release. The same «session.upload_progress.enabled = 0» line covers it in the meantime.
And after the patch?
PHP2Shell won't be the last one. What changes a company's risk isn't reacting to each headline but knowing what it has exposed: which versions run, which ports are open and who can get in. It's the same principle as closing port 22 and working in layers, and, if your system lives in the cloud, reviewing the whole AWS account.
PHP 8.2 also stops receiving security fixes on December 31, 2026. If your system is on 8.1 or 8.2, the next flaw won't get an official patch. It's a good time to plan the move to 8.4 without breaking production. If you run Laravel or WordPress, also check this week's alerts.
Passive check: it only reads your homepage's public response, like a browser. Use it only on domains you own or manage.
Check my PHP for freeFrequently asked questions
What is PHP2Shell?
It's the name of two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2. They allow code execution on the server without logging in. They were fixed on October 21, 2026 and are already being exploited.
Is PHP 7.4 vulnerable to PHP2Shell?
Yes. PHP 7.4, 8.0 and 8.1 are affected and have no official fixed release. The way out is your distribution's or an extended-support vendor's updated package, the minimal backport PHP published, or upgrading to a supported branch.
How do I know which PHP version my server runs?
On the server, with «php -v» or «phpinfo()» on a temporary page. Also check PHP-FPM or the Apache module, which can run a different version. From the outside, the free check at security.wits.mx tells you whether your homepage advertises a vulnerable version.
Is changing php.ini enough?
No. PHP published temporary measures (memory_limit=-1, a low post_max_size and turning off session.upload_progress) that reduce the risk, but it states that no configuration change removes it. The only complete fix is to update and restart the workers.
Is my WordPress site affected?
If your host runs an affected PHP version, yes: the flaw is in PHP, not WordPress. Ask your host which version it runs and whether the patch is applied, or check it in your control panel.
Is PHP2Shell in CISA's KEV catalog?
As of October 22, 2026 it wasn't in CISA's Known Exploited Vulnerabilities catalog, although watchTowr was already reporting real exploitation. Not being in KEV doesn't mean it isn't being exploited.
When does PHP 8.2 support end?
On December 31, 2026. After that date PHP 8.2 gets no more security fixes, as has been the case for 8.1 since December 31, 2025.
Sources
- PHP: security notices of October 20, 21 and 23, 2026
- GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
- GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
- watchTowr: PHP CVE-2026-109618 FAQ
Written by Samuel Hinojosa and the wITS security team · Updated Oct 25, 2026 · Markdown
