Last updated: 22 October 2026. This is a fast-moving issue. We will update this page as vendors publish new information.
On 20 October 2026 the PHP security team warned of an emergency release for two critical flaws in PHP itself. Details leaked online the same day, and the patches shipped on 21 October, a day earlier than planned. Together the two bugs are known as PHP2Shell (also written php2shell). Both are rated 9.2 out of 10 (CVSS v4.0), and both can let an attacker run code on a web server without logging in.
PHP runs roughly 7 in 10 websites whose server language is known, including every WordPress, Drupal, Joomla and Magento site. So this is one of the most widely relevant server bugs in years. This post explains what happened in plain language, who is affected and what to do first.
PHP2Shell in 30 seconds
- What: two memory-handling bugs inside the PHP interpreter, CVE-2026-109618 and CVE-2026-109619. They are not WordPress or plugin bugs.
- Impact: unauthenticated remote code execution (RCE), and memory disclosure that can leak passwords, tokens and API keys.
- Affected: PHP 8.2, 8.3, 8.4 and 8.5 before the fixed releases. Older branches back to PHP 5.4 contain the vulnerable code too.
- Fixed in: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or your Linux distribution’s patched package.
- Do now: update PHP and restart every PHP worker. If you can’t update today, apply the temporary settings below and limit public access.
What exactly are the two bugs?
CVE-2026-109618: out-of-memory corruption
While PHP sets up an incoming request, it builds internal data structures. If the process runs out of memory at just the wrong moment, those structures are left half-built. PHP’s cleanup code later treats the half-built data as valid, and a carefully crafted request can turn that into code execution. PHP confirmed full RCE over HTTP against Apache mod_php with default input and memory limits.
CVE-2026-109619: stale global state (use-after-free)
PHP keeps some request-specific state after the memory behind it has been freed. When the same worker process handles the next request, it can read that stale state before it is reset. This is a classic use-after-free. Researchers used it for memory disclosure and for RCE. One confirmed trigger path is the session upload progress feature, which is on by default, but researchers say it is not the only path.
Both flaws are reached before your application code runs, so a well-written WordPress or Laravel app does not protect you. The fix has to happen in PHP.
Timeline
| Date (2026) | What happened |
|---|---|
| 17 Oct | Amazon Threat Intelligence says its honeypots saw a php2shell exploitation attempt, four days before public disclosure. |
| 20 Oct | CVE IDs leak on Hacker News and social media. PHP publishes an advance notice of a critical release, and CERT-EU issues advisory 2026-018. |
| 21 Oct | PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Researchers (Calif, Wiz) publish technical write-ups. Cloudflare reports early attacks and adds WAF rules, and CISA urges immediate patching. |
| 22 Oct | Linux distributions continue shipping backported packages. Amazon describes php2shell as broadly exploited in the wild. |
The reports on exploitation differ. Amazon and watchTowr report exploitation attempts. Huntress had not seen successful exploitation on its partners’ systems as of the evening of 21 October, and PHP said the public proof-of-concepts it reviewed at release were not functional. Treat it as actively targeted: attackers move fast once a bug with a catchy name and a 9.2 score is public.
Which PHP versions and setups are affected?
| PHP branch | Status | What to do |
|---|---|---|
| 8.5 | Affected before 8.5.12 | Update to 8.5.12 or later |
| 8.4 | Affected before 8.4.27 | Update to 8.4.27 or later |
| 8.3 | Affected before 8.3.36 | Update to 8.3.36 or later |
| 8.2 | Affected before 8.2.35 | Update to 8.2.35 or later (8.2 support ends 31 Dec 2026) |
| 7.4 – 8.1 | Affected, end of life | No official release. Use a distro/LTS backport or PHP’s source backport, or upgrade to 8.3+ |
| 5.4 – 7.3 | Affected, end of life | No fix from PHP. Upgrade, or take the system off the internet |
Distribution packages can keep the old version number. Ubuntu 24.04, for example, fixed PHP 8.3 in package 8.3.6-0ubuntu0.24.04.13, which still reports itself as “8.3.6”. Always compare the full package version with your vendor’s advisory, not just php -v. Our step-by-step patching guide shows how.
Every way of running PHP for the web is in scope: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates mod_php as the highest risk, because the demonstrated exploit fires before any application code runs. PHP-FPM blocks one specific out-of-memory path at startup, but PHP still validated RCE against FPM, so FPM needs the update too.
What to do now (priority order)
- Find every PHP install: web servers, containers, control panels (cPanel, Plesk), vendor appliances. The CLI
php -vmay not be the binary your web server uses. - Update to the fixed version for your branch, or to your distribution’s patched package.
- Restart all PHP workers (PHP-FPM, Apache, LiteSpeed), then confirm the running version.
- If you can’t patch today: set
session.upload_progress.enabled = 0at the server or pool level (not withini_set()). On PHP 8.5, also setfatal_error_backtraces = 0. Restart workers. PHP lists more temporary measures, and none of them is a full fix. - Reduce exposure: put internet-facing sites behind a WAF (Cloudflare added free rules for known vectors), or restrict access until patched.
- Look for signs of compromise from 17 October onwards: PHP processes starting shells or
curl/wget, new PHP files in the web root or uploads, new cron jobs or admin accounts.
On shared or managed hosting you can’t patch PHP yourself. Your host has to. Our 15-minute checklist for WordPress and shared-hosting owners covers what you can check and what to ask your host.
Is this the same as wp2shell?
No. wp2shell (CVE-2026-63030 and CVE-2026-60137, July 2026) was a WordPress core bug chain, fixed in WordPress 6.8.6, 6.9.5 and 7.0.2. PHP2Shell is a bug in PHP itself, so updating WordPress does not fix it. A site can need both fixes, but they are separate.
FAQ
Does a WAF or security plugin protect me?
A network WAF such as Cloudflare’s can block known exploit patterns and buys you time. A WordPress security plugin runs inside PHP, after the vulnerable code, so it cannot stop this bug. Only a patched PHP closes the hole.
Is changing php.ini enough?
No. PHP’s settings changes reduce known attack paths, but PHP and the researchers stress that updating is the only complete fix. Some sources say config changes alone are not a suitable mitigation at all.
How do I know which PHP version my site runs?
In WordPress, go to Tools → Site Health → Info → Server. On a server, check your package manager and the running FPM or Apache process, not just the CLI. Our free Website Safety Check tests HTTPS, headers and email security, but it cannot see your PHP version for you.
Need help?
We patch, harden and audit Linux and PHP servers for small businesses. If you aren’t sure your servers are patched, or you think one was attacked, see our Linux server hardening & audit and VAPT services, or contact us.
Sources
- Qualys: PHP patches two critical RCE vulnerabilities
- Tenable: php2shell FAQ
- Huntress: Rapid response to php2shell
- watchTowr: PHP2Shell intelligence
- JFrog Security Research: All you need to know
- Help Net Security: PHP2Shell patched
- Ubuntu: php2shell fixes available
- CISA: Critical vulnerabilities in PHP require immediate patching
