PHP2Shell: patch PHP now, then check

#php #security #webdev #cybersecurity

Originally published on the Dunime blog.

Two critical PHP flaws let an attacker run code on a web server without logging in. What changed on 21 October, which sites it touches, and what to do today.

If a website runs on PHP, it is in scope. On 21 October 2026 the PHP project shipped fixes for two critical flaws that can let an unauthenticated attacker run code on the web server, and said that updating is the only complete fix.

What changed

On 20 October the PHP security team gave advance notice of a release fixing two critical vulnerabilities, both rated CVSS v4.0 9.2. On 21 October it published PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 with a security advisory headed "update now". The pair is widely reported under the name PHP2Shell.

CVE-2026-109618, code execution via out-of-memory corruption: out-of-memory handling can interrupt PHP while internal request data is only partly set up, and request cleanup may then treat that invalid data as valid.
CVE-2026-109619, code execution via stale global state: internal state belonging to one request can survive after its memory has been freed, and a later request handled by the same worker may use it.

In PHP's words, there are no complete mitigations and updating is the only safe choice. On 23 October PHP added an informational note: keep session.upload_progress.enabled=0 until the next regular bugfix release, to close an unlikely related vector it will document as CVE-2026-115560.

On exploitation: BleepingComputer reported on 21 October that Cloudflare's CTO said the company was already observing early attacks against both flaws before the patches shipped. The UK NCSC alert of the same day asks organisations to update immediately; it does not itself state that the flaws are being exploited.

Who it applies to

PHP's advisory puts every PHP installation that serves web requests at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs.

CMS and web apps: WordPress, Drupal, Joomla, Magento, phpMyAdmin and Nextcloud all run on PHP. Help Net Security, reporting Searchlight Cyber's research, names all six as software on which exploitation has been confirmed. A fully updated plugin or theme does not help if the PHP underneath is unpatched.
Shared hosting and cPanel: on shared hosting the provider usually owns the PHP build. The PHP version picker in the panel shows which branch a site uses, but whether that build carries the 21 October fix is the host's answer to give.
Old PHP: PHP 8.1 and older no longer get updates from the PHP project. Some Linux distributions and long-term-support vendors backport fixes, so ask the vendor. PHP also published minimal source backports for 7.4, 8.0 and 8.1 for people who build from source. PHP 8.2 itself reaches end of life on 31 December 2026.
Agencies and IT teams: anyone who runs sites for others owns an inventory problem today. The NCSC asks for discovery of every PHP installation, internet-facing first, and warns not to limit the search to outdated PHP versions.

Patching the plugin is not patching PHP.

What to do today

1. Find every PHP install. Start with internet-facing sites, then internal tools. Include appliances and products that bundle PHP, and apply their vendors' updates as they arrive.
2. Check the version. On a server, php -v shows the command-line build. The web server can run a different build, so also check the hosting panel or your package manager. Distribution packages may carry the fix under their own version numbering, so confirm with the vendor's security notice rather than the number alone.
3. Update. Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the patched package from your distribution or LTS vendor, internet-facing systems first. Restart PHP-FPM or Apache so every worker runs the new build.
4. If you cannot update yet, reduce exposure. PHP's interim measures narrow specific attack paths but do not make a server safe. They are listed in the next section.
5. If even that is not possible: the NCSC says to consider taking the system offline until it is fully mitigated, and, if it cannot be updated or disabled straight away, to check it for signs of compromise and backdoors first.
6. Check the logs. Look for new or changed PHP files in upload and cache folders, unexpected admin accounts, and bursts of large multipart POST requests, memory-exhaustion errors or crashed PHP-FPM workers. A server that was exposed before patching should be checked, not just patched.
7. Know who to call. Your hosting provider for the PHP build, your application vendor for bundled PHP, and an incident response team if you find signs of compromise. In India, cyber incidents are reported to CERT-In.

Interim mitigations PHP published

Only for systems that cannot be updated immediately. PHP is explicit that these reduce exposure to specific attack paths and do not make an installation safe.

For CVE-2026-109618: set memory_limit=-1 in a way applications cannot override, such as php_admin_value in the FPM pool or Apache configuration, and check nothing sets a finite limit back. Set a low post_max_size: 8M for applications without file uploads, 32M if uploads are needed, with upload_max_filesize below it. Use a container or cgroup limit, ideally one that kills only the affected worker; PHP warns not to substitute RLIMIT_AS or RLIMIT_DATA.
For CVE-2026-109619: set session.upload_progress.enabled=0 in php.ini, the FPM pool or server configuration (not ini_set() or .user.ini) and restart every worker. On PHP 8.5, also set fatal_error_backtraces=0 and restart. Remove invalid or deprecated per-request settings that emit diagnostics, and fix fatal errors and timeouts an attacker can reach.
What does not help: hiding errors with error_reporting, display_errors or the @ operator.

A free scanner, and its catch

On 22 October Searchlight Cyber released php2shell-scanner, a free, open-source command-line tool (github.com/assetnote/php2shell-scanner) that tests whether a host shows the vulnerable behaviour rather than only reading a version number. It first tries to produce a PHP memory-exhaustion error, then looks for a PHP-FPM worker dying mid-request, and only as a last resort reads the advertised PHP version.

The catch: detection deliberately pushes PHP into an out-of-memory condition. The researchers call this "fundamentally risky in nature" and ask for care and caution. Each tested path can receive a small control request and three probes totalling about 29 MiB.
False positives: the README warns that a patched build can return the same empty HTTP 500 when a probe exceeds a low memory_limit, so check any "vulnerable" result against the installed version and vendor backports.
Run it only on systems you own or are authorised in writing to test, and in a maintenance window. It is a check after patching, not a reason to delay the patch.

Questions people ask

What is PHP2Shell? The name widely used for CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities fixed on 21 October 2026 that can allow unauthenticated remote code execution on web servers running PHP, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.

Which PHP versions fix PHP2Shell? PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive updates from the PHP project; some Linux distributions and LTS vendors provide backported fixes, and PHP published minimal source backports for 7.4, 8.0 and 8.1.

My WordPress site is on shared hosting. What should I do? Check the PHP version in your hosting panel and ask your host whether their PHP build includes the 21 October 2026 fixes. Updating WordPress, plugins and themes does not fix PHP itself. If the host cannot confirm, ask when it will, and follow the NCSC advice for systems that cannot be patched.

Sources

Dunime maps live threats like this one to the specific checks and defences that answer them: dunime.com/now.

Not sure what's exposed? Dunime's VAPT checks whether unpatched services like this are reachable and exploitable across your estate.

Published by Dunime Technologies — custom software, automation and cybersecurity, Delhi NCR, India.

DEV Community