PHP2Shell Alert: Fix the Vulnerability Before Attackers Strike

PHP powers a large share of the web, from WordPress sites and online stores to custom business applications and APIs. In October 2026, researchers disclosed PHP2Shell, two critical vulnerabilities in PHP itself that can let attackers take control of a web server without logging in. Because the flaws sit in the PHP runtime rather than in a specific website or plugin, almost any business running PHP needs to check its servers and apply the fix. 

PHP published full details and fixes for two critical PHP2Shell vulnerabilities on October 21, 2026. Both received a critical score of 9.2 under the Common Vulnerability Scoring System (CVSS) version 4.0. Calif identified one flaw with help from OpenAI’s GPT-5.6 Sol model. Wiz independently discovered and reported both vulnerabilities. Wiz reports that at least one flaw affects PHP releases dating back to 5.4. 

The flaws can allow unauthenticated remote code execution (RCE). That means an attacker can run code on a server without signing in. Any PHP runtime that handles web requests may be affected. Teams can apply the PHP2Shell vulnerability fix by updating every live PHP runtime to a patched release or a vendor package containing both fixes. Teams should restart every worker and verify the active runtime after deployment.

Quick answer	Details
PHP2Shell CVE-2026-109618	Critical remote code execution risk caused by out-of-memory corruption.
PHP2Shell CVE-2026-109619	Critical RCE risk when a PHP worker reuses outdated data from an earlier request.
Affected deployments	PHP web request handlers, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed.
Fixed upstream versions	PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. For older or vendor-managed branches, confirm a backported fix with the PHP distributor.
Recommended action	Install a fixed release or verified vendor package, restart workers, and confirm the live runtime is patched.

Which PHP Versions Contain the PHP2Shell Fix?

The table above lists the official PHP releases that include the fixes. Linux distributions and hosting providers may also offer patched packages with different version numbers. Check the provider’s security notice or package changelog for both CVE IDs. Confirm the installed package includes the fixes before treating the server as patched.

The PHP project no longer issues security updates for PHP 8.1 and earlier. Teams on those branches need a vendor-supported backport or an upgrade to a maintained branch. PHP 8.2 security support ends on December 31, 2026. Plan a PHP2Shell PHP upgrade to a maintained branch before then to stay eligible for future security updates.

PHP branch	Affected range listed in the advisory	Fixed upstream release
PHP 8.5	Earlier than 8.5.12	8.5.12
PHP 8.4	Earlier than 8.4.27	8.4.27
PHP 8.3	Earlier than 8.3.36	8.3.36
PHP 8.2	Earlier than 8.2.35	8.2.35
PHP 8.1 and older	No branch-specific range listed in the PHP advisories	No regular upstream release. PHP published source backports for PHP 7.4 / 8.0 / 8.1.

Vendor packages: Check the provider’s security notice or package changelog for a package that contains both fixes. PHP published source backports for PHP 7.4, 8.0, and 8.1. Ask the provider if it offers a supported package for the branch. 

What Does PHP2Shell Allow?

PHP2Shell affects PHP’s request handling layer. PHP’s advisory describes an unauthenticated request through Apache mod_php that can trigger remote code execution before application code runs. A login check inside WordPress or another application may not protect this path because PHP processes the request first. 

Updating WordPress core or a plugin also leaves the PHP runtime unchanged. The PHP2Shell security patch therefore needs to be installed at the PHP runtime layer. This is separate from CMS and plugin updates.

Which PHP Systems Need Review?

Trace each website or API from its web server or load balancer to the PHP process that handles requests. Record the PHP package or image used by each production region, server group, container, and release slot. Include autoscaling templates so newly launched servers do not restore an older build.

php -v shows the PHP version used in the command line. The version that handles website requests may be different.

Managed hosting customers can ask which PHP runtime serves each domain and how the provider applies security updates. This helps teams identify production instances that still need the patch.

How to Apply the PHP2Shell Security Patch

Apply the PHP2Shell security patch through the package or deployment process that controls each live PHP service. PHP directs users with distribution packages to check their vendor for updated packages. Teams that need ongoing help with security updates can explore Teqnovos’s application maintenance services. 

Check the Installed PHP Version 

php -v

This command shows the command line version. The PHP runtime serving website requests may use a different version. 

