The PHP2Shell vulnerability is a pair of critical flaws in the PHP core that can let an attacker run code on a web server without logging in. PHP released fixes on 21 October 2026, and the two bugs carry the IDs CVE-2026-109618 and CVE-2026-109619. If your website, shop or blog runs on PHP, this is the update to do today. This guide explains the PHP2Shell vulnerability in simple words, shows who is at risk and lists the steps to take.
What is the PHP2Shell vulnerability?
PHP2Shell is the name security researchers gave to two bugs that both lead to remote code execution (RCE). RCE means an attacker can make your server run commands that the attacker chooses. Here, a single request from the internet can trigger the attack before your own application code even starts.
- CVE-2026-109618: when PHP runs out of memory, it can stop while request data is only partly set up. Cleanup then treats the broken data as valid, and that opens the door to code execution.
- CVE-2026-109619: some internal request data can survive after PHP frees its memory. A later request on the same worker can then use that stale data before PHP resets it.
Who is at risk from the PHP2Shell vulnerability?
The PHP2Shell vulnerability can hit any PHP setup that serves web requests. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Setups that use mod_php face the highest risk. WordPress sites run on PHP, so owners of WordPress sites should check their PHP version right away.
Is the PHP2Shell vulnerability under attack?
Yes, attackers already probe for the PHP2Shell vulnerability. A working exploit exists. Amazon Threat Intelligence reported an exploitation attempt on 17 October 2026, four days before the public announcement, on its MadPot honeypot. It remains unclear how the attacker learned the details. Because of this, you should not wait for a convenient maintenance window.
Which PHP versions fix the flaws?
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Every fixed release closes the PHP2Shell vulnerability. Minimal source backports exist for PHP 7.4, 8.0 and 8.1, but the PHP project no longer supports 8.1 and earlier. If you run one of those versions, plan an upgrade to a supported release, or ask your Linux distribution or long-term support vendor for a patched package. Many distributions shipped patches before the public announcement.
How to fix the PHP2Shell vulnerability step by step
- Check your version with
php -v, and ask your host which version your site uses. - Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your distribution’s patched package.
- Restart PHP-FPM or your web server so the new version takes effect.
- Turn on a web application firewall. Cloudflare has deployed initial rules for known exploit routes, and they cover all plans, including free ones.
- Run the open-source php2shell-scanner from Searchlight Cyber to test your host for the PHP2Shell vulnerability.
- If you cannot patch at once, the UK NCSC advises taking the affected system offline until you can.
What about routers, firewalls and other products?
The PHP2Shell vulnerability also reaches products that ship PHP inside. As of 22 October 2026, Palo Alto Networks said that the flaws affect all PAN-OS and Panorama versions, and it had no fixed release yet. Fortinet and Cisco were still assessing their products. Check your vendor advisories regularly.
Key takeaways
- The PHP2Shell vulnerability covers two critical PHP flaws that let attackers run code without a login.
- Patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 today.
- Attackers tried the exploit four days before the public announcement.
- Use a firewall and a scanner while you patch, and take unpatchable systems offline.
FAQ
Do I need a login to exploit the flaws? No. An attacker needs no account on your site.
Is my WordPress site affected? Yes, if its server runs an unpatched PHP version. Ask your host to confirm the version, and update it.
Will a firewall alone stop the PHP2Shell vulnerability? A firewall adds a layer of defence, but it does not replace the patch. Update PHP as well.
Related reading: see our guides on Node.js security vulnerabilities and the Arista VeloCloud zero-day.
