The PHP2Shell vulnerability in the PHP runtime was patched on 21 October 2026, closing two flaws that allow unauthenticated remote code execution. The fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and both carry a CVSS v4.0 score of 9.2. PHP says updating is the only complete fix.
What the PHP2Shell Vulnerability Actually Is
PHP2Shell is not one bug but two memory-handling faults in the PHP runtime itself, which means a website is exposed even when its own code is written securely. PHP, the scripting language that runs most of the web’s server-side code, was patched for both on 21 October 2026.
- CVE-2026-109618, remote code execution via out-of-memory corruption: When PHP runs out of memory mid-request, it can stop while its internal request data is only partly set up. The cleanup routine then treats that half-built data as valid, which an attacker can steer into running their own code.
- CVE-2026-109619, remote code execution via stale global state: PHP can keep pointing at request data after the memory behind it has been released. A later request handled by the same worker process reads those dead references before PHP resets them — a use-after-free.
Security vendor Qualys reports that the second flaw also leaks the contents of PHP worker memory to an unauthenticated attacker, which can include passwords, authentication tokens and API keys. Researchers at Wiz, one of the parties PHP credited, described the pair as ranking “among the most severe vulnerabilities discovered in PHP”.
The name PHP2Shell comes from the researchers, not from PHP. The project’s own advisory does not use it.
The Four Releases That Fix It
Four supported branches received a fix, and three end-of-life branches received source patches only.
| PHP branch | Affected | What to install |
|---|---|---|
| 8.5.x | Everything before 8.5.12 | 8.5.12 |
| 8.4.x | Everything before 8.4.27 | 8.4.27 |
| 8.3.x | Everything before 8.3.36 | 8.3.36 |
| 8.2.x | Everything before 8.2.35 | 8.2.35 |
| 7.4.x to 8.1.x | Affected | No packaged release; minimal source backports from the PHP security team |
| 5.4.x to 7.3.x | Affected | No fix from the PHP project |
PHP 8.2 itself reaches end of life on 31 December 2026, so 8.2.35 buys time rather than a long-term position. According to Tenable’s write-up, the oldest affected code path traces back to PHP 5.4.0, released in 2012 — which is why the exposure reaches so far into older installations.
If your server runs distribution packages rather than builds from php.net, the version number may not match. Linux distributions and long-term-support vendors received the patches in advance, so check your vendor’s advisory for the package version that carries the fix.
Which Setups Are Most Exposed
Every PHP installation that serves web requests is affected, but the risk is not even across them. PHP’s advisory names Apache with mod_php as the worst case, saying it considers “the risk highest for mod_php, with a demonstrated exploit” that fires before any application code runs.
- Apache with mod_php: Highest risk. A single unauthenticated request can trigger the flaw before the site’s own code executes.
- PHP-FPM: Still needs patching. Its start-up behaviour blocks one out-of-memory path, but PHP says it validated session-lifecycle code execution against FPM under the right application conditions.
- php-cgi, FrankenPHP and LiteSpeed: Identified as at risk, with exploitability varying by configuration.
Because PHP is bundled inside so much other software, CISA warned that its “prevalence may not be directly observable”. John Hammond of security firm Huntress put the same point to The Register more bluntly: “The number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast.”
How to Check Which PHP Version You Are Running
Patch advice is useless until you know your starting point, and most coverage of PHP2Shell skips this step. Work through whichever of these applies to you.
- If you have shell access: Run php -v for the command-line version, then check the version your web server actually serves, which can differ. The served version is the one that matters.
- If you run WordPress: Open Tools, then Site Health, then the Info tab, and expand the Server section. The PHP version is listed there.
- If you use cPanel: Look in MultiPHP Manager or Select PHP Version to see the version assigned to each domain. Sites on one account can run different versions.
- If you have none of the above: Ask your host directly which PHP build your account is on and whether it carries the 21 October fix. Do not leave a temporary phpinfo page on a public site to find out.
- After updating: Restart PHP and the web server if you manage them yourself, then re-check the version. An update that has not been restarted into service has not taken effect.
If You Cannot Patch It Yourself
Many site owners cannot patch, because the PHP build belongs to their host. That does not leave you without options, but it does change what they are.
CISA’s alert of 21 October is blunt about the alternative to patching. For organisations that cannot update quickly, or that are still on PHP 8.1 or an earlier unsupported branch, it says they should “take PHP-based systems offline until they can be patched or updated”. CISA adds that a web application firewall “may provide some protection” in the meantime, and advises watching for PHP worker processes launching shells or downloading tools. The same pattern of urgency followed WordPress CVE-2026-87902, which CISA gave a fix deadline of 28 September 2026.
CERT-EU, which published advisory 2026-018 on both CVEs, took a similar line, telling organisations that where immediate patching is not feasible they “should consider isolating internet-facing applications”.