Update PHP Packages 

Debian or Ubuntu with PHP 8.3 FPM 

sudo apt update

sudo apt install –only-upgrade php8.3-cli php8.3-common php8.3-fpm libapache2-mod-php8.3

RHEL or Fedora 

sudo dnf upgrade php php-cli php-fpm

Replace the example package names with the PHP packages installed on the server. Include the active web serving runtime and its installed extensions. The team checks the vendor security notice for a package revision that fixes both CVEs. Vendor package numbers may differ from upstream PHP release numbers. 

Rebuild Container Images

Teams using containers update the PHP base image or package in the build configuration. They publish a new image and redeploy each service that uses it. Updating the host does not change PHP inside a running container. 

For containerized PHP services, Teqnovos DevOps engineers can help rebuild the image and roll out the patched release.

Roll Out and Test

Deploy to one instance first. Restart the service that handles PHP requests: 

# PHP-FPM

sudo systemctl restart php8.3-fpm

# Apache mod_php

sudo systemctl restart apache2

Use the PHP-FPM command for requests handled by PHP-FPM. Use the Apache command for requests handled by mod_php. If both serve traffic on the instance, run both commands. Test application routes such as sign-in, file uploads, and API requests. Watch for application errors during the rollout. 

Verify the Update

Confirm each production instance uses the fixed package revision or container image. Confirm the relevant service is active after the restart. 

What Should Teams Running Older PHP Do?

An older version label does not confirm whether a package contains the PHP2Shell fixes. Teams using distribution packages or managed hosting need to check the vendor’s security notice and confirm that the deployed package addresses both CVEs.

Confirm a Vendor Fix

For an older PHP branch, the team asks whether the provider offers a supported backport. It checks that the PHP service serving the site runs that package. If the provider cannot confirm the backport, the team treats the runtime as unpatched.

If no supported backport is available, a PHP2Shell vulnerability fix service can help assess the upgrade path for the application. 

Plan a PHP Upgrade

Teams on PHP versions that no longer receive security updates need to move to a maintained branch. Older PHP applications often carry framework and extension dependencies that complicate upgrades. Teqnovos’s application modernization services can help teams map the work in stages. 

Plan the PHP2Shell PHP upgrade around the application’s framework and required extensions. For Laravel applications that need code changes during the upgrade, teams can hire Laravel developers to help update dependencies and prepare the codebase for a supported PHP branch. 

Test those dependencies in staging and record compatibility issues before setting the production date. If a legacy extension blocks the move, identify a supported replacement or get help maintaining the application.

Set a Support Deadline

PHP 8.2 reaches the end of upstream security support on December 31, 2026. Teams that use it for compatibility should schedule the upgrade before support ends. PHP’s supported versions page lists branch support dates and identifies end-of-life releases.

How to Verify the PHP2Shell Fix

A complete check confirms the package contains both fixes and every live web worker uses that package. A successful page load alone does not prove the PHP2Shell fix reached all serving instances.

Match the Package to the Advisory

Check the vendor’s security notice for PHP2Shell CVE-2026-109618 and CVE-2026-109619. Record the package release or build revision that includes both fixes. A vendor backport may leave the PHP version string unchanged, so the package record matters.

Inspect a Live Request

Use an authenticated internal diagnostic route to capture the PHP version handling a web request. Compare that result with the package record. Remove the route after testing. Avoid leaving a public phpinfo() page in place because it can expose server and configuration details.

Check Every Traffic Target

Inspect each active server or container behind the load balancer. Compare its package revision or image digest with the approved patched build. A public request may reach a patched instance while an older worker remains available to receive traffic.

Keep Verification Evidence

Record the advisory checked, package revision, image digest, test time, and serving instances reviewed. Also check the deployment template used for new instances. This gives the operations team a clear record and helps prevent an older image from returning during scale-out.

PHP2Shell Mitigation: Interim Settings While a Patch Is Delayed 

These settings reduce exposure to specific attack paths. They do not make PHP safe. Only an update or a vendor package with the fixes provides a complete solution.

• CVE-2026-109618: Set memory_limit=-1 in a configuration the application cannot override, such as php_admin_value. Set post_max_size to 8M when uploads are not needed or 32M when they are. Keep upload_max_filesize below that value. Use a container or cgroup limit as an availability boundary. Do not use RLIMIT_AS or RLIMIT_DATA.
• CVE-2026-109619: Set session.upload_progress.enabled=0 in php.ini or server configuration that applies before request parsing. Restart every worker. Do not rely on ini_set() or FPM .user.ini. This blocks confirmed session paths but does not cover other variants.
• PHP 8.5: Also set fatal_error_backtraces=0 and restart every worker. This blocks only the confirmed fatal backtrace path.

