.svg){kind=small}
PHP2Shell is the name for two critical PHP runtime vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can allow unauthenticated remote code execution on servers running a vulnerable PHP version, according to the Cyber Security Agency of Singapore, the national cybersecurity agency, and NCSC-NL, the Dutch national cyber security centre. Any PHP install that serves web requests is in scope. That includes a fully updated WordPress, Drupal or Magento site if the PHP underneath is unpatched.
The fix is to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart every PHP worker. PHP 7.4, 8.0 and 8.1 can use a verified vendor package derived from the source backports while you plan an upgrade. PHP 7.3 and older, including PHP 5, must be upgraded or taken offline. The PHP project's GitHub advisories assign both CVEs a CVSS v4.0 score of 9.2.
Which PHP Versions Fix PHP2Shell?
Only four releases fix both flaws: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Any PHP process serving web requests on an earlier build should be treated as potentially exposed, however current the application on top of it is. The exception is a build whose package changelog or vendor advisory confirms backports for both CVEs.
Check Point, a cybersecurity vendor, warned that updating WordPress, Magento or Drupal alone does not fix a PHP-core vulnerability. Akamai, a content delivery and security company, explains why: PHP's session layer processes upload progress before application code runs.
Calif, the publisher of the underlying security research, released a write-up confirming unauthenticated RCE against 11 widely used PHP applications, including WordPress. KELA, a cyber threat intelligence company, reported the findings. Every one of those applications ran on the same PHP runtime, so the remediation unit is every web-serving PHP process.
Exposure varies by server API. For CVE-2026-109618, full RCE is confirmed on Apache mod_php, and PHP-FPM, FrankenPHP and LiteSpeed are susceptible by source analysis. CVE-2026-109619 RCE is confirmed on mod_php and PHP-FPM. PHP's advisory and CISA, the US cybersecurity agency, list PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed as in scope.
Support dates come from the Supported Versions page on php.net, the PHP project's official site. The same releases fix both CVEs. As of October 25, 2026, PHP 8.2.35 is a bridge release, because 8.2 security support ends December 31, 2026.
How Do You Check If You Are Affected?
Treat any process serving web requests on PHP below 8.2.35, 8.3.36, 8.4.27 or 8.5.12 as potentially exposed, unless a package changelog or vendor advisory confirms backports for both CVEs. The same applies to any 8.1 or older build without a verified vendor fix.
Run php -v for the CLI, then check the version inside the serving process. For PHP-FPM, run php-fpm -v inside the running container or on the host. For Apache mod_php, confirm the loaded module version and worker start times. On distribution packages, read the changelog for both CVE IDs, because the version string alone can mislead.
A fair objection comes from Davi Ottenheimer, a security analyst who writes as Flying Penguin. He argues that exploitation attempts and confirmed compromises are separate numbers, and that no confirmed compromise has been published. He is right about the distinction.
The decision stays the same. Proving a deployment is unexploitable takes longer than patching it, and full RCE is already confirmed on Apache mod_php. Patch first, then assess exploitability once the fixed binary is serving traffic.
Same-Day Remediation Steps
Knowing which version fixes PHP2Shell only helps if the fixed binary is the one answering requests. That is where most same-day plans break.
A patch is complete only when every long-lived worker has restarted and you have confirmed the version from the process that serves traffic. Upgraded packages leave old PHP-FPM and Apache workers running vulnerable code in memory.
Cycode, an application security company, recommends restarting Apache and every PHP-FPM pool, plus queue workers, RoadRunner, FrankenPHP, containers and pods. It also recommends rebuilding images with --pull --no-cache and pinning digests. Safe Security, a cyber risk management firm, gives the same advice: restart workers after patching, then validate the running runtime.
Here is the Kubernetes pattern, in order:
- On VMs, restart the PHP-FPM and Apache mod_php services, then check worker start times. Any worker older than your package upgrade is still running the old code.
