# PHP2Shell Vulnerability: What Website Owners Must Patch Right Now

By [Eoin Villarin](https://amvprosox.com/about). Published 2026-10-29. Canonical: https://amvprosox.com/blog/php2shell-php-vulnerability-website-owners

> Two critical PHP flaws now exploited in the wild let attackers take over web servers. Here is what to patch, what to ask your host and how to check your site.

## What is the PHP2Shell vulnerability and how do I fix it?

The PHP2Shell vulnerability is two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution on servers running PHP for websites. PHP fixed them on October 21, 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and CISA confirmed active exploitation on October 26. Update PHP, restart workers and check for compromise.

**Key takeaways**

- PHP released fixes for CVE-2026-109618 and CVE-2026-109619 on October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Both PHP2Shell flaws are rated 9.2 on CVSS v4.0 and allow unauthenticated remote code execution on PHP installations that serve web requests.
- CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities catalog on October 26, 2026 and set an October 29 deadline for federal agencies.
- PHP 8.1 and older receive no official PHP2Shell release, and PHP 8.2 reaches end of life on December 31, 2026.
- Updating WordPress or plugins does not fix PHP2Shell, because the flaw is in the PHP runtime itself.

The PHP2Shell vulnerability is a pair of critical flaws in PHP itself that let an attacker run code on a web server without logging in. PHP shipped fixed versions on October 21, 2026, and on October 26 the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed the bugs are being exploited in real attacks. If your website or store runs on WordPress, WooCommerce, Magento, Drupal, Laravel or any other PHP software, your server needs the update now.

This guide is for US small business owners, ecommerce brands and agencies who run PHP sites and need to know what to check, what to ask their host and what to fix this week. You get the patched version numbers, a plain-English explanation of the risk, interim protections and a step-by-step checklist.

Facts below come from the official [PHP security advisory](https://www.php.net/archive/2026.php), the [CISA alert](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) and the researchers' own reports, linked next to each claim. This post is general information, not legal advice or a security audit of your specific setup.

## PHP2Shell at a Glance

| Item | Detail |
| --- | --- |
| CVE IDs | CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale request state) |
| Severity | CVSS v4.0 score of 9.2 for each, per PHP |
| Impact | Unauthenticated remote code execution on the web server |
| Affected setups | PHP serving web requests: Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed |
| Fixed versions | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (released October 21, 2026) |
| Unsupported versions | PHP 8.1 and older get no official release, only source backports and vendor packages |
| CISA status | Added to the Known Exploited Vulnerabilities catalog on October 26, 2026 |
| Federal deadline | October 29, 2026 for US federal civilian agencies |

## What Is the PHP2Shell Vulnerability?

PHP2Shell is the name researchers gave to two memory-safety bugs in the PHP engine. According to the [PHP advisory](https://www.php.net/archive/2026.php#2026-10-21-5), the first (CVE-2026-109618) happens when out-of-memory handling interrupts PHP while request data is only partly set up, so cleanup code later treats broken data as valid. The second (CVE-2026-109619) lets internal request state survive after its memory has been freed, so the next request handled by the same worker can use that stale state.

The important part for business owners is where the bug lives. It is in PHP, the language runtime, not in WordPress or a plugin. The PHP team says the risk is highest with Apache mod_php, where an unauthenticated request can trigger the attack before any application code runs. That means a fully updated WordPress site on an unpatched server is still exposed.

![Wiz Research diagram of the PHP2Shell vulnerability used for remote code execution against WordPress, Drupal and Joomla](https://amvprosox.com/api/img/1793276930833-ovj59t)
*Wiz Research's diagram of PHP2Shell attacks against popular PHP applications. Image: Wiz*

### Who found it and how

[Wiz Research says](https://www.wiz.io/blog/php2shell-php-rce) it found the first bug on August 19, 2026 with help from frontier AI models and reported the issues to the PHP security team on August 24. Wiz says it demonstrated unauthenticated code execution against the latest container images of WordPress, Drupal and Joomla. Wiz also describes a memory disclosure path that it says works regardless of the application, which could leak secrets such as environment variables and database passwords.

