PHP2Shell (CVE-2026-109618/109619): What Happened & What to Do

What happened

On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The releases fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell." Both can let an attacker run code on a server without logging in. The PHP project rated both flaws CVSS v4.0 9.2 and says updating is the only complete fix.

The timeline moved fast:

• October 17: According to SecurityWeek, Amazon saw the first exploitation attempt against a honeypot, while the flaws were still secret.
• October 20: The PHP security team announced an upcoming critical release. SecurityWeek reported that details leaked online the same day.
• October 21: The fixed releases and the official security advisory were published on php.net.
• October 22: SecurityWeek reported that PHP2Shell "is now being broadly exploited in the wild." Cloudflare said attempts reached the millions after the release.

The first flaw involves how PHP handles out-of-memory errors partway through a request. The second involves internal data that stays in memory after it's freed and can be reused by a later request. Either way, the attacker's code runs with the web server's permissions.

Why it matters

The bug is in PHP itself, not in a plugin or framework. The advisory says every PHP installation serving web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers mod_php the highest risk.

That means WordPress, Joomla, Drupal, Laravel, Magento and custom PHP sites are all in scope. Updating your CMS won't fix it.

The scale is large. Censys counted roughly 1.57 million internet-facing hosts with an identifiable, unpatched PHP version. VulnCheck said at least 1 million hosts run end-of-life PHP. PHP 8.1 and older get no upstream fix.

Two more warnings:

• Some "exploits" are fake. watchTowr found that the public proof-of-concept code it reviewed didn't work or crashed targets. JFrog found fake PoCs and malware on GitHub. Don't run random checker scripts from GitHub.
• A WAF is only a stopgap. Cloudflare deployed rules against known exploit methods but called them temporary. The UK NCSC told organizations to update PHP immediately or take systems offline until they can.

Who should act now

• Website owners on WordPress, Laravel or any other PHP stack: update PHP, restart PHP workers, and confirm the version your web server actually runs.
• Shared and managed hosting customers: ask your host to confirm in writing that the October 21 fixes are deployed.
• Enterprises: find every PHP system, including legacy apps, containers and vendor appliances. Fix internet-facing systems first, and check for signs of compromise back to October 17.
• Anyone on PHP 8.1 or older: plan an upgrade now. There's no upstream release for your branch.

Get the full patch guide and check your site

Check your site and read the full PHP2Shell patch guide →

Our free PHP2Shell checker makes one normal request to your homepage. It shows whether your site exposes a PHP version and whether that version is patched. It sends no exploit code. The same page has the complete guide:

• Commands to check your PHP version
• Update steps for Debian, RHEL and Docker
• The official stopgaps from the PHP advisory
• An 8-step response plan for enterprises
• Signs of compromise to look for
• A 10-question FAQ

For a broader look at your site, run the free vulnerability scanner or an automated pentest.

Sources

• PHP project, security advisory and release notes, October 21, 2026: https://www.php.net/
• BleepingComputer, "PHP ships emergency patches for critical PHP2Shell flaws," October 21, 2026: https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/
• SecurityWeek, "PHP2Shell Exploitation Started Days Before Patches," October 22, 2026: https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/