- Picture the failure. The package manager reports success at 2 p.m.,
php -vprints 8.4.27, and the ticket closes. At 6 p.m. the same FPM workers that started last Tuesday are still answering requests. The CLI is the wrong witness. Ask the serving process. - Restarting every worker on the same day carries an availability cost for revenue-generating sites. Limit it with rolling restarts or a canary deployment. Treat a WAF rule as partial protection that runs alongside the restart: the flaw sits in PHP's memory handling, so attackers can vary request structure or reach an unprotected origin. Barracuda, an email and network security vendor, positions WAF enforcement as mitigation alongside patching.
- Do not run public exploit code to test your systems. JFrog, a software supply chain security company, warned that some circulating proofs of concept are fake and malicious.
What If You Cannot Patch Today?
Every interim measure here is partial. The PHP project's advisory for CVE-2026-109618 names one primary interim step, setting memory_limit=-1 at the server level, and says it is incomplete. That setting removes a safety limit, so pair it with request-size limits at the proxy and container memory limits. Avoid RLIMIT_AS and RLIMIT_DATA, because they trigger the vulnerable path. On PHP 8.5, also set fatal_error_backtraces=0.
Setting session.upload_progress.enabled=Off may narrow one reported attack path. Apply every ini value in php.ini or the FPM pool config, then restart workers. A per-app ini_set() call runs too late.
At the edge, cap multipart and request sizes at a reverse proxy or WAF, and block multipart requests entirely if the app accepts no uploads. On the host, run PHP as an unprivileged user and keep the webroot read-only.
The upload-progress setting shows why partial means partial. GMO Flatt Security, a Japanese security firm, initially suggested disabling it. The same day, it said the setting is incomplete as a fix and that bypasses are expected. The Hacker News, a cybersecurity news outlet, reports that PHP core developer Gina Peter Banyard said "the only mitigation is patching / upgrading PHP." Joe Ferguson, described by The Hacker News as release manager for the upcoming PHP 8.6, said, "ini settings won't save you."
CISA's guidance is blunter. Anyone who cannot update immediately, or who runs PHP 8.1 or earlier, should take PHP-based systems offline until patched. CISA says a WAF may give partial protection.
Treat each setting as a bridge of hours or days. Set a deadline for the real fix before you apply the first one.
What If You Run PHP 7.4, 8.0, 8.1 or Older?
Same-day steps assume a fixed release exists for your branch. For the large share of PHP running 8.1 or older, no such release exists.
Check Point reports that fixes shipped only for branches 8.2 to 8.5, and that PHP 8.1 and older need a distribution or vendor backport. PHP published minimal source backports for 7.4, 8.0 and 8.1 but no official release. PHP 7.3 and older, including PHP 5, have no fix at all: upgrade or take those systems offline.
Flare, a threat exposure management company, analyzed 2,220,231 internet-facing PHP service records across 224 countries. It found 72.7% (1,613,623) on branches outside upstream support. Only 27.3% (606,608) ran PHP 8.2 to 8.5. Within that dataset, 21.3% were PHP 7.4.3 or PHP 7.4.33, end-of-life versions that will not receive an upstream fix.
That leaves three options. A backport means installing a packaged fix from your Linux distribution or a commercial LTS vendor. An upgrade moves the application to a supported branch. Containment applies the interim measures from the previous section, which reduce exposure and leave the flaw in place.
Version strings can mislead on distribution builds. Flare could not determine the patch status of 18.8% (418,288) of its records because they used distribution-associated version strings. A package may report PHP 8.1.2 and still carry the fix. Read the package changelog for CVE-2026-109618 and CVE-2026-109619 before you trust or dismiss a version number.
Moving to 8.2.35 buys little. PHP 8.2 security support ends December 31, 2026, about two months away. PHP 8.4 runs to December 31, 2028, and PHP 8.5 to December 31, 2029. Pick one of those as your target.
The objection worth taking seriously: a legacy app on PHP 7.4 may need months of refactoring to run on 8.4, so a vendor backport plus containment looks like a rational long-term choice. For the next few weeks, it is. Backports from a distribution or commercial vendor are legitimate, and refactoring takes time. But a backport ties your security to a third party's schedule, and every future runtime flaw repeats that dependency. The 18.8% of records with undeterminable patch status shows how hard backport status is to verify.
Use the backport this month. Start the compatibility audit now: run your test suite against 8.4 and list every deprecated function and extension that breaks.
