PHP2Shell is the nickname for two critical PHP flaws disclosed on 21 October 2026: CVE-2026-109618 and CVE-2026-109619. Together they can let an unauthenticated attacker run code on a server that runs PHP, with a single request. If you run WordPress, WooCommerce, Joomla, Drupal or Magento, or look after client sites that do, this is the checklist I put together from the PHP advisory and the security write-ups published since.
What the bugs are
- CVE-2026-109618 (CVSS v4.0 9.2): if PHP runs out of memory while request data is only partly initialised, cleanup later treats that data as valid.
- CVE-2026-109619 (CVSS v4.0 9.2): state from one request survives, after its memory is freed, into the next request handled by the same worker (a use-after-free). An earlier circulated score of 10.0 was corrected by the PHP Foundation.
Every web SAPI is in scope: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php is rated highest risk, because the demonstrated exploit fires before any application code runs.
Timeline: Amazon's honeypots saw an exploitation attempt on 17 October, four days before disclosure. CVE IDs leaked on 20 October, and PHP shipped fixes on 21 October at 14:00 UTC. Amazon now describes exploitation as broad and suggests looking back to 17 October, not the disclosure date. Over 100 "exploit" repos appeared on GitHub on day one, and some of them are themselves malicious.
Fixed versions
| Branch | Fixed in |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 (security support ends 31 Dec 2026) |
| 7.4 / 8.0 / 8.1 | No official release: source backports only, ask your host or vendor |
| 5.4 to 7.3 | End of life, no fix |
Distro and LTS packages got the patches early (Ubuntu shipped on 21 October), so a distro package can be patched even if its version number looks old. Only your vendor can confirm a backport.
Check what you run (2 minutes)
-
WordPress: Tools → Site Health → Info → Server shows the PHP version and the SAPI.
apache2handlermeansmod_php, the highest-risk setup. - cPanel: MultiPHP Manager. EasyApache 4 release 25.91 ships ea-php82 8.2.35, ea-php83 8.3.36, ea-php84 8.4.27 and ea-php85 8.5.12.
-
Anything else: drop a temporary file that prints
PHP_VERSIONandPHP_SAPI, load it once in a browser, then delete it. The web server's PHP can differ fromphp -vover SSH.
If you can't patch today
These are stopgaps, not fixes:
; CVE-2026-109618 – set in the main php.ini so apps can't override it
memory_limit = -1
; CVE-2026-109619
session.upload_progress.enabled = 0
; PHP 8.5 only
fatal_error_backtraces = 0
Restart every PHP worker after changing them. Cloudflare has WAF rules for known vectors on all plans, including free, but they only cover traffic that actually goes through Cloudflare. On shared hosting, .htaccess and .user.ini tweaks are not a reliable mitigation, so your host has to patch. The UK NCSC and CERT-EU both advise isolating or taking offline anything that can't be patched or mitigated.
After patching: four things to check
- New or changed admin accounts in your CMS.
- Recently modified or unknown PHP files, especially in upload directories, and new cron jobs.
- Unexpected scripts or redirects on checkout and login pages.
- Secrets on the box (DB, payment, mail, cloud keys): rotate them once the patch is confirmed.
How countries reacted
On 21 October several public bodies took sites offline as a precaution, including NCSC-NL and parts of the Dutch government, Finland's state IT provider Valtori, Denmark's Kombit, French prefecture sites and several German federal sites. CERT-EU issued advisory 2026-018. CISA recommended patching, and the NSA advised taking unpatchable systems offline (per Reuters). The full table, with sources, is in the original guide.
The full version, with a "which setup are you?" table for shared hosting, VPS, site builders, static sites and agencies, is on Kuponaut. Sources: Help Net Security, Tenable FAQ, Sansec, Safeguard on shared hosting. This is general information, not advice for your specific setup.
Top comments (0)