PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Affected Versions, Fixes, and What to Do Now

PHP2Shell is the name used for two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. They can allow remote code execution on a vulnerable server without requiring an attacker to log in.

The PHP project released fixes on October 21, 2026. If your website uses PHP, check the version and apply the relevant update as soon as possible. Updating WordPress, Laravel, themes, or plugins alone does not fix a vulnerability in the PHP engine itself.

This guide explains what PHP2Shell is, which versions are affected, how to check your server, and what to do after patching.

PHP2Shell at a glance

• Vulnerabilities: CVE-2026-109618 and CVE-2026-109619
• Severity: Both are rated 9.2 on the CVSS 4.0 scale.
• Impact: Remote code execution on vulnerable systems.
• Fixed PHP releases: 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
• Main action: Update PHP or install a security-patched package from your hosting provider or operating-system vendor.

What Is PHP2Shell?

PHP2Shell refers to two vulnerabilities in the PHP engine. One involves memory corruption when PHP runs out of memory. The other involves the use of internal data after the memory has been freed. Under the affected conditions, an attacker may be able to use these flaws to execute code on a vulnerable server.

The vulnerabilities affect PHP itself, rather than a specific WordPress plugin, Laravel package, or website theme. This means an application can be properly maintained and still be exposed if its underlying PHP runtime has not been patched.

The PHP project released fixed versions on October 21, 2026, after details of the vulnerabilities became public ahead of the planned disclosure. Security reports described exploitation attempts around the time the fixes were released. That does not mean every vulnerable server has been compromised, but it does mean administrators should treat unpatched systems as a priority.

Which PHP Versions Are Affected?

The PHP project lists these fixed releases:

If you use PHP 8.1 or an older branch, do not assume there is no possible fix simply because the PHP project does not provide a new regular release for that branch. Some operating-system distributions, hosting providers, and commercial vendors may provide backported security patches. Check your vendor’s advisory and package changelog to confirm whether the relevant fixes have been applied.

Older PHP branches may also be out of support, so planning an upgrade to a supported version is the safer long-term approach.

Not sure which PHP version your website uses? Check your hosting panel or ask your hosting provider. If you manage multiple websites, check production, staging, and container-based environments too.

Why Is PHP2Shell Serious?

PHP2Shell deserves prompt attention for three main reasons.

1. It affects the PHP runtime. Updating an application or one of its plugins does not replace the vulnerable PHP engine.

2. It may be exploitable remotely. An attacker may be able to send requests to an exposed vulnerable service without first signing in.

3. A successful attack can affect the server. Code running with the web server’s permissions may be able to access application files, configuration details, or credentials available to that account. The actual impact depends on the server’s permissions and configuration.

Patching reduces the risk from these vulnerabilities. However, if an attacker gained access before the fix was installed, updating PHP alone may not remove malicious files or undo other changes.

How to Check Whether Your Server Is Affected

Start by checking the PHP version from the command line:

php -v

However, the command-line PHP version may be different from the version used by your website. Check the PHP version selected in your hosting control panel, the PHP-FPM service used by the site, or the PHP runtime inside the relevant container.

Avoid leaving a public phpinfo() page on a production website. If you use one temporarily to verify the runtime, restrict access to it and remove it immediately afterward because it can expose configuration details.

If PHP came from your Linux distribution

Linux distributions sometimes backport security fixes without changing the upstream version number. As a result, an apparently older version may include a vendor security patch.

Check your distribution’s security advisory and package changelog for CVE-2026-109618 and CVE-2026-109619. For example, on a Debian- or Ubuntu-based system, you may be able to inspect a package changelog with a command like this:

apt changelog php8.3

Replace php8.3 with the package name used by your system. Package names and commands can vary by distribution and repository. If you are unsure, ask your system administrator or hosting provider to confirm the patch status.

Also check staging servers, Docker images, scheduled jobs, and any other services that run PHP. Updating one server does not automatically patch every environment.

How to Fix PHP2Shell

The correct fix depends on how PHP is installed and managed. Use the steps below as a general checklist, and follow the instructions from your hosting provider or operating-system vendor.

1. Install a fixed PHP release or vendor patch

For the supported branches listed by the PHP project, install the appropriate fixed release:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

If your system uses distribution-provided packages, install the security update from the official repository and verify that the vendor confirms the relevant CVEs are fixed.

If you use shared or managed hosting, check the provider’s security notice or contact support. If you manage PHP through a hosting control panel, use its supported update process.

If PHP runs in Docker, update the image to a patched base image and rebuild and redeploy the affected containers. Updating the host operating system does not automatically update PHP inside a container.

If PHP was compiled from source, obtain the fixed source release from the official PHP project and rebuild it using your normal deployment process.

2. Restart the services that run PHP

After updating, restart the relevant PHP runtime or web service according to your environment. This may include PHP-FPM, Apache when using mod_php, or another service that loads PHP.

