PHP2Shell explained

PHP2Shell: what it is, who is affected, and how to fix it.

PHP2Shell is the name given to two critical vulnerabilities in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, disclosed and patched on 21 October 2026. Both are rated 9.2 under CVSS v4.0 and allow remote code execution without a login. This page gives you the facts in plain language and the exact versions to look for.

Last updated 25 October 2026. Sources are linked at the end of each section.

What PHP2Shell is

PHP2Shell is a pair of memory-safety bugs in PHP itself, not in WordPress or any plugin. CVE-2026-109618 is triggered when PHP runs out of memory while a request is only partly set up; CVE-2026-109619 is a use-after-free where state left over from one request can be reused by the next request on the same worker. On an unpatched server, an attacker who can send a web request can run their own code or read server memory before your application code even loads. PHP rates the risk highest for mod_php deployments, but PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are all in scope.

The bug had been present since PHP 5.4, roughly fourteen years. Amazon observed exploitation attempts against its honeypots on 17 October, four days before disclosure. Within 48 hours of the patch, security vendors counted exploit attempts in the millions, some delivering Mirai botnet malware. Palo Alto Networks estimated 22.6 million exposed PHP instances.

Tenable: PHP2Shell FAQ · Unit 42 threat brief · The Hacker News

Am I affected?

You are in the affected range if your web server runs any of these:

• PHP 8.5 below 8.5.12, 8.4 below 8.4.27, 8.3 below 8.3.36, or 8.2 below 8.2.35. These branches have official fixed releases.
• PHP 8.1, 8.0 or 7.4. These are end-of-life. The PHP team published minimal source backports, so a host can patch them, but there is no official release to install.
• PHP 7.3 or older. No fix exists. The only remedy is moving to a supported branch.

Managed hosts can backport the fix without changing the version number, so a version string alone does not settle it. Automattic reports WordPress.com, WordPress VIP, WP Cloud and Pressable are protected. A self-managed server, a VPS, or a "we set it up once" agency install is only patched if someone patched it.

How to check

1. Run the free check. If your server advertises its PHP version in a response header, our check compares it with the fixed releases and tells you where it stands. Many servers hide the version, which is normal and does not mean you are safe.
2. Ask your host one question in writing: "Which PHP version serves my site, and have both PHP2Shell CVEs been patched on every worker?" Keep the answer.
3. On your own server, run php -v for the command-line version and check the version your web server actually uses (phpinfo or your control panel), because they can differ.

Run the free check

How to fix it

1. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your distribution's patched package. On PHP 7.4 to 8.1, apply the vendor backport or plan an upgrade to a supported branch.
2. Restart every PHP worker: PHP-FPM pools, Apache with mod_php, or the container. An updated package with old workers still running is still vulnerable.
3. Fix what the upgrade breaks. Deprecated functions, plugin fatal errors, session and upload handling can all break on a new PHP branch. Test the pages that take money first.
4. If you cannot patch today, CISA's guidance is to take the system offline, and CERT-EU recommends isolating internet-facing applications. Interim settings such as memory_limit=-1 (set so applications cannot override it) and session.upload_progress.enabled=0 reduce exposure but do not make a server safe.

If you think you were hit

• Patch first, then look for signs: files changed since 17 October, unfamiliar PHP files in uploads or cache folders, new administrator accounts, scheduled tasks you did not create, outbound traffic you cannot explain.
• Rotate every credential the server could reach: database passwords, API keys, mail credentials, admin logins. Assume anything stored on the server was readable.
• Do not clean by deleting the obvious file and moving on. This month's WordPress backdoors rebuild themselves from database entries and shared memory.

This is the work we take on. Scope and fee are agreed in writing first, and if we accept the job and cannot deliver the agreed fix, the service fee comes back.

Questions people ask

Is PHP2Shell being exploited in the wild?

Exploit attempts are in the millions and started before the patch existed. Several research teams report working exploits. No vendor had confirmed a successful compromise of a customer system as of 25 October 2026, and Sophos withdrew an earlier claim. The honest position is: actively attacked, not yet proven breached at scale.

Does updating WordPress fix PHP2Shell?

No. WordPress runs on PHP; the flaw is in PHP. Only updating the PHP runtime on the server, and restarting its workers, fixes it.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP 7.4 to 8.1 have source backports only. PHP 7.3 and older have no fix.

Can a website scanner tell me if I am patched?

Only partly. A scanner can read a PHP version if the server advertises one and compare it with the fixed releases. It cannot see a hidden version or a vendor backport, which is why our check reports that as "verify with your host" rather than guessing.