PHP2Shell: What It Is and How to Patch and Mitigate It

The short answer: PHP2Shell is a pair of critical flaws in the PHP runtime (CVE-2026-109618 and CVE-2026-109619) that let an unauthenticated attacker run code on a server with a single web request. Fixes shipped on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Exploitation attempts were seen before the patch was public. Update PHP on every server today and restart the PHP workers. Updating your CMS or plugins does not fix it.

As of 23 October 2026, here is what is confirmed, who is exposed, and a mitigation plan you can hand to your team.

What happened

Details of two PHP memory-safety bugs leaked on social media on 20 October, ahead of a planned disclosure. PHP published an emergency release and the official advisories (CVE-2026-109618, CVE-2026-109619) the next day.

• CVE-2026-109618 (out-of-memory corruption): if PHP runs out of memory while setting up a request, half-built internal data can be trusted by cleanup code, which leads to code execution.
• CVE-2026-109619 (stale global state): internal state can outlive the memory behind it, so the next request handled by the same PHP worker can act on leftover data.

Both are rated 9.2 under CVSS v4.0 by PHP. Both are remote and need no login. Help Net Security reports that Amazon's honeypot network recorded an exploitation attempt on 17 October, four days before disclosure, and watchTowr reports in-the-wild exploitation since 21 October.

Who is affected

Every PHP installation that serves web requests, whatever the server setup: PHP-FPM, Apache with mod_php, php-cgi, LiteSpeed and FrankenPHP. PHP rates Apache mod_php as the highest risk, because an attack can succeed before your application code runs at all.

PHP branch	Status	What to do
8.5	Fixed in 8.5.12	Update and restart workers
8.4	Fixed in 8.4.27	Update and restart workers
8.3	Fixed in 8.3.36	Update and restart workers
8.2	Fixed in 8.2.35	Update and restart workers
7.4, 8.0, 8.1	No official release	Distribution or LTS vendor package, source backport, or upgrade
7.3 and older	No fix	Upgrade, or isolate the server

That covers most WordPress, WooCommerce, Magento, Drupal, Joomla and Laravel sites, and plenty of internal tools and appliances. Some network vendors have also started publishing advisories for products that embed PHP.

Mitigation plan

Today

1. Inventory every PHP install. Include staging servers, old microsites, admin tools and anything your agency or host manages. Run php -v (and check the FPM or Apache module version, which can differ from the CLI).
2. Update PHP to the fixed release for your branch, or install your distribution's patched package. Linux distributions received fixes before the public release, so check your package manager first.
3. Restart all PHP workers (PHP-FPM pools, Apache, LiteSpeed) so the patched code is actually running.
4. On managed hosting, ask your provider to confirm the PHP version in writing.

If you cannot patch immediately

• Restrict access to the server (VPN, IP allow-list) or take it offline. The UK NCSC recommends taking unpatched systems offline.
• Keep WAF rules in blocking mode. Cloudflare has deployed managed rules for all plans, including Free; paid plans should confirm the Managed Ruleset is set to block. Treat this as a stopgap: Cloudflare saw attackers changing payloads to get around it.
• Reduce exposure: disable unnecessary upload endpoints and limit upload and request sizes.

This week

• Check for compromise on anything that was exposed and unpatched: unexpected PHP worker crashes, new or modified PHP files, unfamiliar admin accounts, outbound connections from the web server and new cron jobs.
• Rotate secrets stored on affected servers (database passwords, API keys) if you see any sign of intrusion.
• Retire unsupported PHP. If you were on 8.1 or older, this is the moment to plan an upgrade. The next runtime flaw will not come with a backport.

What this means for your team

PHP2Shell is a reminder that application security includes the runtime underneath the application. Most breaches we see start with a component nobody owned: an old PHP version on a forgotten server, or a host that never updated. A short, written patching process with a named owner per server is worth more than any single tool.

How Intelvue can help

Our team has patched and hardened PHP platforms for more than a decade, including WordPress, Magento and custom PHP. For PHP2Shell we can:

• Audit your servers and confirm every PHP install is on a fixed version.
• Patch and restart safely, including upgrades from unsupported PHP 7.x and 8.0/8.1.
• Check exposed systems for signs of compromise and harden them.

See our security audits and compliance service, read the website security checklist, or talk to an engineer today.