PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 out of 10 and can let an attacker run code on a server without logging in. PHP shipped fixes on October 21, 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The only reliable fix is upgrading PHP itself.
What is the PHP2Shell vulnerability?
PHP2Shell is the name security researchers gave to a pair of flaws in the PHP engine, the interpreter that reads and runs PHP code. They are tracked as CVE-2026-109618 and CVE-2026-109619, and the PHP security team rates each one 9.2 (Critical) on the CVSS v4.0 scale.
Both flaws can lead to remote code execution, often shortened to RCE. In plain terms, someone on the internet can send a specially built web request and make your server run commands of their choosing. No password and no account is needed.
The name comes from the end goal: turning a PHP request into a shell, which is a command line on the target machine.
Timeline: how the PHP vulnerability unfolded
- October 17: A security analysis reports an exploit attempt in the wild, four days before fixes shipped.
- October 20: The PHP security team announces an urgent release for two critical flaws. Technical details leak online before coordinated disclosure.
- October 21: PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Public proof of concept code is already circulating.
- After the patch: Researchers at VulnCheck report an exploit that works even with ASLR, a common memory protection, switched on.
Why did the PHP vulnerability become global news?
It sits in the core, not in one app
Most security stories are about a single plugin or product. This one is in PHP itself. Even a website with perfectly written code can be exposed if the server underneath runs an unpatched PHP. Recorded Future’s analysis makes the same point: secure applications are still at risk.
PHP is everywhere
According to W3Techs, PHP runs 69.3% of websites whose server side language is known. That includes WordPress, which powers roughly 40% of the web, and a long tail of shops, school portals, hospital sites and government pages.
The details leaked before the fix
Responsible disclosure normally gives defenders a head start. Here the technical details went public a day before the patch, and working exploit code followed fast. That turned a scheduled update into a race.
Governments issued warnings in advance
Cyber agencies in Singapore and Japan, and CERT-EU in Europe, published alerts before the patch even landed, urging teams to prepare. Japan’s IPA noted that PHP flaws were abused in attacks before, in 2024, which is why it chose to warn early.
How the two PHP flaws work
You do not need to be a security engineer to follow the idea. Both bugs are memory safety problems: the engine ends up using memory in a state it should not.
CVE-2026-109618: out of memory corruption
When the server runs out of memory at the wrong moment, PHP can be interrupted while it is still setting up internal request data. Later cleanup then works on invalid data. An attacker who can trigger that situation may be able to take over what the engine does next. Researchers at watchTowr reproduced this one before the official release.
CVE-2026-109619: stale global state
The second flaw involves old internal state that is not reset properly. Wiz describes how failures plus stale state can expose freed or half initialized memory, which can enable memory disclosure, corruption and code execution.
Exploitation depends on the runtime, server setup and reachable code paths. That is why impact differs from server to server, and why you should not assume you are safe without checking.
Which PHP versions are affected?
Third party reports, relayed by CERT-EU and Japan’s IPA, say PHP 5 and later may be affected, though the full scope was still being verified. PHP’s advisory rates the risk highest for Apache with mod_php. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed setups are also listed as affected.
| PHP branch | Fixed in |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 (security support ends December 31, 2026) |
| 8.1 and older | No packaged fix reported. Upgrade the branch. |
PHP version checker
Run php -v on your server, then enter the version here. It runs in your browser and nothing is sent anywhere.PHP branch 8.58.48.38.28.18.07.x5.x Patch number (the last digit)Check my version
Pick your version and press the button.
How to fix the PHP vulnerability
Patching is the fix. Interim server settings exist for specific attack paths, but PHP states they do not make an installation safe, so treat them as a short bridge at best.
Update through your normal channel
Use your operating system’s package manager, your host’s control panel or your container base image. PHP also warns that the volunteer run Remi repository would not have updates ready on release day, so use distribution packages or build from source if you rely on it.
Restart the PHP process
An upgrade only protects you once the running service restarts. Reload PHP-FPM or Apache after updating, then confirm with php -v and the version shown by your web server.
Prioritize internet facing systems
Singapore’s cyber agency advised patching internet facing systems first. Start with public websites, admin panels and APIs, then move inward.
Your PHP2Shell action checklist
0 of 6 done
- I listed every server and site that runs PHP
- I checked each PHP version with the tool above
- I upgraded to a fixed version or a supported branch
- I restarted PHP-FPM or Apache after the update
- I asked my host or agency to confirm their patch status
- I reviewed logs for odd requests since October 17
Is my website affected? WordPress and hosting
If your site runs on PHP, the answer is yes unless your server has been patched. For WordPress owners this is the key point: updating WordPress core, themes or plugins does not fix this. The flaw is below WordPress, so the PHP version on the server must change.
On shared or managed hosting, the provider controls PHP. Ask them in writing which fixed version you are on and when it was applied. On a VPS or your own server, the job is yours. If your agency manages the site, send them the version table above and ask for a date.
One more risk factor: Axis Intelligence estimates that 48.3% of PHP sites were still running an end of life PHP branch on October 23, 2026. Those sites cannot simply take a patch. They need a branch upgrade, which takes planning and testing.
What security experts are saying
“Adversaries are clearly spending time (and tokens) on this bug.”
A VulnCheck researcher, quoted by The Register
The “tokens” remark points to AI assisted work on both sides, a theme in several write ups. Wiz and watchTowr both stressed that exploitation can vary by configuration, while Recorded Future tracked public exploit attempts and urged immediate patching. The shared advice is simple: do not wait to confirm exploit conditions on your own stack.
Since the patch, PHP’s team has also said that separate memory safety reports seen afterward do not show the October 21 fixes are ineffective. If you are on a fixed version, the right move is to stay current, not to panic.
Frequently asked questions about the PHP vulnerability
What is the PHP2Shell vulnerability?
It is the nickname for CVE-2026-109618 and CVE-2026-109619, two critical flaws in PHP core that can allow unauthenticated remote code execution. Both are rated 9.2 on CVSS v4.0.
How do I check if my site has the PHP vulnerability?
Find your PHP version with php -v or your host’s dashboard, then compare it to the fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Use the checker above for a quick answer.
Does updating WordPress fix the PHP vulnerability?
No. The flaws are in PHP itself, so the fix is a PHP upgrade on the server.
What should I do if I am on PHP 8.1 or older?
Plan an upgrade to a supported branch such as 8.3 or newer. No packaged fix was reported for these branches, so patching in place is not an option.
Is there a PHP security update I can wait on?
No. Public exploit code exists and attacks have been reported, so this update is urgent.
