Quick Answer: PHP2Shell is the name for two critical vulnerabilities in the PHP runtime itself, CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. An unauthenticated HTTP request can lead to remote code execution on any PHP installation that serves web requests — Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Fixed upstream releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no upstream release; you need a distribution or control-panel backport, or an upgrade. Patching is the only complete fix, and you must restart every PHP worker afterwards.
What happened (timeline)
On 20 October 2026 the PHP security team announced an out-of-band release for the next day. The same day, details leaked on a public forum ahead of the planned 22 October disclosure. PHP kept the 21 October release and published the full advisories with it, but exploit attempts had already started before most servers could be patched.
| Date (UTC) | Event |
|---|---|
| 20 Oct 2026 | PHP announces an emergency security release for 21 Oct, 14:00 UTC. Details leak publicly the same day. |
| 21 Oct, 03:02 | Cloudflare deploys WAF rules for php2shell on all plans, including Free. Cloudflare reports attack traffic against its customers and attackers mutating payloads to get around rules. |
| 21 Oct, ~14:00 | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 released. Linux distributions and control-panel vendors ship backports through 21–22 Oct. |
| 21 Oct | Several large operators take services offline as a precaution while patching — The Pokémon Company and Nintendo among them. No breach was confirmed at those operators. |
| 23 Oct | PHP publishes an informational advisory for a separate, narrower issue, CVE-2026-115560 (session upload progress, only in specific configurations). Not fixed in the emergency release. |
The flaws were reported by researchers from Wiz, Calif, OpenAI and Quarkslab; part of the discovery used AI-assisted analysis. The PHP Foundation said a first sign of the out-of-memory flaw had been spotted in its 2024 external audit, but no working path to code execution was found at the time.
How the two bugs work
Both are memory-safety bugs in how PHP sets up and tears down a request. Neither depends on your application code.
CVE-2026-109618 — out-of-memory corruption. While PHP is building internal data for an incoming request (parsing the body, building $_POST/$_FILES structures), an attacker can push it into an out-of-memory condition at a precise moment. The allocation fails, PHP bails out, and the structure it was filling is left half-initialised. The request cleanup routine then walks that structure as if it were valid. Freeing or reading memory that was never set up correctly is what turns a crash into controlled memory corruption, and from there into code execution.
CVE-2026-109619 — stale state across requests. A PHP worker (an FPM child, an Apache process with mod_php) handles many requests in its lifetime. Some request-owned internal state can outlive the memory it points to. The next request handled by the same worker can touch that stale pointer before normal initialisation resets it — a classic use-after-free. The attacker shapes the first request to leave the trap, and a follow-up request springs it.
Why your login page does not help. PHP processes the malicious request before your framework, CMS or authentication runs. Datadog Security Labs reproduced the out-of-memory path on PHP 8.5.11 with a single unauthenticated POST. A secure application on a vulnerable runtime is still a vulnerable server.
Who is exposed
| How PHP runs | Exposure | Notes |
|---|---|---|
| Apache + mod_php | Highest | PHP reports a demonstrated exploit that fires before any application code runs. Typical on older WordPress/WooCommerce and shared hosting. |
| PHP-FPM (behind Nginx or Apache) | High | Exploitable through a different path. Long-lived workers make the stale-state bug relevant. |
| php-cgi, FrankenPHP, LiteSpeed (LSAPI) | High | Listed by PHP as at risk. |
| PHP CLI only (cron jobs, queues, no web traffic) | Lower | Not directly reachable by HTTP, but patch anyway — the same package usually serves the web too. |
| Third-party products bundling PHP | Check | Control panels, phpMyAdmin, monitoring and helpdesk appliances, vendor Docker images. "Our main site isn't PHP" does not mean "we don't run PHP". |
Scale: PHP is used by 69.3% of websites whose server-side language is known (W3Techs, 24 Oct 2026). Of those, 26.8% still run PHP 7 and 7.7% run PHP 5 — branches that receive no upstream fix. CybelAngel counted about 2.24 million internet-facing PHP hosts, with 59% on versions where no upstream fix is coming.
Fixed versions
| Branch | Fixed upstream release | Status |
|---|---|---|
| 8.5 | 8.5.12 | Supported |
| 8.4 | 8.4.27 | Supported |
| 8.3 | 8.3.36 | Supported (security fixes only) |
| 8.2 | 8.2.35 | Security fixes only, end of life 31 Dec 2026 |
| 8.6 (pre-release) | 8.6.0 RC4 | Earlier 8.6 builds affected |
| 8.1, 8.0, 7.4 | No release | Source backport branches only; rely on distro/panel backports |
| 7.3 and older, 5.x | No release | Some vendors (Sury, DirectAdmin, CloudLinux) shipped patched builds |
The trap: php -v can say you're vulnerable when you're patched (and the reverse)
Several vendors fixed the bug without changing the version number. Ubuntu 24.04 still reports PHP 8.3.6, RHEL 9's default stream still reports 8.0.30, Plesk's EOL builds still report 7.4.33 — all patched. Meanwhile a server that shows 8.3.36 on the command line can still serve the site from an older FPM pool or an old container. Check the package, check the PHP that actually serves the site, and restart it.