PHP’s advisory also lists partial mitigations, while stating plainly that they do not make an installation safe. They include setting memory_limit=-1 through server configuration rather than application code, holding post_max_size down to 8MB, disabling session.upload_progress.enabled, and, on PHP 8.5 only, setting fatal_error_backtraces=0. Each needs a worker restart to apply, and some will change how large file uploads behave on a working site — test before and after.
Hosting companies moved at different speeds. GoDaddy, for one, said its Managed Hosting for WordPress was patched across all PHP versions while its Web Hosting and Windows Hosting products were still waiting on packaged builds from a vendor. If you are on shared hosting, your host’s status page is the fact that governs your site, not PHP’s release notes.
Exploitation Status as of 22 October 2026
No successful compromise has been publicly confirmed. Attack attempts, however, began the same day as the patch.
CISA said that it “has not observed exploitation of these vulnerabilities as of the time of publication” on 21 October. Security firm watchTowr, which reproduced both bugs, reported no exploitation at 11:26 UTC that day and then active exploitation attempts by 14:19 UTC, minutes after the patch shipped. Jake Knott of watchTowr told The Register: “Whilst nobody has been successful to date, we don’t expect that will last long.”
Cloudflare enabled firewall rules for known exploit vectors by default on 21 October, including for free-tier customers, and its chief technology officer Dane Knecht said the company was “seeing early attacks emerging and are updating mitigations as new vectors show up”. Those rules only cover traffic routed through Cloudflare. The PHP Foundation said its security team inspected the proof-of-concept code circulating publicly and “did not identify any functional exploits at the time of release/public disclosure”.
Neither CVE had been added to CISA’s Known Exploited Vulnerabilities catalogue at the time of writing. That gap between disclosure and formal cataloguing is not unusual; Atlassian’s CVE-2026-21589 drew attack attempts within two hours while sitting outside the KEV list.
Several organisations took services down pre-emptively rather than wait. The Register reported that Finnish government services and websites went offline as a precaution, along with sites belonging to the Dutch parliament, Dutch cybersecurity authorities and the country’s data protection regulator, and that the privacy group noyb temporarily withdrew its own website.
Scale estimates vary and none is authoritative. W3Techs measures PHP at 69.3% of websites whose server-side language is known. Independent scans put internet-exposed PHP hosts at more than 1.3 million, by researcher Silas Cutler’s count, and above 1.9 million on Shodan data cited by Henk Poley.
How the Flaw Reached Release, and How It Leaked
PHP had not planned to publish on 21 October. The project gave advance notice on 20 October of a release the following day at 14:00 UTC, having originally scheduled it for 22 October, and moved it forward after the CVE identifiers leaked onto Hacker News and social media.
The leaked identifiers carried a CVSS score of 10.0. The PHP Foundation says that figure was wrong and that the correct score for both flaws is 9.2. The Hacker News also reported that a researcher published a working proof-of-concept video around 20:00 UTC on 20 October by mistake, before any patch existed, and that Cloudflare turned on its rules at 03:02 UTC and Chainguard shipped patched container images at 07:41 UTC — both ahead of the official release.
The uncomfortable part came afterwards. According to The Hacker News, the PHP Foundation said a core developer had seen signs of the memory flaw during an external audit in 2024 and that the fix then stalled for months, which the Foundation called “a structural failure”. PHP credited Calif, OpenAI and Wiz among the parties involved in the current disclosure; both Calif and Wiz have said they used AI models in the research. Patch cycles across the industry have been heavy this month, with Microsoft’s October 2026 Patch Tuesday alone fixing about 1,413 vulnerabilities.
Frequently Asked Questions
What Is the PHP2Shell Vulnerability?
PHP2Shell is the name researchers gave to two flaws in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0. Together they let an unauthenticated attacker run code on a web server, and one of them can also leak memory containing credentials and API keys.
Which PHP Version Fixes PHP2Shell?
Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on which branch you run. If your server uses distribution packages, the fixed package may carry a different version number, so follow your vendor’s advisory instead.
Is PHP2Shell Being Exploited?
Exploitation attempts began on 21 October 2026, the day of the patch, according to watchTowr and Cloudflare. No successful break-in had been publicly confirmed as of 22 October 2026, and CISA said it had not observed exploitation when it published its alert.
What if My Site Runs PHP 8.1 or Older?
There is no packaged release for PHP 7.4, 8.0 or 8.1; the PHP security team published source backports only. Branches from 5.4 to 7.3 get nothing. CISA’s advice for unsupported versions is to take those systems offline until they can be patched or upgraded to a supported branch.
Do I Need to Act if My Site Is on Shared Hosting?
You cannot install the PHP update yourself on shared hosting, so check your host’s status page or support channel to confirm whether its build carries the 21 October fix. Hosts patched at different times, and some products at the same company were patched before others.
