PHP Vulnerability: What PHP2Shell Is and How to Patch It

The PHP vulnerability known as PHP2Shell is a pair of critical flaws in the PHP runtime, tracked as two CVE records: CVE-2026-109618 and CVE-2026-109619. Either one can let an attacker run code on a web server without logging in. PHP released fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and it says updating is the only safe choice.

This guide gathers what PHP, the researchers, Cloudflare and Linux distributions have published so far. It covers the affected versions, the risk by server setup, the patch steps and the temporary measures. The facts are moving fast, so check the update log near the end for changes after 21 October 2026.

What Is the PHP Vulnerability Called PHP2Shell?

PHP2Shell is the nickname for two critical PHP vulnerabilities that live in the runtime, not in any application. Both are memory-safety bugs in how PHP handles a request that ends abnormally, for example when it runs out of memory. PHP rates each one 9.2 on CVSS v4.0, and the confirmed impact is unauthenticated remote code execution as the web worker account.

Cloudflare says Calif.io, Wiz, OpenAI and Quarkslab disclosed the flaws. PHP’s own advisories hold the technical detail for CVE-2026-109618 and CVE-2026-109619.

Table of the two PHP2Shell vulnerabilities, CVE-2026-109618 for out-of-memory corruption and CVE-2026-109619 for stale global state, with what goes wrong and the confirmed impact.

Which PHP Versions Are Affected?

The flaws hit every release before 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and researchers say they reach back to PHP 5.4. PHP’s GitHub advisory lists the supported branches. However, Wiz reports that every release in the last decade is hit by at least one of the bugs.

Table of the first fixed release for each PHP branch: 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with PHP 8.1 and older unsupported.

The old branches matter, because many sites still run them. W3Techs shows PHP on 69.3% of the sites whose language it knows, and 34.8% of those sites run PHP 7 or older.

Bar chart of PHP version share among PHP sites: 65.2 percent on PHP 8, 27.0 on PHP 7, 7.7 on PHP 5 and 0.1 on PHP 4, with PHP 7 and older having no official fix.

PHP gave no release for 8.1 and older. It did publish minimal source backports for 7.4, 8.0 and 8.1, and some distributions ship their own backports, so ask your vendor.

Who Is at Risk From the PHP Vulnerability?

Every PHP installation that serves web requests is at risk, and Apache with mod_php is the highest-risk setup. PHP’s advisory names PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.

You do not need a bug in your own code. Wiz demonstrated code execution against fresh WordPress, Drupal and Joomla images, and says even a simple Hello World page can fall to it.

Table of risk by PHP setup: Apache mod_php is highest risk, PHP-FPM is validated through CVE-2026-109619, FrankenPHP is likely exposed, and LiteSpeed and php-cgi are listed at risk.

Memory disclosure adds a second risk. Wiz says an attacker could read passwords, tokens, API keys and certificates from a worker’s memory, even without running code.

Is the PHP Vulnerability Being Exploited?

Reports differ. Cloudflare saw attack traffic against its customers before the public release, and watchTowr reports exploitation on its honeypots on 21 October. Other security sources say CISA and Huntress had seen none at the time. As of watchTowr’s last update, the CISA known-exploited catalogue did not list either CVE.

Details also leaked early. PHP had announced a release for 14:00 UTC on 21 October, and it reserved the right to move earlier. Cloudflare switched on WAF rules by default from 03:02 UTC that day, and it saw attackers mutate their payloads.

Timeline table from Wiz’s August discovery to PHP’s 21 October release, including the 20 October leak and Cloudflare’s default WAF protection.

How Do You Check Whether Your Server Is Affected?

To see whether the PHP vulnerability reaches your server, check the PHP version and the service that serves your site. Then compare the package with your distribution’s advisory. Linux vendors backport fixes without changing the version number, so a lower number can still carry the fix.

php -v
php-fpm -v                          # php-fpm8.3 -v on Debian and Ubuntu
dpkg -l | grep -E '^ii +php'        # Debian and Ubuntu
rpm -qa | grep -E '^php'            # AlmaLinux, Rocky, RHEL
apache2ctl -M | grep php            # mod_php on Debian and Ubuntu
httpd -M | grep -E 'mpm_|php'       # mod_php on the RHEL family

The command-line php -v can differ from the version your web service loads. That is why php-fpm -v and the package list matter. If a host or control panel manages PHP for you, ask the provider to confirm the patch.

