Two critical PHP vulnerabilities, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), leaked on 20 October 2026 — two days before their planned disclosure. Both are rated CVSS 9.2 and can lead to remote code execution. PHP shipped the fixed versions — 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — on 21 October, ahead of schedule, together with the technical details. Here is who is affected and exactly what to do.
Quick answer
PHP2Shell is a pair of critical PHP bugs (CVE-2026-109618 and CVE-2026-109619) that can let an unauthenticated attacker run code on any PHP setup that serves web requests — PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distribution's patched package) right away and restart PHP. PHP 8.1 and older get no official update: move those sites to a supported version.
What is PHP2Shell?
PHP2Shell is the name given to two critical vulnerabilities in the PHP language itself — CVE-2026-109618 and CVE-2026-109619. The PHP security team scores both 9.2 on CVSS v4.0, and CERT-EU notes that a score this high points to remote code execution without authentication. That is the worst class of bug for a web server: an attacker who can reach a PHP site could run their own code on it.
PHP published the technical details together with the fix. They are two separate bugs:
- CVE-2026-109618 — RCE via out-of-memory corruption (GHSA-w8hw-w9fx-j79w): if PHP runs out of memory while a request is still being set up, the cleanup code can treat half-initialised internal data as valid.
- CVE-2026-109619 — RCE via stale global state (GHSA-6wmf-4rv5-p3rp): internal state that belongs to one request can outlive the memory behind it, and a later request handled by the same PHP worker may use it before it is reset.
PHP rates Apache with mod_php as the highest risk: there, a demonstrated exploit works from a single unauthenticated request before any application code runs — so it does not matter how well the site itself is written.
Timeline
- 20 October 2026 — the CVE identifiers and claims of a working exploit circulate publicly, ahead of a coordinated disclosure planned for 22 October. The PHP security team publishes an advance notice of an emergency release, and CERT-EU issues advisory 2026-018.
- 21 October 2026 — Cloudflare reports early attacks and ships WAF rules as a stopgap. The PHP security team releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 early, before the planned 14:00 UTC slot, with an advisory and full technical details.
- Security firms expect mass exploitation shortly after the patches land, because attackers can compare the fixed and unfixed code to find the bug.
Who is affected?
Any server that runs PHP — and that is most of the web: WordPress, WooCommerce, Joomla, Drupal, Laravel and Symfony apps, forums, billing panels and control panels. PHP says every installation that serves web requests is at risk — PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed — on every branch before the fixed versions. CERT-EU and early reports say the bugs go back as far as PHP 5.
What to do now
- Find every PHP version you run. Check
php -von the command line, the PHP selector in your control panel (DirectAdmin, cPanel, Plesk) and the version each site actually uses — one server often runs several. - Update to the fixed release. On supported branches that means 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux distributions and LTS vendors received the patches in advance, so use your distribution's updated packages where you can (
aptordnf). On DirectAdmin, update CustomBuild and rebuild PHP once it lists the new versions; on cPanel, update the ea-php packages. If you rely on the volunteer-run remirepo packages, PHP warns they will not be updated on release day — switch to distribution packages or build from source. Then restart PHP-FPM, or Apache if you use mod_php, so the new version is actually loaded. - Move sites off PHP 8.1 and older to a supported branch, and test them on the new version.
- Until you can patch, shield the site: put it behind a web application firewall (Cloudflare has published rules for the known attack paths), and take admin panels and non-essential sites off the public internet. CERT-EU advises isolating internet-facing PHP applications until a fix is applied.
- After patching, look for signs of compromise: unknown PHP files in upload folders, new admin accounts, unfamiliar cron jobs or outbound connections — especially on sites that were exposed before the fix.
Can't update for a few hours?
The PHP advisory lists stopgaps that reduce exposure to the known attack paths — and is explicit that they do not make an installation safe. Apply them in php.ini, the FPM pool or the server configuration (not with ini_set() or a .user.ini file), then restart every PHP worker:
session.upload_progress.enabled=0— blocks the confirmed session path of CVE-2026-109619 (other variants remain).- On PHP 8.5, also
fatal_error_backtraces=0— blocks the confirmed fatal-backtrace path. memory_limit=-1, set withphp_admin_valueso applications cannot override it, plus a lowpost_max_size(8M if the site takes no uploads, 32M if it does) — narrows CVE-2026-109618. Keep a container or cgroup memory limit as the safety net.- Request-size, field-count and header limits at the web server or proxy, and a web application firewall in front of the site.
Don't run random "PoC" exploits
Several repositories already claim to offer a working PHP2Shell exploit. Security researchers have not verified them, and fake proof-of-concept code is a common way to infect the very admins who download it. Test by patching, not by running strangers' exploits on your servers.
If your site is on shared hosting
On shared or managed web hosting, PHP itself is updated by the host — but you choose which version your site uses. Open the PHP version selector in your control panel and make sure the site runs a supported version (8.2 or newer), not 7.x or 8.1. For the bigger picture on keeping a PHP site safe, see how to secure a WordPress site and our cPanel/WHM authentication bypass write-up.
A leaked critical bug with a public patch is a race. The sites that update PHP in the first hours are the ones that never find out what PHP2Shell does.