PHP2Shell is the name for two critical bugs in PHP itself that let an attacker run code on a web server without logging in. The fix is a PHP update, not a WordPress, theme or plugin update: you need PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released on 21 October, or a patched package from your Linux distribution or host. Attacks are already happening, so if you run a PHP site, check your version today.
On shared or managed hosting, the host usually controls PHP updates, so ask it whether your site’s PHP build is patched. If you manage your own VPS or Docker image, check and update it yourself. PHP 7.x has no official fix.
What PHP2Shell is
The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated 9.2 out of 10 on CVSS v4. They sit in PHP’s memory management and error handling, code that runs on nearly every request.
- CVE-2026-109618, RCE via OOM corruption: if a request hits PHP’s memory limit at exactly the wrong moment, PHP leaves half-built internal data behind and later treats it as valid. Crafted multipart uploads can trigger this while staying inside normal upload limits.
- CVE-2026-109619, RCE via stale global state: a fatal error at the wrong point can leave internal state pointing at memory from a previous request. The next request handled by the same worker can then use that freed memory.
PHP’s own advisory says every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest on Apache with mod_php, where an unauthenticated request can trigger the out-of-memory bug before any application code runs, and full code execution was shown with default settings. Code execution has also been confirmed on PHP-FPM through application code paths. Wiz, one of the research teams involved, says every PHP version back to 5.4 is affected by at least one of the bugs, and that it demonstrated pre-login code execution on WordPress, Drupal and Joomla.
Is PHP2Shell being exploited?
Yes. Amazon’s threat intelligence team says PHP2Shell “is now being broadly exploited in the wild”. It also found an exploit attempt against its honeypots dated 17 October, four days before the public release, from an anonymised IP address.
The disclosure did not go to plan. According to the PHP Foundation, the two CVE numbers leaked on 20 October around 8:30 PM IST with a wrong CVSS score of 10.0. PHP pulled the release forward by a day to 21 October, 7:30 PM IST. On the night of the leak, one of the reporting firms, Calif, mistakenly published a video of its exploit, and copies spread. Chainguard also shipped fixed container images more than six hours before the coordinated release, which let anyone study the patch early. Public proof-of-concept exploits followed within hours.
Which PHP versions fix PHP2Shell
| PHP branch | Vulnerable versions | Fixed version | Security support until |
|---|---|---|---|
| PHP 8.5 | 8.5.0 to 8.5.11 | 8.5.12 | 31 Dec 2029 |
| PHP 8.4 | 8.4.0 to 8.4.26 | 8.4.27 | 31 Dec 2028 |
| PHP 8.3 | 8.3.0 to 8.3.35 | 8.3.36 | 31 Dec 2027 |
| PHP 8.2 | 8.2.0 to 8.2.34 | 8.2.35 | 31 Dec 2026 |
| PHP 8.1 and older | All | No official release | Already end of life |
For PHP 7.4, 8.0 and 8.1, the PHP security team published minimal source patches for people who build PHP themselves, and some Linux distributions and paid long-term support vendors ship backported fixes. Everyone else on those versions should move to a supported branch. PHP 8.2 itself stops getting security fixes at the end of this year, so PHP 8.3 or newer is the sensible target if you are upgrading anyway.
How to check your PHP version
On WordPress: go to Tools > Site Health > Info and open the Server section. The PHP version listed there is the one your site actually runs. Most hosting panels, including cPanel, show it too.
On a server you manage: run these over SSH.
# PHP version on the command line
php -v
# Is Apache running PHP as mod_php? (Debian and Ubuntu)
apache2ctl -M 2>/dev/null | grep -i php
# Which PHP-FPM services are running?
systemctl list-units --type=service 'php*'The command-line PHP and the PHP serving your site can be different versions, so trust Site Health or your FPM service name over php -v. Distribution packages also often keep an older version number with the fix backported. On Ubuntu or Debian, apt changelog php8.3-cli (change the version to match yours) shows whether the latest package mentions CVE-2026-109618 and CVE-2026-109619.
How to update PHP
Shared hosting or managed WordPress: check your host’s status page or email, or ask support directly whether PHP has been patched for CVE-2026-109618 and CVE-2026-109619. Hostinger, for example, says its managed plans are patched and filtered at the firewall, but VPS customers have to update PHP themselves. If your host lets you pick a PHP version, choose 8.3 or newer after checking that your theme and plugins support it.
Ubuntu or Debian VPS:
sudo apt update && sudo apt upgrade
# Restart every PHP worker (change 8.3 to your version)
sudo systemctl restart php8.3-fpm
# If you use Apache with mod_php
sudo systemctl restart apache2RHEL, AlmaLinux, Rocky Linux or Fedora:
sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm httpdIf you use the volunteer-run Remi repository, note that PHP’s advisory said it would not have updates on release day and urged users to switch to distribution packages or build from source.