What to Do if a PHP2Shell Patch Is Delayed

An extension conflict or release window may delay the update. The team should treat the PHP2Shell security risk as urgent. PHP says no complete mitigation exists and updating is the only safe choice. Temporary controls only reduce exposure.

Set an Owner and Fix Date

The application owner names one person to manage the delay. That person records the blocker and sets a date for the next decision. The owner escalates the issue to the platform team or hosting provider.

Limit Access

If operations allow, take the service offline until it is patched. For services that remain online, the team limits access to approved networks or users. These controls reduce exposure but do not fix PHP2Shell.

Follow Verified Guidance

The application owner asks the PHP vendor or host for guidance tied to the affected package and both CVEs. The team applies a WAF rule only after the vendor or security team validates it for this flaw. A generic WAF rule does not replace the update.

Keep the Issue Open

The assigned owner tracks the temporary restriction and sets a review date. The issue stays open until the patched runtime is deployed and verified. If the provider misses the target date, the owner escalates to the security lead and business owner.

How to Check for Possible Compromise

Clean application logs do not rule out PHP2Shell activity. One attack path can run before application code starts. Another can use data left by an earlier request. Some warning paths may not appear in PHP logs. 

1. Compare Logs

The security team builds a timeline around the suspected activity.

• It reviews web server records for unusual multipart requests with many parts or headers.
• It checks PHP logs for memory errors or fatal errors. It also checks for startup failures and timeouts.
• It compares upload progress records with later requests handled by the same worker when the logs identify that worker.

These patterns can guide an investigation. They do not confirm an attack.

2. Inspect Server Activity

The team compares process and file activity with the service’s normal pattern.

• It checks for Apache or PHP workers that start unexpected shells or tools such as sh or curl.
• It reviews outbound connections made by PHP processes to unfamiliar addresses.
• It looks for new scripts in writable upload or temporary folders. It also checks for new scheduled tasks, SSH keys, or accounts.

3. Isolate the Instance

If the findings point to code execution, the security team limits access to the affected instance.

• The team removes the instance from public traffic and restricts access to nearby systems.
• It saves available logs. It also preserves a disk snapshot and process or network data before replacing the instance.
• The team records the timeline and response actions. If activity continues, it contains the instance promptly and preserves the evidence still available.

NIST recommends balancing containment with evidence preservation during incident response. 

4. Review Access and Recover

The team checks which systems and secrets the PHP process could reach. 

• It identifies database credentials and cloud or storage keys the process could access.
• A clean administrative workstation is used to revoke or rotate credentials that may be exposed. The team also invalidates affected sessions.
• The security team reviews connected systems and restores a confirmed compromised service from a trusted image.

After recovery, the team can request application security testing to review weaknesses beyond the PHP runtime. 

PHP2Shell Vulnerability Remediation Checklist

The security owner closes the work item after checking every deployment path.

• The production and staging inventory includes every domain and region. It also includes failover and canary targets.
• No inactive server group or deployment slot remains eligible to receive traffic.
• Container and autoscaling records point to the approved deployment.
• The hosting provider confirms coverage for each managed domain and runtime pool.
• Every remaining exception has an owner and a review date.

How Teqnovos Helps You Fix PHP2Shell

Patching PHP on a live server can affect the customers and teams who rely on it every day. Teqnovos handles the full PHP2Shell response, so your systems are protected without breaking the features your business depends on.

• Exposure assessment: We identify every PHP runtime serving your websites, applications, and APIs, including containers and managed hosting.
• Emergency patch deployment: We update supported PHP versions to the fixed releases with minimal downtime.
• Interim protection: Where an immediate update isn’t possible, we apply PHP’s recommended mitigation settings and access controls.
• Legacy PHP upgrades: We move applications on PHP 8.1, 7.x, or older to a supported branch, updating code, frameworks, and extensions along the way.
• Compatibility testing and verification: We test critical workflows after patching and give you a clear record of what was fixed and what still needs attention.

Conclusion

A PHP2Shell vulnerability fix addresses the immediate risk. Keeping PHP supported takes a plan for what comes next. Teams that need help assessing legacy PHP environments can work with Teqnovos to plan upgrades around their application needs.