PHP2Shell (CVE-2026-109618 and CVE-2026-109619): What It Is and How to Fix It

What PHP2Shell is

PHP is the programming language behind a large share of websites. PHP2Shell is the name given to two flaws in how PHP itself handles memory. They were made public and fixed on 21 October 2026. Together they allow remote code execution. That means an attacker can send crafted web requests and then run their own commands on your server, with no login. Both are rated 9.2 on CVSS v4 (a 0 to 10 severity score).

Each flaw has its own CVE (the public ID number for a security flaw). Here is what each one does, in technical terms:

• CVE-2026-109618: when PHP runs out of memory, it can stop part-way through setting up request data. The cleanup step then treats that half-built data as valid.
• CVE-2026-109619: data from one request can survive after its memory is freed. A later request handled by the same worker may then use it.

PHP runs WordPress, online shops, custom apps and admin panels, so the number of sites at risk is very large.

Who is affected

Treat any server running an older PHP version as affected until you confirm otherwise. A patch is the vendor's fix for a flaw, and the table below shows the first fixed version for each branch. Security vendor Sophos reports that the PHP project sees Apache with mod_php as the highest-risk setup. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are also affected. Sources do not fully agree on the exact version range, so patch rather than try to argue your way out of it.

Is it being exploited?

Yes. Amazon's threat intelligence team saw an attack attempt on 17 October, four days before the flaws were made public. A researcher's honeypot (a decoy server set up to attract attackers) recorded working code execution on mod_php 8.4.26. GreyNoise reported at least six successful attacks. CISA, the US government's cyber defense agency, added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog on 26 October 2026. KEV is its public list of flaws used in real attacks.

A security firm has also claimed that a China-linked group used PHP2Shell together with a Linux flaw to break into 24 firewalls. Palo Alto Networks Unit 42 confirmed the attacker's tools. It could not confirm these PHP flaws were the way in, so treat that link as unconfirmed.

How to fix it

The fix is to update PHP. These steps are for whoever runs your servers or website.

1. Upgrade PHP to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later (the fixed release for your branch). Then restart PHP-FPM, Apache or your PHP runtime so the new version is actually loaded.
2. Check managed platforms: shared hosting, control panels and hosted app platforms ship their own PHP builds. Ask your provider which version you are running.
3. Rebuild container images from patched base images.
4. If you cannot patch today, the PHP team lists partial fixes: memory_limit=-1, a lower post_max_size and session.upload_progress.enabled=0. These reduce risk. They do not replace the upgrade.
5. Put a web application firewall in front of exposed PHP apps while you patch. This is a filter that blocks known attack traffic before it reaches your site.

Check whether you were hit

Updating PHP closes the hole, but it does not remove an attacker who is already in. If your PHP servers were online and not updated after 17 October, look for signs of a break-in:

• New or changed PHP files in web folders, especially small files with eval, base64_decode or system calls. These are web shells: hidden pages that give an attacker a back door.
• Unexpected processes started by the web server user, such as shells, curl or wget
• New cron jobs, SSH keys or user accounts
• Outbound connections from web servers to unfamiliar addresses
• Spikes in PHP memory errors or worker crashes in your logs

If you find anything, cut the server off from the network, keep the logs and rebuild it from a clean source. Our incident response plan template covers the steps, and you can contact us for hands-on help.

See the full list of vulnerabilities to patch now.