If your website, online store or web app runs on PHP, this one needs your attention today. PHP2Shell is the nickname for two critical flaws in the PHP runtime itself, not in a plugin or theme. This guide explains how to find out whether you are affected, how to check your real PHP version, and how to patch safely.
- PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026 to close two critical remote code execution flaws, both rated CVSS v4.0 9.2.
- Update PHP itself, then restart PHP-FPM or your web server so the new version actually loads.
- Updating WordPress, Laravel or a plugin does not update the PHP runtime underneath it. That comes from your server package, host or container image.
What Is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?
PHP2Shell covers two vulnerabilities in how PHP handles memory while processing a web request.
- CVE-2026-109618: involves out-of-memory handling. PHP may interrupt a request while internal data is only partly set up, then handle that data wrongly during cleanup.
- CVE-2026-109619: involves stale internal state that survives after its memory is freed, so a later request handled by the same worker can use that leftover data.
According to watchTowr, both flaws can let an attacker run code on a web server without logging in. That is why the severity is so high: the attacker does not need an account on your site.
PHP says every PHP installation serving web requests is at risk, with Apache setups using mod_php carrying the highest risk. Industry experts have compared the situation to Log4Shell.
Is Your PHP Version Affected?
Compare your version with this table:
| PHP Branch | Vulnerable | Fixed In |
|---|---|---|
| 8.5 | Below 8.5.12 | 8.5.12 |
| 8.4 | Below 8.4.27 | 8.4.27 |
| 8.3 | Below 8.3.36 | 8.3.36 |
| 8.2 | Below 8.2.35 | 8.2.35 |
| 8.1 and older | All versions | No official release |
Things to know:
- The flaws affect nearly all PHP releases going back to version 5.4.
- PHP published minimal source backports for 7.4, 8.0 and 8.1, but these are not official releases. Treat them as a stopgap and plan an upgrade.
- PHP 8.2 itself reaches end of life on December 31, 2026, so plan a move to 8.3 or newer.
- Older PHP 5.x and 7.x applications are often legacy systems, for example older CodeIgniter projects. If yours is one of them, a planned website redesign and maintenance project is usually safer than staying on an unsupported version.
Is PHP2Shell Being Exploited?
The picture changed quickly, so here is the timeline:
- Early on October 21, watchTowr reported no exploitation in the wild, and neither CVE was in CISA’s Known Exploited Vulnerabilities catalog at that time.
- Several security companies later reported exploitation attempts, including some before the patches were released.
- Patchstack says the flaw is being actively exploited and lists multiple confirmed incidents.
Treat any unpatched, internet-facing PHP server as exposed. The flaws can also be used to read sensitive process memory, which may hold credentials, API keys and other secrets.
How to Check Your PHP Version
This is where many people go wrong. Use the method that matches your setup.
Option 1: WordPress dashboard
Go to Tools → Site Health → Info, expand Server, and note the PHP version and SAPI.
Option 2: Hosting control panel
Open your hosting panel (cPanel, Plesk or your host’s dashboard) and look for PHP version, MultiPHP Manager or PHP Config. On shared hosting, you can also ask your host whether the 21 October 2026 PHP security update has been applied.
Option 3: Server (command line)
php -v
Warning: this shows the command-line PHP only. A command-line version alone cannot establish the PHP version used by web requests, and the two can be separate installs with their own versions and settings. Also check the PHP-FPM binary (for example php-fpm8.3 -v) or use WordPress Site Health.
The backport trap
Linux distributions often backport a fix without changing the version number. For example, Ubuntu 24.04’s fixed package still reports PHP 8.3.6. So a low version number does not always mean vulnerable. On Debian or Ubuntu, check the package changelog for the CVE numbers:
apt changelog php8.3-fpm | grep -i CVE-2026-109618
Replace php8.3-fpm with the package you actually use. If the CVE appears in the changelog, the fix is installed.
How to Patch PHP2Shell, Step by Step
- List every PHP environment: production, staging, APIs, internal tools and Docker images. Updating one server does not fix the others.
- Back up your files and database.
- Test on staging first if you use older plugins or custom code.
- Install the update using the method below.
- Restart PHP. Restart PHP-FPM or the web server so the new interpreter is loaded. Also restart long-running PHP workers such as queue workers or Laravel Octane, because a process started before the update keeps running the vulnerable code.
