Quick Summary: Two critical vulnerabilities in the PHP engine itself (CVSS 9.2) allow unauthenticated remote code execution on almost any web server running PHP. The only complete fix is to upgrade immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 (or apply vendor backports) and restart all PHP workers.
Introduction
On 21 October 2026 the PHP project released emergency security updates for two critical flaws, publicly known as PHP2Shell. Tracked as CVE-2026-109618 and CVE-2026-109619, both carry a CVSS v4.0 score of 9.2 and affect every PHP installation that handles web requests—going back more than a decade to PHP 5.4.
Because the bugs live in the PHP runtime (memory management and fatal-error handling) rather than in application code, frameworks such as WordPress, Magento, Drupal, Laravel, Symfony, Joomla and many others are exposed even when their own code is fully patched. Attackers can trigger the issues with a single crafted HTTP request before any application logic runs. Exploitation attempts were observed in the wild both before and after the patches landed.
This guide explains what the vulnerabilities are, who is affected, how to confirm your exposure, and the exact steps required to remediate them.
Prerequisites
Before applying the fix, make sure you have:
- Administrative (root or sudo) access to the server
- Ability to install or upgrade PHP packages (or build from source)
- SSH or console access so you can restart PHP-FPM, Apache, or the relevant service
- A recent backup of critical data and configuration files
- Knowledge of which PHP version(s) and SAPI(s) (mod_php, PHP-FPM, php-cgi, etc.) are running on the host
How do you determine if your PHP installation is vulnerable?
Check the currently running PHP version and the SAPI in use:
php -v
php -i | grep -E 'Server API|PHP Version'Any version earlier than the fixed releases listed below is vulnerable:
| Branch | Vulnerable if earlier than | Fixed version |
|---|---|---|
| 8.5 | 8.5.12 | 8.5.12 |
| 8.4 | 8.4.27 | 8.4.27 |
| 8.3 | 8.3.36 | 8.3.36 |
| 8.2 | 8.2.35 | 8.2.35 |
Older branches (8.1, 8.0, 7.4, etc.) received limited source backports from the PHP project, but official binary packages are only guaranteed for the four supported branches above. Check your Linux distribution or hosting provider for backported packages.
All SAPIs that serve web requests are affected: Apache with mod_php (highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
Comparison of Available Options
| Approach | Completeness | Performance / Operational Impact | Recommended Use Case |
|---|---|---|---|
| Upgrade to fixed PHP release | Full | Minimal once done | Production and all internet-facing hosts |
| Vendor LTS / distro backport | Full | Minimal | Environments locked to older PHP |
| Temporary mitigations (see below) | Partial | Can reduce resource limits or break upload-progress features | Stop-gap only while preparing the upgrade |
| Isolate the application | High | High (service downtime) | When immediate patching is impossible |
Only the first two options fully close the vulnerabilities.
Step-by-Step Configuration Guide
- Identify every PHP instance
Inventory all servers, containers and hosting accounts that run PHP. Include secondary environments (staging, CI, control panels, etc.). - Obtain the fixed packages
- Official source: https://www.php.net/downloads
- Most Linux distributions and cloud providers received the patches in advance; use your normal package manager (apt, dnf, yum, etc.).
- Example on Ubuntu/Debian (adjust version numbers as needed):
sudo apt update sudo apt install php8.3 php8.3-fpm # or the matching package set for your branch - Apply the upgrade
Install the new packages. Confirm the version afterwards:php -v - Restart all PHP workers
Old processes continue running the vulnerable code until they are recycled:# PHP-FPM sudo systemctl restart php8.3-fpm # Apache mod_php sudo systemctl restart apache2 # Or the equivalent for your stack - Verify the fix
Re-check the version and, if possible, confirm that temporary mitigations are no longer required. - (Optional temporary mitigations while preparing the upgrade)
These reduce but do not eliminate risk:; php.ini or pool config session.upload_progress.enabled = 0 ; on PHP 8.5 also: fatal_error_backtraces = 0Restart workers after changing these settings. Settingpm.max_requests = 1(PHP-FPM) further limits same-worker reuse. Do not rely on these measures long-term.
Frequently Asked Questions (FAQ)
What causes the PHP2Shell vulnerabilities?
CVE-2026-109618 is an out-of-memory (OOM) corruption issue: when a request hits the memory limit at a critical moment, PHP can leave partially initialised internal data that is later treated as valid. CVE-2026-109619 is a stale-global-state / use-after-free problem that leaves pointers to memory belonging to a previous request. Both can be turned into unauthenticated remote code execution and, in some cases, process-memory disclosure.
Can this approach be used in production environments?
Yes. The official fixed releases are production-ready. Apply them as soon as possible; the risk of active exploitation is already high.
Do I need to change any application code?
No. The flaws are in the PHP engine itself. Updating the runtime is sufficient.
What if I cannot upgrade immediately?
Apply the temporary mitigations listed above, restrict network access to the PHP application if feasible, and monitor for unusual process behaviour or unexpected outbound connections. Treat this as a short-term measure only.
Conclusion
PHP2Shell is one of the most severe PHP vulnerabilities in more than a decade because it lives in the core runtime and requires no authentication. The only reliable defence is to upgrade to a fixed version (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or a vendor backport) and restart every PHP worker. After patching, continue normal security hygiene—keep PHP and your applications up to date, monitor for compromise indicators, and treat any unpatched internet-facing PHP host as high-risk until the upgrade is complete.