Signs You Were Already Hit
Preserve logs before you change anything. A restart or redeploy can erase the evidence you need.
Review web, PHP-FPM, Apache and proxy logs from before you patched. Datadog, a monitoring and security platform, points to two signals. One is a PHP error log entry reading "Allowed memory size ... exhausted" at "Unknown on line 0". The other is an Apache "AH00052 ... Segmentation fault" entry. Neither proves an attack, and a successful attack can leave no error at all. The strongest signal is a PHP worker launching a shell.
Also look for new cron entries, modified PHP files and unusual outbound connections. The flaws can expose worker memory, so rotate database passwords, API keys and tokens if you cannot rule out compromise.
The timeline sets the review window. Amazon, a cloud computing provider, saw an attempt on October 17. Details leaked on October 20. watchTowr, a security research firm, saw exploitation in its honeypots on October 21. CISA said the same day it had not observed successful exploitation, and PHP2Shell was not in its Known Exploited Vulnerabilities catalog as of October 22-23. Rapid7, a security vendor, found that public proof-of-concept code works only for specific OS, PHP and web server combinations. Start your log review no later than October 17.
WordPress, Drupal, Magento and Managed Hosting
Patch the PHP runtime, because the vulnerable processing happens before WordPress, Drupal, Magento or plug-in code runs. Application updates leave the flaw where it is.
On managed hosting, the provider controls the runtime. Ask it to confirm the fixed PHP version for each site in writing, along with confirmation that workers were restarted.
CVE-2026-115560: A Separate Issue
PHP published CVE-2026-115560 on October 23. It affects fully patched releases, including 8.5.12, but only under a non-standard session serializer configuration. As of October 25, 2026, no fix exists, and one is due in the next regular release.
If you run a custom session serializer, set session.upload_progress.enabled=0 and restart workers.
Legacy PHP Estates That Need Outside Help
Planning an upgrade off an unsupported branch is straightforward on paper and hard in an estate nobody has fully mapped. That is the point to decide whether to do it alone.
Outside help is justified under four conditions: PHP 8.1 or older with no official fix, many separate PHP apps, PHP embedded in vendor products, or no in-house PHP engineers. Inventory and upgrade work stall under those conditions.
The exposure data shows how common they are. Mallory, a threat intelligence company, counted about 2,618,284 PHP services through Shodan, a search engine for internet-connected devices, on October 21. Of those, 1,925,107 (73.5%) ran PHP 8.1 or older. Panorays, a third-party risk management company, reports that 97% of companies whose PHP version was identifiable ran a vulnerable version.
The objection deserves a direct answer. The same-day fix is a package update and a restart, so most teams can handle it internally. For teams on supported branches with a known inventory, that is correct: use the steps above and finish today. The case for help applies to the upgrade path off 7.4, 8.0 or 8.1, and to estates where nobody owns the PHP runtime.
Ask yourself whether any application runs PHP 8.1 or older with no vendor backport, and whether you run more PHP applications than you can list from memory. Ask whether a vendor product embeds its own PHP runtime you cannot patch directly, and whether your team includes engineers who have shipped a PHP version upgrade. One wrong answer means the inventory and upgrade work will likely stall, even if the patch is simple.
Think of the agency microsite nobody has touched in years, or the internal tool still on 7.4 because its author left. Those applications set your actual exposure.
An upgrade can run incrementally, with the live system in service throughout. We took ownership of a legacy PHP and React platform used by 3,000+ advisors daily at the Business Advisory Firm. We migrated it to AWS in stages and held 99.9% uptime, verifying each piece before moving to the next. The same method applies to a PHP runtime upgrade. Move one application at a time, test it against the target branch, and keep the old path available until the new one proves out.
If your estate matches those conditions, talk to us about patching and upgrading legacy PHP.
Your First Hour on PHP2Shell
Run php -v and php-fpm -v inside every process that serves web traffic. Log every result below 8.2.35, 8.3.36, 8.4.27 or 8.5.12 as an open incident, with an owner and a deadline, unless a changelog confirms both CVE backports.
Then put December 31, 2026 on the calendar. That is the day PHP 8.2 stops receiving security fixes. Plan for it now, or today's patch becomes next quarter's emergency.
.avif)
