PHP2Shell: Critical PHP Flaws Explained and What Your Business Should Do Now
Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) allow remote code execution on web servers. Fixed versions, who is affected and a practical patch checklist.
If your business runs anything built on PHP, including WordPress, WooCommerce, Magento, a client portal or a cPanel website, update PHP now. On October 21, 2026 the PHP project released emergency fixes for two critical flaws nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619) that let an attacker run code on a web server without logging in. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Servers on PHP 8.1 or older get no official fix and need an upgrade or a vendor-backported package.
Below is what happened, who is affected, and a short checklist you can hand to whoever manages your website or servers.
What PHP2Shell is
PHP2Shell is a pair of memory-safety bugs in the PHP engine itself, not in a plugin or a framework. That is why it is so broad: any PHP installation that serves web requests is in scope.
- CVE-2026-109618 is triggered when PHP runs out of memory while it is still setting up a request. The cleanup that follows can treat half-initialized data as valid, which leads to memory corruption.
- CVE-2026-109619 is a use-after-free: leftover state from one request can point to memory that has already been freed, and a later request on the same worker can use it. PHP also lists memory disclosure as an impact.
Both are rated 9.2 (critical) on CVSS v4.0 and can be exploited remotely by an unauthenticated attacker. Details leaked publicly on October 20, before the patches were ready, which is why the fixes shipped as an emergency release the next day.
Who is affected
According to CISA and the PHP advisory, every common way of running PHP for the web is affected:
- Apache with mod_php (PHP rates this the highest risk, because a single request can trigger the exploit before any application code runs)
- PHP-FPM (the usual setup behind Nginx, and common on cPanel servers)
- php-cgi, FrankenPHP and LiteSpeed
In practice, for a small or mid-sized business that means:
- Your company website if it runs on WordPress or another PHP CMS
- Online stores on WooCommerce, Magento or PrestaShop
- Client and employee portals, intranets and booking systems written in PHP
- Shared or reseller hosting, VPS and dedicated servers running cPanel, Plesk or similar panels
Palo Alto Networks' Unit 42 reported more than 22 million internet-facing instances that are potentially vulnerable, so this is not a niche problem.
Is it being exploited?
Reports differ, so plan as if it is. Amazon Threat Intelligence observed an exploitation attempt against its honeypots on October 17, four days before disclosure, and reported more attempts from multiple actors after October 21. Cloudflare and watchTowr also reported early attack attempts. CISA said on October 21 that it had not yet observed successful exploitation, and as of October 23 neither CVE had been added to CISA's Known Exploited Vulnerabilities catalog.
The safe reading: attackers are actively trying, so any unpatched internet-facing PHP server should be treated as at risk, and investigations should look back to October 17.
What to do now: a checklist
1. Find every place PHP runs
Make a list of every website, server and application that uses PHP, including the ones a vendor or former developer set up. Remember that PHP is often embedded in other software and that a single cPanel server can run several PHP versions side by side.
2. Update to a fixed version
| Your PHP branch | What to do |
|---|---|
| 8.5 | Update to 8.5.12 or later |
| 8.4 | Update to 8.4.27 or later |
| 8.3 | Update to 8.3.36 or later |
| 8.2 | Update to 8.2.35 or later |
| 7.4 to 8.1 | No official release. Use your Linux distribution's or LTS vendor's patched package, or upgrade to 8.2+ |
| 7.3 and older | End of life with no fix. Upgrade, or take the site offline |
On cPanel servers, update the PHP packages through EasyApache or your operating system's package manager, and check every PHP version enabled in MultiPHP, not just the default. If your website is on shared hosting, ask your host to confirm in writing that it has applied the fix.
3. Restart PHP
Patched packages only protect you once the running processes are replaced. Restart PHP-FPM pools and Apache (for mod_php), then confirm the new version is the one actually serving requests.
4. If you cannot patch today
CISA's guidance is blunt: if a system cannot be updated immediately, or it runs PHP 8.1 or older, take it offline until it can be. PHP lists interim settings that reduce exposure but do not make a server safe: set memory_limit=-1 in a way applications cannot override (for CVE-2026-109618), set session.upload_progress.enabled=0 (for CVE-2026-109619) and, on PHP 8.5, fatal_error_backtraces=0, then restart all PHP workers. A web application firewall, such as Cloudflare's managed rules, may block known attack patterns, but only for traffic that passes through it.
5. Check for signs of compromise
Because attempts started before disclosure, review activity since October 17:
- PHP or web server processes launching shells,
curl/wgetdownloads or other unexpected programs - New or modified PHP files in upload folders, caches and other writable directories (classic web shells)
- New administrator accounts in WordPress or your CMS, and unexpected scheduled tasks or cron jobs
- Unusual outbound connections from the web server
If you find anything suspicious, assume credentials stored on that server are exposed: rotate database passwords, API keys and admin logins after the system is cleaned or rebuilt.
A second, lower-risk advisory
On October 23 the PHP project published a further advisory, CVE-2026-115560, describing another remote code execution risk that only affects applications configured in an unusual way. PHP considers it unlikely to affect most sites and recommends disabling session upload progress until a routine fix ships. Keep an eye on the official PHP security advisories for updates.
The bigger lesson
PHP2Shell is a reminder that the software underneath your website needs the same patch discipline as your laptops. Old PHP versions keep running quietly for years on forgotten servers, and they are exactly what attackers scan for. A simple inventory, a monthly patch window and alerts for critical advisories turn an emergency like this into a routine update.
If you are not sure which PHP versions your sites run, or who is responsible for patching them, request a free IT assessment. We manage cPanel/WHM, Linux and Windows servers for businesses in Miami-Dade and across South Florida, and we can check, patch and verify your systems quickly.
