On October 21, 2026, the PHP project shipped emergency security updates for two serious vulnerabilities nicknamed PHP2Shell. Both let an attacker run code on a web server without logging in. Both sit in PHP itself, not in any one website or plugin, so a site can be exposed even when its own code is clean.
What is PHP2Shell?
PHP2Shell is two bugs, tracked as CVE-2026-109618 and CVE-2026-109619, that share a root cause in how PHP handles memory. The first involves PHP’s response to running out of memory mid-request, which can leave internal data half-initialised and later misused during cleanup. The second involves internal state that keeps pointing at memory after it has been freed.
Both are rated 9.2 on the CVSS v4.0 scale. Reports of a perfect 10 were not PHP’s own rating.
The advisory describes a demonstrated attack where a single unauthenticated HTTP request against Apache with mod_php can trigger the first flaw, using default settings. That happens before any application code runs, so app-level protections like input validation or a hardened CMS don’t help.
Who is affected?
Any PHP installation that serves web requests. The advisory names PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Reporting says the flaws reach back as far as PHP 5.4, and PHP powers roughly 70% of websites. That doesn’t mean 70% of sites are exploitable, since real risk depends on version, build and configuration. But it does mean the exposure is very wide, especially on shared hosting and control panels.
mod_php setups carry the highest risk.
Which versions fix it?
| PHP branch | Fixed version |
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
PHP 8.1 and older no longer get official updates. The PHP security team published minimal source backports for 7.4, 8.0 and 8.1, but these are patches for people who build PHP themselves, not packaged releases. PHP 8.2 itself reaches end of life on December 31, 2026.
One caution: Linux distributions often backport fixes without changing the version number, so a “lower” version string isn’t proof you’re vulnerable. Check your vendor’s security advisory.
What should you do?
- Find every PHP runtime you run: Check servers, containers, cloud instances and hosting accounts.
- Update to a fixed version: Install your distribution’s patched package, then restart Apache, PHP-FPM and any long-running PHP workers. Until the restart, the old code may still be running.
- Ask your host: If you’re on shared or managed hosting, confirm in writing that the PHP runtime has been patched.
- Treat configuration changes as partial only: PHP’s advisory says no setting fully closes these holes. Turning off session.upload_progress helps against one path but isn’t a fix.
- Add a WAF as a stopgap: Cloudflare deployed rules for known exploit paths on October 21. That reduces risk while you patch but doesn’t replace patching.
- Isolate what you can’t patch: The UK’s NCSC has suggested considering taking systems offline if they can’t be fixed right away.
Patching isn’t the end
Updating closes the door but doesn’t tell you whether someone already walked through. After patching, review server logs, look for unexpected files or configuration changes, and watch for odd outbound connections. If you find signs of compromise, keep your logs, bring in your host or an incident response specialist, and rotate credentials.
Reports differ on whether the flaws were exploited before disclosure. Some analysts said no exploitation had been confirmed as of October 21, while other coverage mentions attempts before public disclosure. Either way, assume nothing and check.
The bigger picture
The bug traces back to an out-of-memory weakness that an earlier audit flagged but couldn’t prove exploitable. AI-assisted auditing from Calif, Wiz and OpenAI helped turn it into working remote code execution. The code had reportedly been in PHP for over a decade.
The takeaway is that vulnerabilities are being found faster, so the gap between disclosure and patching matters more than ever. Know what you run, keep it supported, and patch quickly.