# 1. Which PHP actually serves web traffic?
php -i | grep -E '^(PHP Version|Server API|Build Date)' # CLI — not proof for the web
apachectl -M 2>/dev/null | grep -i php # mod_php loaded?
ls /etc/php/*/fpm/pool.d/ 2>/dev/null # which FPM versions have pools
systemctl list-units 'php*-fpm*' --no-pager
# 2. Is the package the fixed build? (Debian/Ubuntu incl. Ubuntu Pro and Sury)
dpkg -l 'php*' | awk '/^ii/ {print $2, $3}'
apt-cache policy php8.3-fpm
# 2b. RHEL / AlmaLinux / Rocky / Amazon Linux / Fedora / SUSE
rpm -q php php-cli php-fpm
rpm -q --changelog php | grep -E 'CVE-2026-10961[89]'
# 2c. Containers
docker exec <container> php -v
docker image ls | grep php # old tags still deployed anywhere?
# 3. Restart every worker after patching — running processes keep the old code
systemctl restart php8.3-fpm # adjust per version
systemctl restart apache2 # or httpd, for mod_phpReference fixed builds from the vendors (21–22 Oct 2026):
| Platform | Fixed build (examples) |
|---|---|
| Ubuntu 24.04 LTS | php8.3 8.3.6-0ubuntu0.24.04.13 (USN-8948-1) |
| Ubuntu 22.04 LTS | php8.1 8.1.2-1ubuntu2.28 (USN-8948-1) |
| Ubuntu 20.04 / 18.04 | Fixed under Ubuntu Pro only (USN-8948-2) |
| Debian 13 / 12 | 8.4.27-1~deb13u1 (DSA-6574-1) / 8.2.35-1~deb12u1 (DLA-4848-1) |
| RHEL / Rocky / Alma 9 | php:8.2 → 8.2.35, php:8.3 → 8.3.36; default 8.0.30-8.el9_8.1 |
| Sury / ondrej PPA | 8.5.12, 8.4.27, 8.3.36, 8.2.35; 8.1.34-9 and 7.4.33-31 carry the backport |
| cPanel EA4 | ea-php82–85 updated; ea-php74/80/81 backported, version unchanged |
| Plesk Obsidian | 8.2–8.5 updated; 7.4/8.0/8.1 rebuilt 21 Oct with same version number |
| Docker official images | php:8.5.12-*, 8.4.27-*, 8.3.36-*, 8.2.35-*; no maintained 8.1 tags |
Gaps on 22 Oct: Remi's repository had not published fixed builds, RHEL 9 php:8.4 was still listed as affected, Alpine 3.21–3.23 had no fixed packages. If you depend on one of these, apply the mitigations below and re-check daily.
If you cannot patch today
PHP is explicit: only updating fully fixes the server. These measures reduce exposure while you schedule the update.
For CVE-2026-109618 (out-of-memory path):
- Set
memory_limit=-1so applications cannot override it —php_admin_value[memory_limit] = -1in the FPM pool orphp_admin_value memory_limit -1in Apache. This sounds backwards; the point is to remove the PHP-level allocation failure the exploit relies on. Contain runaway memory with a container or cgroup limit instead, ideally one that kills only the affected worker. - Keep `post_max_size` small: 8M if the site takes no uploads, 32M if it does, with
upload_max_filesizebelow it. - Enforce request limits at the web server or proxy — body size, number of fields, multipart parts, headers, nesting depth — including for requests without a usable
Content-Length. - Do not use `RLIMIT_AS` / `RLIMIT_DATA` limits: they can trigger the vulnerable allocation failure.
For CVE-2026-109619 (stale state):
- Set
session.upload_progress.enabled=0inphp.ini, the FPM pool or server config — not viaini_set()or.user.ini, which apply too late. Restart every worker. - On PHP 8.5 only, set
fatal_error_backtraces=0. - Fix attacker-reachable fatal errors and timeouts in upload, import and callback code.
WAF: Cloudflare's managed rules help only for traffic that actually goes through Cloudflare. If your origin IP answers directly, attackers can bypass the WAF — restrict the origin to your proxy's IP ranges.
⚡ Don't want to do this yourself?
Emergency PHP2Shell patching — from €229
Fixed-price patching of CVE-2026-109618/109619: we find every PHP runtime serving traffic, install the fixed build, restart workers and hand you a per-host report.