- Verify the version through a real web request (WordPress Site Health, for example), not just php -v.
Patch status on common platforms
Tanium’s tracker lists fixes for Ubuntu 22.04, 24.04, 26.04 and 26.10, Debian 12 and 13, Docker official php images (tags 8.5.12, 8.4.27, 8.3.36, 8.2.35) and cPanel EasyApache 4 (version 25.91). Ubuntu 20.04 is fixed only for Ubuntu Pro subscribers. Always confirm with your own vendor.
Ubuntu / Debian
sudo apt update
sudo apt upgrade
sudo systemctl restart php8.3-fpm # use your PHP-FPM service name
Docker: pull or rebuild with a fixed official tag (for example php:8.3-fpm at 8.3.36 or newer), then redeploy your containers.
Shared hosting: you usually cannot patch PHP yourself. Ask your host to confirm the patched package, or switch the PHP version in the control panel.
What This Means for WordPress, Laravel and E-commerce Sites
- WordPress: a WordPress or plugin update will not fix this. The fix is at the PHP level. If you are not sure who manages your server, our WordPress development team can audit your PHP version and plugin compatibility before you upgrade.
- Laravel: update PHP on the server or container, then restart queue workers and Octane. Our Laravel development team can help with framework compatibility.
- WooCommerce, Magento and OpenCart stores: these run on PHP too. Stores handle customer and payment data, so patch them first. See our WooCommerce, Magento and OpenCart development services if you need hands-on help.
- Custom PHP apps: a dedicated PHP development partner can test your code on a newer PHP version without breaking features.
If You Cannot Patch Today
- A WAF helps but does not replace the patch. Vendors describe WAF rules as a bridge, and only the patch closes the issue for good.
- Do not rely on one setting. Turning off session.upload_progress is not enough, and sites that disabled it still need to update.
- Reduce exposure. If a system cannot be fixed promptly, consider taking it offline until it is fully mitigated.
- On PHP 8.1 or older: move to a supported version. If you cannot, ask your host or OS vendor for a verified backport.
After Patching: Check for Signs of Compromise
Because exploitation started before patches were available, patching alone may not be enough.
- Review web server, PHP-FPM and application logs for unusual requests, errors and unfamiliar processes.
- Look for unexpected PHP files in uploads, cache and other writable folders.
- Rotate secrets (database passwords, API keys, .env values) on any server that was exposed while unpatched.
- Keep a tested backup you can restore.
- Hacked sites often get spam pages or malware warnings in Google. A technical SEO audit can help you find and clean up that damage.
Frequently Asked Questions
Q. What is PHP2Shell?
Ans. It is the name used for two critical PHP runtime vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution.
Q. Does updating WordPress fix PHP2Shell?
Ans. No. The flaw is in PHP, not in WordPress. You must update the PHP version on your server or hosting account.
Q. How do I check if my PHP version is vulnerable?
Ans. Compare your PHP version with the fixed versions (8.5.12, 8.4.27, 8.3.36, 8.2.35) using WordPress Site Health or your hosting panel. On Debian or Ubuntu, also check the package changelog for the CVE numbers, since fixes may be backported.
Q. I updated PHP. Why might I still be vulnerable?
Ans. You may not have restarted PHP-FPM or the web server, or the web server may use a different PHP install than the one php -v shows.
Q. Is PHP 8.1 safe to keep using?
Ans. No official fix exists for PHP 8.1 and older. Use a verified vendor backport as a temporary measure and upgrade to a supported version.
Q. Will switching PHP versions break my site?
Ans. It can, if a plugin, theme or custom code does not support the newer version. Test on staging first.
Conclusion
PHP2Shell is a runtime-level problem, so the real fix is a PHP update plus a restart, followed by a quick check for signs of compromise. Start with internet-facing sites and stores, then work through staging servers and Docker images.
Need help auditing PHP versions across your websites, upgrading safely, or setting up ongoing security updates? Check our website maintenance packages, explore our web development services, or contact the Xelogic team.
Further reading (external):
- Dark Reading: PHP2Shell overview
- The Hacker News: emergency PHP patches
- Tanium: patch status by platform
- Konfirmity: PHP2Shell advisory
Radhika Lohmod
I'm Radhika Lohmod, Senior Content Specialist at Xelogic Solutions, and I specialize in creating high-quality content across various domains to help businesses connect with their audience.