Not every researcher agrees on how easy real-world attacks are. [Sansec reports](https://sansec.io/research/php2shell) that the public proof-of-concept exploits do not work against a default PHP installation and that most need an extra bug in the target application. That debate matters less than it sounds, because CISA has now confirmed exploitation in the wild.

## Is PHP2Shell Being Exploited Right Now?

Yes. On October 26, 2026, CISA [added both CVEs to its Known Exploited Vulnerabilities catalog](https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog). Under Binding Operational Directive 26-04, federal civilian agencies had to secure their systems by October 29. CISA says the directive does not bind private companies but encourages every organization to prioritize catalog entries.

Attacks also started early. Amazon Threat Intelligence said attackers began targeting the flaws four days before the patches shipped, [BleepingComputer reports](https://www.bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks/), and several security firms reported attempts before disclosure. Wiz estimates PHP runs about 70% of websites, so automated scanning for unpatched servers is the realistic threat for small business sites, not targeted hacking.

![Wiz diagram showing how the PHP2Shell vulnerability can leak environment variables, database passwords and API keys](https://amvprosox.com/api/img/1793276931439-7c7hg4)
*Wiz says the memory disclosure path can expose secrets held by the PHP process. Image: Wiz*

## Which PHP Versions Fix PHP2Shell?

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP project says Linux distributions and long-term support vendors received the patches in advance, so their packages may carry the fix under a different version string. That is common on Ubuntu, Debian and Red Hat servers, where the vendor backports security fixes without changing to the upstream number.

### What if you run PHP 8.1 or older?

PHP 8.1 and older no longer receive releases from the PHP project. The team published minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build PHP themselves, but CISA's advice is blunt: take PHP systems offline if they cannot be patched right away or if they run PHP 8.1 or earlier. Also note that [PHP 8.2 reaches end of life on December 31, 2026](https://www.php.net/archive/2026.php), so a site patched to 8.2.35 today still needs a version upgrade within two months.

### The follow-up flaw: CVE-2026-115560

On October 23, PHP published an informational advisory for a related issue, CVE-2026-115560, in session upload progress handling. It only applies to an unusual combination of configuration and code, and PHP says it will be fixed in the regular release cycle. [Cloudflare notes](https://blog.cloudflare.com/php-vulnerabilities-waf-protection/) it affects fully patched releases too, so the upload progress setting below is worth changing even after you update.

## Interim Protection If You Cannot Patch Today

The PHP advisory is clear that workarounds reduce exposure but do not make a server safe. In its words, "only an update is a complete solution". If an update has to wait a few hours, these steps buy time:

- **Disable session upload progress** by setting `session.upload_progress.enabled=0` in php.ini, the FPM pool or the server config, then restart every PHP worker. PHP warns not to rely on `ini_set()` or an FPM `.user.ini` file for this.

- **Lower request size limits**: PHP suggests a low `post_max_size` (8M if you do not need uploads, 32M if you do) with `upload_max_filesize` below it.

- **Turn on a web application firewall.** CISA says a WAF may offer interim protection. Cloudflare says it deployed managed rules on October 21 in both its free and paid rulesets, but customers who changed `session.upload_progress.name` are not covered.

- **Watch for warning signs.** CISA recommends monitoring for PHP worker processes that launch shells or download tools. Wiz adds unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses and oversized or malformed `PHPSESSID` cookies.

## What PHP2Shell Means for Your Website

For most US small businesses the fix is not hard, but it sits in a place many owners never look: the server. Here is the checklist I am running for client sites this week, in order.

- **Find the PHP version your site actually uses.** In WordPress, go to Tools, Site Health, Info, Server. In cPanel or Plesk, check the PHP version manager. The command line version can differ from the one serving web pages, so check the web version. Never leave a public `phpinfo()` page online.

- **Ask your host in writing.** On managed WordPress or cloud hosting, the provider usually patches PHP. Ask whether your server has the October 21 fix for CVE-2026-109618 and CVE-2026-109619, and get a yes with a date. On a VPS or dedicated server you own, patching is your job.

- **Update PHP, then restart PHP-FPM or Apache.** Move to 8.3.36, 8.4.27 or 8.5.12 where your code allows. If you are on 8.1 or older, treat the upgrade as urgent, and test plugins and themes on a staging copy first.