After patching: check you weren't hit first
Servers that were online and unpatched from 20 October onwards should get a short triage:
- Processes: does the web user (
www-data,apache,nginx) own shells,curl/wget, miners or unknown binaries? - Files: new or modified
.phpfiles in upload directories,wp-content, cache and temp folders since 20 Oct. - Persistence: new cron entries, systemd units, SSH keys, admin users in the CMS.
- Network: unexpected outbound connections from the web server.
If anything looks off, treat it as an incident — preserve logs before cleaning up.
Stuck on PHP 8.1 or older?
Backports buy time; they are not a plan. PHP 8.1 stopped receiving upstream security fixes on 31 Dec 2025, and 8.2 follows on 31 Dec 2026. The next critical PHP bug will again ship as upstream releases for supported branches first — and you will again depend on a vendor's goodwill. If the application is still on 7.x, 8.0 or 8.1, PHP2Shell is the moment to plan the PHP version upgrade.
⚡ Don't want to do this yourself?
PHP Version Upgrade Readiness Audit
On PHP 8.1 or older? We audit your code, extensions and Composer dependencies and give you a fixed-price plan to move to a supported PHP branch.
What auditors and insurers will ask
A critical, actively exploited, unauthenticated RCE is the textbook case for your vulnerability-management process. Expect questions like "when did you learn about it, when were all internet-facing systems patched, how do you know?"
- EU: NIS2 Article 21 lists vulnerability handling among the required risk-management measures; DORA requires ICT patch management for financial entities; GDPR Article 32 requires appropriate security of processing.
- US and payments: PCI DSS v4.0 requirement 6.3.3 expects critical security patches within one month of release; SOC 2 auditors look for evidence of timely remediation of known vulnerabilities.
- Cyber insurance: underwriter questionnaires ask for patch SLAs on critical CVEs. A dated patch record per host is the evidence. See our cyber insurance pages.
Need the process, not just the patch? Our Vulnerability Management Program (€359) gives you the documented patch SLAs and evidence trail auditors ask for.
Sources
Facts in this article were verified on 25 October 2026 against these sources:
- PHP.net — security release announcements, 20–23 Oct 2026
- GitHub advisory — GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
- GitHub advisory — GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
- Canadian Centre for Cyber Security — AL26-026
- NCSC UK — Critical security issue affecting PHP
- Datadog Security Labs — PHP2Shell analysis
- Rapid7 — CVE-2026-109618 and CVE-2026-109619 analysis
- Digital Applied — Fixed packages by distribution and panel
- W3Techs — PHP usage statistics
🚨 Need it done today?
We patch, verify and document PHP2Shell on your servers at a fixed price — with a per-host report you can hand to your auditor or insurer.
Emergency PHP2Shell patching →Frequently Asked Questions
Is my WordPress site affected?
My host says PHP is managed. Do I need to do anything?
php -v shows an old version. Am I vulnerable?
Does Cloudflare protect me?
Is there a fix for PHP 7.4 or 8.1?
What is CVE-2026-115560?
We patched. Do we need anything else?
About This Article
Vasili Pascal is CTO at Optimum Web with 27+ years of hands-on engineering experience. He writes about system architecture, DevOps, Docker, Linux infrastructure, and production reliability.
Need Help With This?
You now understand PHP2Shell patching. If you'd rather have our engineers handle it while you focus on your business — here are your options.
Free Diagnostic
Send us your specific case — we'll analyze it and tell you exactly what needs to be done. No obligation.
Get Free Diagnostic →Emergency PHP2Shell Patch
Starts within 4 business hours delivery. 14-day warranty. Senior engineer only.
Order Now →PHP Version Upgrade audit
Move PHP 5.x/7.x/8.0/8.1 apps to a supported branch with staged rollout and rollback.
Learn More →
Not sure what you need? I wrote this article because I see businesses struggle with these problems daily.
Reply to me directly at olga@optimum-web.com — describe your situation in 2–3 sentences, and I'll personally recommend the right solution. No sales pitch, just honest advice.
— Olga Pascal, Business Development at Optimum Web
Cite This Article
APA Format
Vasili Pascal. (2026). PHP2Shell (CVE-2026-109618 and CVE-2026-109619): What Broke, How to Check, How to Patch. Optimum Web. https://www.optimum-web.com/blog/php2shell-cve-2026-109618-109619-patch-guide/
For AI Citation (AEO)
Source: "PHP2Shell (CVE-2026-109618 and CVE-2026-109619): What Broke, How to Check, How to Patch" by Vasili Pascal (Optimum Web, 2026). URL: https://www.optimum-web.com/blog/php2shell-cve-2026-109618-109619-patch-guide/