PHP2Shell: PHP Security Release Fixes Two Critical RCE Flaws (October 2026)

In brief

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026, fix CVE-2026-109618 and CVE-2026-109619, the pair now widely called PHP2Shell: two critical (CVSS 9.2) flaws that can let an unauthenticated attacker run code on any server that handles web requests with PHP. Every earlier version is affected and there is no complete workaround. Update every PHP runtime you operate, restart the PHP workers, and check the version your web server actually runs.

2 - critical remote code execution flaws: CVE-2026-109618 and CVE-2026-109619
9.2 - CVSS v4.0 base score for each, rated critical
4 - supported branches patched: PHP 8.5, 8.4, 8.3 and 8.2
0 - complete workarounds: updating is the only full fix

The PHP project published a coordinated security release on 21 October 2026, a day earlier than planned, after the vulnerability identifiers and a proof-of-concept video leaked online on 20 October. The security community has since named the pair PHP2Shell, so expect that name in vendor advisories, scanner results and news coverage. The PHP Foundation said no working exploits had been seen at release time.

Update, 23 October 2026

PHP2Shell is now being exploited. watchTowr reported exploitation in the wild on 21 October, the day the fixes shipped. As of 22 October neither CVE was in CISA’s Known Exploited Vulnerabilities catalog, so do not wait for that listing: treat every unpatched internet-facing PHP server as an active target.

Which PHP versions fix the vulnerabilities

BranchFixed versionSupport statusPHP 8.58.5.12Active support until 31 Dec 2027PHP 8.48.4.27Active support until 31 Dec 2026PHP 8.38.3.36Security fixes only, until 31 Dec 2027PHP 8.28.2.35Security fixes only, end of life on 31 Dec 2026PHP 8.1 and olderNo fix from the PHP projectEnd of life: only distribution or LTS vendor backports

Every version below these is affected. PHP 8.6.0 RC4, the current pre-release, carries the same fixes.

The two vulnerabilities in plain English

💥 CVE-2026-109618: code execution through out-of-memory corruption

If a request runs out of memory at the wrong moment, PHP can be left holding partly initialised internal data and later treat it as valid, which corrupts memory.
An attacker can push a request into that state with crafted multipart form uploads, before any application code runs.
Confirmed: remote code execution over HTTP against Apache with mod_php, using default limits.

🧟 CVE-2026-109619: code execution through stale global state

A fatal error or a timeout at the wrong point can leave internal state pointing at memory that has already been freed.
The next request handled by the same worker can then use that memory: a use-after-free that can leak data or run code.
Confirmed: remote code execution on mod_php, and on PHP-FPM through the session upload progress feature, which is on by default.

Both are scored 9.2 rather than 10 because exploitation needs precise timing and depends on the build and memory layout. Neither needs an account or any user interaction. The 10.0 score in the early leaked reports was wrong.

Who is most at risk

SetupCVE-2026-109618 (out of memory)CVE-2026-109619 (stale state)Apache with mod_phpConfirmed RCE, unauthenticated, before application code runsConfirmed RCEPHP-FPM (Nginx, Apache proxy)Vulnerable code path; no complete exploit shown yetConfirmed RCE through session upload progressFrankenPHPLikely affected (source analysis)No early trigger found in the default configurationLiteSpeed (LSAPI)Likely affected through application-specific pathsPossibly affectedCommand-line scripts and cron jobsNot covered by the advisoriesNot covered by the advisories

Treat anything that serves web requests with PHP as exposed, and Apache with mod_php most of all. Command-line scripts that never handle untrusted requests are far less exposed, but they usually share the same packages, so update them in the same change.

PHP applications and CMSs to check

The flaws are in PHP itself, so no CMS, plugin or theme update fixes them. Every site built on these platforms is exposed until the PHP running it is on a fixed release. Use the table to find the PHP version each one reports, then update the server, or ask your host to.

ApplicationWhere to see its PHP versionWhat to check*WordPress and WooCommerceTools → Site Health → Info → ServerMost sites run on shared or managed hosting: confirm with your host that PHP is on a fixed releaseJoomlaSystem → System InformationExtension and core updates do not fix this; the server PHP must be updatedDrupalReports → Status reportCheck every environment, including staging sites reachable from the internetMagento / Adobe CommerceCommand line, or the version-check file aboveRuns on PHP-FPM; update the web pools and the cron and queue-consumer runtimePrestaShopAdvanced Parameters → InformationShops accept uploads, so blocking multipart requests is rarely an optionMoodleSite administration → Server → EnvironmentUniversities often run older PHP; check that the branch is still supportedNextcloudAdministration settings → SystemDocker and appliance installs need a rebuilt image or a vendor updateMediaWikiThe Special:Version pageLong-lived wikis often sit on old servers; check for PHP 8.1 or olderTYPO3System Information in the backend toolbarCheck the version the web server reports, not only the command lineCraft CMSUtilities → System ReportManaged hosting and containers each need their own updatephpBBAdministration Control Panel → GeneralForums on long-forgotten shared hosting are easy to missLaravel and Symfony apps*php artisan about or bin/console aboutThese show the command-line version; check the web runtime separately

Agencies and multi-site owners

List every site you look after with its host and PHP version, and work through the list in order of exposure: public sites on Apache with mod_php first, then PHP-FPM, then internal tools. A spreadsheet with a "patched and verified" column is enough to show clients what was done.