How Do You Apply the PHP Patch?

Update to a fixed release or your distribution’s patched package, restart every PHP worker, and check that the new version is running. A restart matters because running workers keep the old code in memory.

# Debian and Ubuntu
sudo apt update && sudo apt upgrade
sudo systemctl restart php8.3-fpm

# AlmaLinux, Rocky, RHEL
sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm

# Check the start time is after the upgrade
systemctl status php8.3-fpm

Vendors are shipping at different speeds, so this snapshot dates from the evening of 21 October 2026. Ubuntu’s tracker lists fixed packages, and AlmaLinux was backporting its own.

Table of fixed PHP packages for Ubuntu 26.04, 24.04 and 22.04 and Debian 13, with AlmaLinux and Red Hat still pending.

If you use the volunteer-run rpms.remirepo.net repository, PHP says it will have no update on the day. PHP urges those users to move to distribution packages or build from source.

PHP Vulnerability Patch: What If You Cannot Update Today?

A configuration change reduces exposure, but it does not make a server safe, and PHP says updating is the only complete fix. Treat these measures as a bridge of hours, not days.

Table of stopgap measures from PHP’s advisory, such as memory_limit set to minus one, a low post_max_size and session upload progress disabled, with the CVE each one targets.

Restart every worker after each change. Also, never use RLIMIT_AS or RLIMIT_DATA as a memory cap, because they can trigger the vulnerable path.

What Should You Look for in Your Logs?

Wiz points to three signals that the PHP vulnerability is in use. They are multipart requests followed by memory-limit errors or repeated HTTP 500 responses, unusually large or malformed PHPSESSID cookies in responses, and unexplained PHP worker churn. These attacks run below the application, so application logs may say little.

An empty log is not proof of safety. PHP warns that a failure can happen before PHP writes any message, and that old logs may have skipped the relevant severities.

If you suspect a compromise, act on the server first:

• Isolate the server, and keep the logs before restarting anything.
• Rotate passwords, API keys, tokens and certificates the PHP worker could read.
• Rebuild from a known-good image when you cannot prove the server is clean.

Why Is This PHP Vulnerability Different?

It sits in the PHP runtime, so updating WordPress or a plugin does not fix it. Cloudflare makes the same point: administrators must update the PHP software itself. Frameworks and CMS code can be perfectly secure and still sit on an exposed runtime.

Wiz adds a second reason. It says the flaws were old, and that frontier AI models made a very hard exploit practical. By Wiz’s account, one researcher did in a week what once took a world-class team months. If that holds, old bugs become cheaper to weaponise.

PHP’s own release record shows the pace. Five of its 11 release rounds in 2026 fixed security issues, and four of the last five did.

Strip of PHP’s 11 release dates in 2026, coloured by type: grey for bug fixes, amber for security releases, and red for the emergency release on 21 October.

What Does This Mean for Dedicated Server Owners?

On a dedicated server you own the patching, including every PHP vulnerability. Nobody updates PHP for you unless you pay for management. Swify servers are unmanaged with full root access, so the PHP version and the patch day are your decision.

A short routine covers most of the work:

• List every PHP install: the system PHP, extra repositories, Docker images and control panels.
• Update the system packages, rebuild any container image, and restart every worker.
• Plan the move off PHP 8.2 before it reaches end of life on 31 December 2026.
• Run PHP workers under a low-privilege account, because the confirmed impact is code execution with that account’s rights.

PHP Vulnerability: The Short Version

The PHP vulnerability PHP2Shell is two critical runtime flaws, CVE-2026-109618 and CVE-2026-109619, with fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Patch, restart every PHP worker, and verify the new version is the one running.

• Check php -v, php-fpm -v and your distribution’s fixed package.
• Treat configuration changes as a short bridge, not a fix.
• Move off PHP 8.1 and older, which have no official update.

Update Log

This article changes as the story does. New entries go at the top.

Frequently Asked Questions

What is the PHP2Shell vulnerability?

Which PHP versions fix PHP2Shell?

Is my WordPress site affected by the PHP vulnerability?

Can I fix the PHP vulnerability without updating?

Is PHP 8.1 or PHP 7 still safe to use?

How do I check my PHP version on a server?

Is PHP2Shell being exploited?