PHP2Shell Explained: Two Critical PHP Flaws, Who's Exposed, and What to Patch Today

PHP2Shell is the nickname for two critical remote code execution vulnerabilities in PHP itself: CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on CVSS v4.0. Because the bugs live in the PHP runtime rather than in any single application, anything running on a vulnerable PHP build is potentially exposed. That includes WordPress, Drupal, Joomla, Magento, Laravel apps, and custom code.

PHP shipped fixes on October 21, 2026. Details had already leaked online before then, and security vendors report exploit attempts against honeypots. If you run PHP anywhere, this is a patch-now week.

The short version

What actually broke (high level)

Both bugs sit in how PHP handles incoming request data before your application code ever runs. That's what makes them nasty: your app doesn't have to do anything wrong to be reachable.

• CVE-2026-109619 is a memory-safety flaw (a use-after-free) tied to PHP's session upload progress feature.
• CVE-2026-109618 involves an out-of-memory condition during request parsing that leaves data half-initialized, which later cleanup code then trusts.

Reporting on the exact split between the two CVEs has been messy. A leaked early write-up described the bugs differently from PHP's own advisories, and at least one researcher has said the leak got both bugs wrong. When in doubt, trust PHP's official advisories over secondhand descriptions. The fix is the same either way: upgrade.

The flaws were reportedly found independently by researchers at Calif (working with OpenAI's "Patch the Planet" project) and at Wiz.

Timeline

• Before Oct 21: Details leak online ahead of coordinated disclosure and before patches exist. The PHP Foundation's executive director said at the time there was no evidence of working exploits, "only incomplete, misguided, and non-working generated ones."
• Oct 17 onward: One threat-intel vendor reports exploitation attempts beginning, four days before the fix.
• Oct 21, 14:30 UTC: PHP releases 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Linux distributions (AlmaLinux among the first) push patched packages the same day.
• Oct 21–22: Honeypot operators, including watchTowr and Amazon, report PHP2Shell exploit attempts. Others note that confirmed successful compromises haven't been established publicly.

Am I affected?

Short answer: if you run PHP 8.5.11, 8.4.26, 8.3.35, 8.2.34, or anything older, assume yes until you've patched or confirmed a backport.

How to check:

1. On a server you control: run php -v for the CLI, but remember the web server may use a different binary. Check your PHP-FPM or Apache module version too, or look at a phpinfo page you've restricted to yourself.
2. On a distro package (Ubuntu, Debian, RHEL, Alma, etc.): the upstream version number may not change. Distributions often backport the fix into the same version string. Check your distro's security advisory for CVE-2026-109618 and CVE-2026-109619 and compare package release numbers.
3. On managed or shared hosting: you probably can't patch PHP yourself. Check your host's status page or open a ticket and ask directly: "Is the PHP my site runs patched for CVE-2026-109618 and CVE-2026-109619?"
4. On WordPress: Tools → Site Health → Info → Server shows the PHP version. Some hosts apply backported fixes without changing the displayed version, so confirm with the host if it shows an old number.

What to do now

1. Patch (the only complete fix)

Upgrade to the fixed release for your branch: 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or your distribution's patched package. Then restart PHP-FPM, Apache, or whatever runs PHP. A package update that never reloads the running workers leaves the old code in memory.

If you're on PHP 8.1 or older, there's no official release. Your options are a vendor backport (some Linux distributions and commercial support providers offer them), building from the source-only patches, or moving to a supported branch. This is a good moment to move to 8.3 or newer. PHP 8.2 reaches end of life on December 31, 2026.

2. If you truly can't patch today: partial mitigation

Several vendors suggest disabling session upload progress (session.upload_progress.enabled = 0) as a stopgap. Be clear-eyed about what it does:

• It reportedly blocks one known path for CVE-2026-109619 and does nothing for CVE-2026-109618.
• It must be set in php.ini, the server config, or each PHP-FPM pool. Runtime ini_set() and .user.ini take effect too late to help.
• Workers must be restarted for it to apply.

PHP has said no configuration change fully closes these vulnerabilities. Treat this as buying hours, not a fix. WAF rules from your CDN or security vendor can add another layer, but they aren't a substitute for patching either.

3. Look for signs of compromise

If a server was exposed while unpatched, especially from mid-October onward, check:

• PHP worker crashes: segfaults or repeated child restarts in PHP-FPM or web server error logs.
• Unexpected files: new or recently modified .php files in upload, cache, or temp directories, which is a classic web-shell pattern.
• Odd process trees: shells or network tools spawned as children of PHP-FPM or the web server user.
• Outbound traffic from web servers to destinations you don't recognize.
• New admin users or changed credentials in your CMS.

If you find any of the above, treat it as an incident: isolate the host, preserve logs, rotate secrets the web server could read (database passwords, API keys, session secrets), and rebuild from a known-good state rather than cleaning in place.

Why this one matters

Most "critical WordPress vulnerability" headlines are about a single plugin. PHP2Shell is different: it's the floor everything stands on. PHP still powers a huge share of the web, a lot of it on hosting where the site owner doesn't control the runtime. The pre-patch leak removed the usual head start defenders get.

The lesson is boring and important. Know what runtime versions you're on, know who's responsible for patching them, and stay on supported branches. The teams that had that inventory finished patching on October 21. Everyone else is still filing tickets.

Sources

This write-up was compiled from vendor advisories and security research published October 20–23, 2026. Where sources disagree, we've said so.

• Qualys: PHP2Shell — find, mitigate, and patch now
• watchTowr: PHP2Shell FAQ
• Tanium: Responding to CVE-2026-109618 and CVE-2026-109619
• AlmaLinux: Patched PHP packages released
• Recorded Future: PHP2Shell exploitation explained
• The Hacker News: PHP issues emergency patches
• Malwarebytes: Why many websites had to go offline

This is a developing story. We'll update this page as PHP, CISA, and major hosts publish more.