PHP2Shell: two critical PHP flaws (October 2026) and what to do now

On 21 October 2026, the PHP project released emergency security updates fixing two critical vulnerabilities, nicknamed PHP2Shell. They can let an attacker who is not logged in run code on your web server, and exploitation attempts have already been observed. If your website, online shop or application runs on PHP (including most WordPress, WooCommerce, Drupal, Magento and Laravel sites), you should act now.

What happened

• CVE-2026-109618: when PHP runs out of memory while setting up a request, internal data can be left half-initialised and later treated as valid, which can lead to remote code execution.
• CVE-2026-109619: internal state belonging to one request can survive after its memory has been freed, and a later request handled by the same PHP worker may use it (a “use-after-free”), which can lead to remote code execution and memory disclosure.

PHP rates both flaws 9.2 out of 10 (critical) on the CVSS v4.0 scale; an earlier score of 10.0 that circulated before the release was incorrect. According to the official PHP advisory, they affect all PHP installations serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is considered highest with Apache mod_php.

Which versions are affected

• Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Every earlier version in these branches is affected.
• PHP 7.4, 8.0 and 8.1: no official release. The PHP security team published minimal source patches, and some Linux distributions and long-term-support vendors provide fixed packages.
• PHP 5.4 to 7.3: end of life, with no fix from the PHP project. Upgrade or isolate these systems.
• Good to know: PHP 8.2 reaches end of life on 31 December 2026 and will receive no security fixes after that date.

Is it being exploited?

Yes, attempts have been seen. Amazon Threat Intelligence reported an exploitation attempt on 17 October, four days before the public disclosure, and broader attempts from several actors from 21 October; Cloudflare and watchTowr also reported early attacks (Tenable’s FAQ summarises the timeline). “Proof-of-concept” code is circulating online but is unverified and may itself contain malware: never run it on your systems.

What to do now: a checklist

1. Find your PHP version: in your hosting control panel, with the command php -v on your server, or with a temporary phpinfo page (delete it right after).
2. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distribution’s patched package), then restart every PHP worker (PHP-FPM, Apache). A restart is needed for the fix to take effect.
3. On shared or managed hosting: check your host’s status page or ask support. Many hosts have already applied the fixes for their customers.
4. If you cannot update today: apply the temporary measures listed in the PHP advisory, such as session.upload_progress.enabled=0 in php.ini or your PHP-FPM pool (not with ini_set() or a .user.ini file), then restart. These reduce exposure but do not make a server safe.
5. On PHP 8.1 or older: plan an upgrade to a supported version and, in the meantime, isolate internet-facing applications or put them behind a web application firewall.
6. Check for signs of compromise since 17 October: unknown PHP files, new administrator accounts, unexpected scheduled tasks or processes, and unusual outgoing traffic.

What about WordPress sites?

The flaws are in PHP itself, not in WordPress, so no WordPress, plugin or theme update fixes them: the fix is updating PHP on your server. If you move to a newer PHP branch (for example from 8.1 to 8.3), test your theme and plugins on a copy of the site first.

Need help?

Keeping PHP, your CMS and your plugins up to date is exactly what our maintenance and technical support covers: we check your versions, apply updates safely with a backup, and monitor your site so issues like this one are handled quickly.