- **Apply the upload progress setting** even after patching, because of CVE-2026-115560.

- **Put a WAF in front of the site.** Cloudflare's free plan, Sucuri or your host's firewall add a layer while you patch and afterward.

- **Check for compromise.** Look for new admin users, unknown PHP files in upload folders, changed core files, odd scheduled tasks and spikes in 500 errors since October 17. A malware scan is a start, not proof.

- **Rotate secrets if the server was exposed.** Change database passwords, API keys, payment gateway keys, SMTP credentials and WordPress salts in `wp-config.php`, because the memory disclosure path targets exactly those values.

- **Keep the rest of the stack current.** Updating plugins does not fix PHP2Shell, but plugin bugs are how attackers chain attacks. My guide to [stopping WordPress plugin vulnerabilities](https://amvprosox.com/blog/wordpress-security-plugin-vulnerabilities-2026) covers that side.

- **Confirm backups work.** Make sure you have an offsite backup from before October 17 and that you have tested a restore.

### Does PHP2Shell affect Shopify and other hosted platforms?

On fully hosted platforms such as Shopify, Squarespace or Wix, the platform runs and patches the servers, so there is nothing for you to update on the server side. The exposure is on self-hosted or managed PHP stacks: WordPress, WooCommerce, Magento (Adobe Commerce), Drupal, Joomla, PrestaShop and custom Laravel or Symfony apps. If you are weighing that trade-off, my comparison of [Shopify vs WordPress and WooCommerce](https://amvprosox.com/blog/shopify-vs-wordpress-woocommerce-2026) explains who owns maintenance on each.

### If customer data may have been exposed

If you find signs of compromise on a store that handles customer details, bring in your developer and your lawyer quickly. State data breach notification laws and your payment processor's rules may require you to act within set timeframes, and the details depend on your state and what data was involved.

## Frequently asked questions

### Does updating WordPress fix PHP2Shell?

No. PHP2Shell is a flaw in the PHP runtime, not in WordPress, WooCommerce or any plugin. Updating WordPress and plugins is still good practice, but the only complete fix is updating PHP to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a vendor package that includes the October 21, 2026 patch, then restarting PHP workers.

### How do I know if my host has patched PHP2Shell?

Check your PHP version in WordPress Site Health or your hosting panel, then ask support directly whether the server includes the fixes for CVE-2026-109618 and CVE-2026-109619. Linux vendors often backport fixes without changing the upstream version number, so a written confirmation from your host is more reliable than the version string alone.

### Is a web application firewall enough to stop PHP2Shell?

No. CISA says a WAF may give interim protection, and Cloudflare deployed rules on October 21, 2026, but both CISA and PHP treat patching as the real fix. Firewall rules can miss unusual configurations, and Cloudflare says sites that changed the session upload progress name are not covered by its rule.

### What should I do if my site runs PHP 7.4 or 8.1?

Plan an upgrade now. The PHP project no longer releases updates for 8.1 and older, and CISA advises taking unpatchable PHP systems offline. Your host or Linux vendor may offer a backported package as a stopgap. Test themes, plugins and custom code on a staging copy, then move to PHP 8.3 or newer.

### Do I need to change passwords after PHP2Shell?

If your server ran an unpatched PHP version that was reachable from the internet, rotating secrets is a sensible precaution. Wiz says the memory disclosure path can expose environment variables, database passwords and API keys. Change database credentials, payment and API keys, email passwords and WordPress salts after you patch.

## Patch PHP2Shell Before Someone Else Finds Your Server

PHP2Shell is one of the most serious web server flaws of 2026 because it sits underneath most of the web. The fix is a version update and a restart, but only if someone checks the server, confirms the patch, closes the gaps and looks for signs of an earlier break-in.

If you run a WordPress, WooCommerce, Magento or Laravel site and are not sure where your PHP version stands, [send me a message](https://amvprosox.com/#contact-form) and I will check your server, patch it or coordinate with your host, and set up monitoring so you are covered next time. You can see the kind of maintenance and rebuild work I do in my [case studies](https://amvprosox.com/case-studies). I will reply within 24 hours.