PHP2Shell is the name given to two critical, unauthenticated remote-code-execution (RCE) vulnerabilities in PHP’s core — CVE-2026-109618 and CVE-2026-109619 — both rated 9.2 on the CVSS v4.0 scale. They were patched on 21 October 2026, and because exploit code is already circulating, every team running PHP needs to update immediately. This guide explains what PHP2Shell is, who is affected, how to check your exposure, and exactly how to patch — with links to every official source.
TL;DR — what you need to know about PHP2Shell
- What: Two PHP core flaws, collectively branded PHP2Shell (“two [bugs] to shell”): CVE-2026-109618 (memory corruption from an out-of-memory condition) and CVE-2026-109619 (stale global state).
- Impact: Unauthenticated remote code execution — an attacker can run commands on your web server without logging in. CVSS v4.0 9.2 (Critical).
- Fixed in: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (released 21 Oct 2026).
- No safe config-only fix: interim mitigations close some attack paths but not all. Updating is the only complete remedy.
- Act now: proof-of-concept code is public and honeypots recorded probing before disclosure.
What is PHP2Shell?
PHP2Shell is a pair of vulnerabilities in the PHP interpreter itself — not in a plugin, framework or application. Because PHP powers an estimated three-quarters of the web (WordPress, Laravel, Magento, Drupal, custom apps and more), a flaw at this layer has an enormous blast radius. The two CVEs were disclosed together and share a single patch release, which is why the security community gave them one memorable name.
CVE-2026-109618 — out-of-memory memory corruption
This flaw lets an attacker trigger a memory-corruption condition by forcing PHP into an out-of-memory (OOM) state. Corrupting memory in a controlled way is a classic path to hijacking program execution — and ultimately to running arbitrary code.
CVE-2026-109619 — stale global state
This flaw involves PHP reusing “stale” global state between requests or operations, which an attacker can manipulate to influence execution in a way the developers never intended. Chained with the right request, it also leads to code execution.
Both carry a CVSS v4.0 base score of 9.2, reflecting that they require no authentication, can be triggered over the network, and result in full code execution.
How serious is PHP2Shell? (CVSS 9.2, unauthenticated RCE)
“Unauthenticated RCE” is the most dangerous class of web vulnerability. It means an attacker needs no password, no user account and no social engineering — just network access to a vulnerable PHP server. Successful exploitation typically leads to web-shell installation, data theft, ransomware staging, cryptomining, or using the server as a pivot deeper into your network. The PHP project itself states that updating is the only safe course of action.
Which PHP versions are affected — and which are fixed?
The vulnerable code reaches back across many PHP releases. Here is the state of play as of the 21 October 2026 security release:
| PHP branch | Status | Action |
|---|---|---|
| PHP 8.5 | Fixed in 8.5.12 | Update to 8.5.12+ |
| PHP 8.4 | Fixed in 8.4.27 | Update to 8.4.27+ |
| PHP 8.3 | Fixed in 8.3.36 | Update to 8.3.36+ |
| PHP 8.2 | Fixed in 8.2.35 | Update to 8.2.35+ |
| PHP 8.1, 8.0, 7.4 | End-of-life — no standard release | Upgrade to a supported branch (or apply your distro.’s backport, if any) |
| PHP 7.3 and older | No fix | Upgrade urgently — these are unsupported and unsafe |
PHP published only minimal source backports for some end-of-life branches; there is no official binary release for 8.1 and earlier. If you are on an EOL branch, the real fix is to move to a supported, patched version — your operating-system vendor or hosting provider may also ship a patched package.
Is PHP2Shell being exploited in the wild?
Reporting is mixed, which is normal in the first days after a major disclosure:
- Pre-disclosure probing: Amazon reported attempts against its honeypots as early as 17 October 2026 — four days before the patch — and details of the flaws reportedly leaked a day before the fix shipped.
- Public PoC: proof-of-concept exploit code is circulating, which dramatically lowers the barrier to mass exploitation.
- Confirmed compromise: some vendors (e.g. watchTowr) report exploitation activity, while others (CISA, Huntress, Germany’s BSI) had not confirmed successful break-ins at the time of writing, and the CVEs were not yet listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog.
The takeaway is simple: whether or not your specific server has been hit yet, the window is closing fast. Treat PHP2Shell as actively dangerous and patch on an emergency timeline.
How to check if you’re vulnerable
Check the PHP version that actually serves your website (your command-line PHP can differ from the version your web server/PHP-FPM uses).