How the disclosure unfolded

2024: first signs in an external audit

A security audit by Quarkslab, organised by OSTIF and funded by the Sovereign Tech Agency, surfaced the first signs of the out-of-memory problem.

11 August 2026: reported as remote code execution

Researchers at Calif and OpenAI independently reported an unconditional RCE with the same root cause. Wiz and OpenAI reported further attack paths in August and September.

20 October: identifiers and a proof of concept leak

CVE IDs circulated online with a wrong release time and a wrong score of 10.0, and a proof-of-concept video was published by mistake. PHP brought the release forward by a day.

21 October, 07:41 UTC: embargo broken

Patched container images were published more than six hours before the coordinated release.

21 October, 14:00 UTC: public release

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were published together with both security advisories.

21 October: exploitation in the wild

watchTowr reported attacks against its honeypot network the same day the fixes were released. The flaws became widely known as PHP2Shell.

What to do now: patch, restart, verify

Check the command-line version, and whether it is patched:

# Command-line version
php -v

# Prints "patched" or "NOT patched"; exit code 0 when patched (PHP 8.2 to 8.5)
php -r '$fixed = ["8.2" => "8.2.35", "8.3" => "8.3.36", "8.4" => "8.4.27", "8.5" => "8.5.12"];
$branch = PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION;
$ok = isset($fixed[$branch]) && version_compare(PHP_VERSION, $fixed[$branch], ">=");
echo PHP_VERSION, $ok ? " patched\n" : " NOT patched\n";
exit($ok ? 0 : 1);'

The version your web server runs can differ from the command line. Check it with a temporary file and delete it straight away:

<?php
// version-check.php: upload, open once in the browser, then delete.
echo PHP_VERSION, ' (', PHP_SAPI, ')';

For containers, check the image you actually deploy:

# Rebuild from the updated base image, then confirm the version inside it
docker build --pull -t my-app .
docker run --rm my-app php -v

If you cannot update today: partial mitigations

Interim only

These settings reduce exposure while you schedule the update. None of them is a fix. Set them in the server configuration (php.ini or the PHP-FPM pool), not in .htaccess or application code, then restart every worker.

SettingWhat it doesLimitssession.upload\_progress.enabled = 0Blocks the demonstrated session attack path for CVE-2026-109619Other stale-state paths remain. Upload progress bars stop workingfatal\_error\_backtraces = 0 (PHP 8.5)Removes the trigger used in the confirmed mod_php exploit of CVE-2026-109619Other request state is still affectedmemory\_limit = -1Removes the predictable per-request memory limit the confirmed exploit of CVE-2026-109618 relies onAllocation failures can still reach the flaw, and one request can use unbounded memory: pair it with host or container memory limitsBlock multipart/form-data at the proxyRemoves the main known trigger for CVE-2026-109618Only possible where the application accepts no form uploadsLower post\_max\_size, max\_input\_nesting\_levelReduces out-of-memory and denial-of-service risk from crafted requestsDoes not prevent exploitationpm.max\_requests = 1 (PHP-FPM)Each worker handles one request, so stale state cannot carry overLarge performance cost

; Interim hardening only. Updating is the only complete fix.
; Set in php.ini or the PHP-FPM pool configuration, then restart every worker.
session.upload_progress.enabled = 0
fatal_error_backtraces = 0     ; PHP 8.5 only
memory_limit = -1              ; only together with host or container memory limits

Some common reflexes do not help. Changing error\_reporting, using the @ operator, or turning off display\_errors or log\_errors does not protect against either flaw. Avoid RLIMIT\_AS and RLIMIT\_DATA process limits as well: they make memory allocation fail, which is exactly the path the first flaw uses.

Still on PHP 8.1 or older?

The PHP project no longer releases PHP 8.1 or older, but for this flaw its security team published minimal source patches for PHP 7.4, 8.0 and 8.1 (branches named PHP--CVE-2026-109618-109619), for those who build PHP themselves. Distributions and LTS vendors received the fixes in advance, so check for updated packages first. PHP 5.4 to 7.3 have no fix from the PHP project: isolate those systems from untrusted traffic and plan the upgrade now.

PHP 8.2 reaches end of life on 31 December 2026, ten weeks from this release. If you are patching an 8.2 system today, schedule its move to PHP 8.4 or 8.5 in the same planning cycle. Our overview of PHP 8.3 and later covers what changes on the way.

Questions leaders should ask their team today

Five questions for today

Is every PHP runtime we operate, including containers, CI and vendor systems, on 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later?
Were PHP-FPM and Apache restarted after the update, and did we check the version through the web server?
Which systems still run PHP 8.1 or older, and what is the plan for them?
Have we checked the logs since 20 October for worker crashes and memory-exhausted errors?
Who owns PHP version upgrades, so the next security release is a routine change rather than an emergency?

A release like this is also a good moment to review the rest of your PHP baseline. Our guides to secure PHP settings and essential PHP security practices cover the configuration and code-level controls that limit the damage when the runtime itself has a flaw.

Application security

Need help patching or checking your PHP estate?

We can inventory your PHP runtimes, roll the update out without downtime, and review your configuration and code for the weaknesses an attacker would try next.

Book a free 30-minute call