Use your provider’s or administrator’s normal restart procedure. The goal is to make sure the running service is using the patched runtime, not an older process that remained active.

3. Confirm the patch is active

Check the runtime used by the website again. If your distribution backports fixes, verify the package changelog or vendor security advisory rather than relying only on the version number.

For containerized deployments, confirm that the running containers were recreated from the updated image. Do not assume that pulling a new image updates containers that are already running.

4. Test the website

After the update, check key pages and application workflows. Review error logs and confirm that the site, integrations, scheduled jobs, and background workers are functioning normally.

Keep your application and dependencies updated too. They are separate from the PHP runtime, but they remain an important part of overall security.

What if you cannot patch immediately?

Treat any temporary mitigation as a short-term measure, not a replacement for applying the vendor’s fix. Consult the official PHP security advisory and your hosting or operating-system vendor for instructions that match your environment. Avoid copying unverified commands or configuration changes from unofficial posts.

Need help with a PHP upgrade? Zehntech’s web development team can help assess an application and plan a PHP upgrade. You can also contact Zehntech to discuss your requirements.

What If You Run PHP 8.1 or Older?

PHP 8.1 and older branches are outside the PHP project’s normal supported release cycle. However, the absence of a new upstream release does not prove that no security patch exists: some vendors may backport fixes to the packages they maintain.

If you use an older branch:

1. Check your vendor’s advisory. Confirm whether your exact operating-system or hosting package includes fixes for both CVEs.
2. Ask your hosting provider. If the provider manages PHP for you, request confirmation of the patch status and its recommended next step.
3. Plan an upgrade. Move to a supported PHP branch after testing compatibility with your application, themes, plugins, and libraries.

Test the upgrade in a staging environment first. Take a verified backup, check application compatibility, and prepare a rollback plan before changing production.

A Related PHP Security Notice: CVE-2026-115560

A separate PHP security notice dated October 23, 2026, covers CVE-2026-115560. It concerns an unusual configuration scenario involving an application changing the session serialization handler at runtime.

The PHP notice recommends setting session.upload_progress.enabled=0 for the affected scenario until the relevant regular bug-fix release is available. Do not apply this setting blindly to every PHP installation: first read the official PHP release and security notices and ask your developer or administrator to confirm whether the described configuration applies to your application.

This is a separate issue from CVE-2026-109618 and CVE-2026-109619, so verify and handle it separately.

After Patching: Check for Signs of Compromise

Patching addresses the vulnerabilities, but it cannot guarantee that a server was not accessed before the fix. If your server was exposed while unpatched, review it for signs of suspicious activity.

Ask your administrator or security team to review:

• Web server and PHP logs for unusual requests or unexpected activity.
• Recently created or modified PHP files, especially in upload directories or other locations where executable code should not normally appear.
• Unexpected processes, scheduled tasks, user accounts, or changes to application files.
• Unexplained outbound network connections.
• Potential exposure of database passwords, API keys, and other secrets.

These indicators do not automatically prove that PHP2Shell was used. Investigate unusual findings in context. If you suspect a compromise, involve your security team, contain the affected system, rotate exposed credentials, and restore from a known-clean backup if needed. Preserve relevant logs and evidence during the investigation.

Frequently Asked Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical PHP vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Under affected conditions, they may allow remote code execution on a vulnerable server.

Which PHP versions contain the fixes?

The PHP project released fixed versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026. If you use a distribution or managed host, check whether its package contains a backported fix.

Does updating WordPress or Laravel fix PHP2Shell?

No. Updating WordPress, Laravel, themes, plugins, or packages does not itself patch the PHP runtime. You must update PHP or install the relevant vendor security patch.

Is PHP2Shell being exploited?

Security reports described exploitation attempts around the time the fixes were released. This does not establish that every vulnerable server has been compromised. Unpatched exposed systems should nevertheless be treated as a priority.

Why does php -v still show an older version after an update?

Some operating-system vendors backport security patches without changing the upstream version number. Check the vendor’s advisory or package changelog for both CVE identifiers.

Do I need to restart PHP after updating?

Usually, the relevant PHP runtime or web service must be restarted or redeployed so the patched runtime is active. Follow the procedure for your specific hosting setup.

Is updating PHP enough if my server was already exposed?

Not necessarily. Patching fixes the vulnerable software, but it does not remove a backdoor or reverse changes an attacker may have made. Review logs and files, and investigate suspicious activity.

Conclusion

PHP2Shell is a serious reminder to keep the PHP runtime up to date, not just the application built on top of it. Check every environment where your websites run PHP, install the appropriate fixed release or vendor patch, restart or redeploy the relevant services, and confirm that the update is active.

If a server was exposed before patching, review it for signs of compromise as well. For older PHP installations, confirm the vendor’s patch status and plan a tested upgrade to a supported branch.

Need help checking your PHP setup? Contact Zehntech to discuss PHP maintenance and upgrade support.