- Command line: run
php -v. If it reports anything below 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12 on its branch, it needs updating. - What your site runs: create a one-line file
<?php phpinfo();(delete it afterwards), or check your hosting panel’s PHP settings. On WordPress, Tools → Site Health → Info → Server shows the active PHP version. - Server-wide: on Debian/Ubuntu,
dpkg -l | grep phplists installed PHP packages and their patch levels.
How to patch PHP2Shell — step by step
Ubuntu / Debian (apt)
sudo apt-get update
sudo apt-get install --only-upgrade 'php*'
# then restart the service that runs your sites:
sudo systemctl restart php8.3-fpm # match your version, e.g. php8.5-fpm
Confirm with php -v and check that each PHP-FPM pool restarted. If your distribution hasn’t yet published the fixed package, your vendor’s security team usually ships it within hours to days — re-run the update until the patched version appears.
cPanel / Plesk / CloudPanel and other hosting panels
Managed panels package their own PHP builds. Update via the panel’s package manager (or apt/yum on the host), then restart PHP-FPM so running workers pick up the new binary. On multi-version servers, patch every installed PHP branch your sites use, and make sure your sites run a supported version (ideally the latest, PHP 8.5.12).
Managed / shared WordPress hosting
Reputable managed hosts typically apply core PHP security patches for you automatically. Verify in your hosting dashboard that the patched version is live, and if your site is pinned to an older PHP branch, switch it to a supported one. If in doubt, open a ticket and ask your host to confirm PHP2Shell is patched.
Docker / containerised apps
Rebuild your images from an updated base (e.g. php:8.3.36-fpm or newer), then redeploy. A running container keeps its old, vulnerable PHP until you rebuild and replace it — patching the host does not fix the container.
End-of-life PHP (8.1 and older)
There is no clean patch for EOL branches. Plan an upgrade to PHP 8.2+ (ideally 8.5), test your application for compatibility, and in the meantime reduce exposure (see mitigations below). Running EOL PHP on the public internet is now a serious liability.
If you can’t patch immediately
Interim mitigations can reduce — but not eliminate — risk. They are a stopgap, never a substitute for updating:
- Restrict or rate-limit untrusted traffic at your WAF/CDN (e.g. Cloudflare) while you roll out the patch.
- Apply any vendor-recommended configuration hardening for the specific CVEs, understanding it only closes some attack paths.
- For systems that genuinely cannot be updated — and especially anything still on PHP 8.1 or older — security agencies advise taking the system offline until it is patched or upgraded.
Official sources and advisories
Always verify against primary sources — here are the authoritative references for PHP2Shell:
- PHP.net — the official PHP project and security releases.
- CISA alert (21 Oct 2026) — “Critical Vulnerabilities in PHP Require Immediate Patching.
- NVD — CVE-2026-109618 and CVE-2026-109619.
- watchTowr — technical FAQ and exploitation intelligence.
- Qualys — find, mitigate and patch guidance.
- Greenbone and SOCRadar — affected/fixed version breakdowns.
PHP2Shell FAQ
What does “PHP2Shell” mean?
It’s the community nickname for the two PHP core CVEs disclosed together on 21 October 2026 — roughly “two bugs to a shell,” reflecting that chaining them gives an attacker a command shell on the server.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older on those branches — or any EOL branch (8.1, 8.0, 7.4 and earlier) — is at risk.
Is a firewall or WAF enough?
No. A WAF can buy you time but cannot be relied on to block every exploitation path for an unauthenticated RCE. Patching is the only complete fix.
Does this affect WordPress sites?
Yes — WordPress runs on PHP, so a vulnerable PHP version puts the whole site at risk regardless of plugins or theme. Update the server’s PHP, not just WordPress.
How do I know I’m safe after patching?
Confirm php -v shows a fixed version and that the version your web server/PHP-FPM serves is patched, then restart PHP-FPM so no old workers linger.
How REIKA responded
When PHP2Shell was disclosed, we patched every PHP branch across our managed infrastructure to the fixed releases within hours, consolidated all sites onto the latest PHP 8.5.12, and verified that only patched versions were serving traffic. If you run WordPress, Bricks or custom PHP applications and want a second pair of eyes on your exposure — or help building infrastructure that patches fast by default — get in touch with REIKA.
This article is for general information and reflects the situation as of 23 October 2026. Vulnerability details evolve — always confirm against the official sources linked above before acting.