Docker: pull the newest official PHP image for your branch, confirm php -v inside it reports a fixed version, then rebuild and redeploy. A running container does not update itself.
Windows: download the fixed build from the PHP downloads page and restart IIS or your web server.
Whichever route you take, restart every PHP worker afterwards. Old FPM or Apache workers keep running the vulnerable code until they are replaced.
If you cannot update today
PHP is clear that only an update fully fixes this. The settings below, from PHP’s advisory, narrow the known attack paths while you get a patch in place:
; php.ini or the PHP-FPM pool config, not ini_set() or .user.ini
session.upload_progress.enabled = 0
; use 32M instead if the site needs file uploads
post_max_size = 8M
; PHP 8.5 only
fatal_error_backtraces = 0Update from PHP on 23 October: Keep session.upload_progress.enabled=0 even after installing the fixed builds until the next regular bugfix release, unless you have confirmed that your application never changes session.serialize_handler at runtime. PHP says a separate code-execution path remains possible only with an unusual combination of settings and application code. The PHP2Shell patches are still essential.
- Restart every worker after changing these.
- If the site never takes uploads or form posts with files, block multipart requests at your web server or proxy.
- Put the site behind a web application firewall. Cloudflare says its php2shell rules have been on by default for all WAF customers, including the free plan, since 21 October, 8:32 AM IST. Paid plans should confirm the Managed Ruleset is in block mode.
- For PHP’s out-of-memory bug, the advisory also lists
memory_limit=-1set at the server level. That removes PHP’s own memory cap, so only use it with a container or cgroup limit as a backstop.
WordPress.org’s advice for sites on PHP older than 8.2 on self-managed hosting is blunt: consider taking the server offline until you can upgrade.
Check whether your site was hit
Because exploitation predates the release, Amazon recommends investigating from 17 October onwards, not from the day you patched. On a server you manage, a quick first look:
# PHP files created or changed since 17 October (plugin updates will show up too)
sudo find /var/www -name "*.php" -newermt "2026-10-17" -lsAlso look for unknown processes running as the web server user, new admin accounts in WordPress, and, if your firewall or proxy logs request bodies, POST requests containing PHP_SESSION_UPLOAD_PROGRESS, a marker Amazon flags. If anything looks wrong, isolate the affected server and preserve logs before rebuilding from a clean backup. Then change the database password, the WordPress salts in wp-config.php and any API keys stored on the server. Our guide to protecting your API keys after a breach covers rotating keys properly.
What PHP2Shell means for Indian sites
CERT-In issued advisory CIVN-2026-0510 on 21 October, warning of a “high risk of remote code execution and complete system compromise” and advising organisations to patch or isolate affected systems. The practical problem in India is ownership. A lot of small business, school and shop websites were built by an agency or a freelancer and sit on shared hosting that nobody actively watches. If that describes your site, message your developer or host today and ask for the PHP version in writing.
The same applies to software you might not think of as PHP. Self-hosted apps such as Nextcloud and phpMyAdmin, and some NAS and appliance admin panels, run on PHP, so anything you have set up on a home server or NAS needs its updates too, especially if it is reachable from the internet. The Netherlands’ NCSC keeps a list of third-party products affected by PHP2Shell, which ENISA recommends checking.
My take
This is a serious PHP security event, and the timeline deserves attention. The PHP Foundation admits the out-of-memory problem was first spotted in 2024 and the fix stalled for months, calling the delay “a structural failure”. It took AI-assisted research from Calif, OpenAI and Wiz to show how exploitable it was, and attackers began exploiting the bugs before public disclosure, according to Amazon’s threat intelligence team.
For site owners, the lesson is that “my WordPress is up to date” is not the same as “my server is up to date”. Find out who updates your PHP, and treat a critical PHP release the way you would treat a critical Chrome update.
FAQ
Will updating WordPress or my plugins fix PHP2Shell?
No. The bugs are in PHP, the language runtime underneath WordPress, and WordPress.org says no WordPress update is required or planned. Only a patched PHP build fixes it.
Is my phone or laptop at risk?
Not directly. PHP2Shell affects servers that run PHP to serve websites. The risk for ordinary users is a compromised website stealing data you enter on it.
Am I safe if my site is behind Cloudflare?
Safer, not safe. Cloudflare’s WAF rules block known exploit patterns, but attackers keep changing their requests. Cloudflare itself tells customers to patch PHP as well.
Is PHP 7.4 still safe to run?
No. PHP 7.4 has been end of life for years and gets no official PHP2Shell release. Upgrade to PHP 8.3 or newer, or use a vendor that ships backported fixes.
- SourceWiz Research: PHP2Shell
