PHP2Shell (CVE-2026-109618 and CVE-2026-109619), How to Check and Patch Your PHP Servers

Saurav Jagdale

Technical Lead, Unico Connect

PHP2Shell is the name for two critical flaws in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619. Any PHP installation that serves web requests is open to unauthenticated remote code execution, per the PHP security advisory, so treat every such server as exposed until it runs a fixed build and every worker has restarted. In the words of the FBI Cyber Division on October 21, the flaws "could allow malicious cyber actors to remotely execute code in PHP core."

What PHP2Shell Is and Why Application Code Cannot Stop It

PHP2Shell is a PHP vulnerability made of two bugs in how PHP starts and cleans up each request. In CVE-2026-109618, out of memory handling can interrupt PHP while request data is only partly initialized, and cleanup may then treat the invalid data as valid. CVE-2026-109619 is a lifetime bug. Request state can outlive its freed memory, and a later request on the same worker may use it.

The worst outcome, confirmed in the PHP advisories, is unauthenticated remote code execution as the web worker account. The second flaw also discloses memory, and according to Wiz, one of the reporting teams, that alone could expose passwords, tokens and API keys with no code execution at all. Login checks will not save you. PHP processes the malicious request before any application code runs, so application level authentication cannot block the attack (Datadog security research, after reproducing both flaws).

Which PHP Versions Fix CVE-2026-109618 and CVE-2026-109619

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both flaws. Support ends December 31 of each year shown (PHP supported versions).

Table 1. Fixed PHP releases by branch, read October 22, 2026

We would treat any PHP older than 8.2 as vulnerable unless your vendor says otherwise.

The CVE records from PHP formally cover only 8.2 to 8.5. Other sources go further back. Calif and Wiz, two of the reporting teams, trace affected code to PHP 5.4. NVD now flags releases back to 7.3 for CVE-2026-109618, and back to 5.4 for the other one. And the AWS security bulletin? It lists PHP 5.4 to 8.1 with no upstream fix released.

Is My PHP Version Vulnerable, a 10 Minute Check

Your PHP is patched only if the runtime that answers web requests runs a Table 1 release or a vendor package naming both CVE IDs.

Every command below only reads. We checked that on throwaway containers, along with the output each step describes. First the code blocks, on October 22, 2026. Then every command in this section, the code blocks included, on October 24.

php -v
# Debian and Ubuntu, use your branch
/usr/sbin/php-fpm8.3 -v
sudo apache2ctl -M | grep -i php
# RHEL family and Amazon Linux
/usr/sbin/php-fpm -v
sudo httpd -M | grep -i php

# Debian and Ubuntu, use your branch
dpkg-query -W 'php*-fpm' 'libapache2-mod-php*'
zgrep 'CVE-2026-10961[89]' /usr/share/doc/php8.3-common/changelog.Debian.gz
# RHEL family
rpm -q --changelog php-fpm | grep 'CVE-2026-10961[89]'

docker ps --format '{{.Names}} {{.Image}}'
docker exec CONTAINER_NAME php -v

What to Patch First Across Your PHP Servers

Inventory comes first. List every system running PHP, including PHP bundled inside other software, and patch the internet facing ones before the rest (CISA alert), then work down Table 2, the order our cloud and DevOps team would follow on a mixed fleet. Finish rows 1 and 2 before anything else.

Table 2. Patch order for a mixed PHP fleet, read October 22, 2026

Give the inventory and the restart checks to one person, usually the DevOps engineer who already sees every host and image, and have them report three numbers to the business. How many hosts are patched and restarted? How many are offline or on interim settings? How many show a sign from the checklist below?

PHP2Shell Mitigations If You Cannot Patch Today

Only an update fully fixes PHP2Shell.

The PHP advisory is explicit that the steps below do not make an installation safe, and if a system cannot be updated now, or still runs PHP 8.1 or older, the CISA position is to take it offline until it is patched.

If the app takes no multipart form data, block it at the proxy, an option the CVE-2026-109618 advisory offers, but place a test order first, because some stores submit cart or checkout forms as multipart (Sansec). On PHP-FPM you can also set pm.max_requests=1 if performance is not a concern, per the CVE-2026-109619 advisory. Confirm each value in a request served by PHP-FPM. Once PHP is updated, put the memory limit back. Leave session upload progress off, though. On October 23, PHP suggested keeping it disabled until its next regular release, to block an unlikely related flaw, CVE-2026-115560.

Do not lean on a WAF here. One of the two flaws "is largely outside the reach of any web application firewall," according to AWS guidance on WAF rules, and requests sent straight to your origin skip an edge WAF anyway, so close the origin to direct traffic.

Table 3. What WAF vendors say they cover, read October 22, 2026

PHP2Shell on WordPress, WooCommerce and Headless Sites

Clicking Update in the WordPress dashboard will not touch this bug. It lives in PHP itself, so it reaches any server that hosts a PHP application. No WordPress update is required or planned (WordPress.org). WooCommerce runs on that same PHP, and Calif lists WordPress, Drupal and Magento among its demonstrated targets.

Going headless does not get you out of it. The storefront might be React or Next.js. The WordPress admin and REST API behind it still run on PHP, and that server needs the fix too.

So who updates PHP on your sites? It is a separate job from WordPress updates. Give it a named owner, whether that is your own team or WordPress developers you hire. Agencies, list every client site by host and PHP build. One forgotten VPS stays open. On GoDaddy managed WordPress hosting, PHP was patched with no customer action, while VPS customers update PHP themselves.

Signs a PHP Server Was Already Compromised

Look back to at least October 17, 2026, the day Amazon honeypots caught the first attempt. Patch every clean host now. A host that shows any sign below is a different job. Isolate it first. Before anyone patches or restarts it, copy its logs and take a disk snapshot. Then rebuild it from a clean image.

Quiet logs do not clear a host.

A successful attack can return HTTP 200 and leave the worker running (Datadog), and per the PHP advisory a missing error is not proof of safety. We would cast a wide net on secrets. Rotate the database passwords, API keys and session secrets the PHP worker could read on any host with a match, and on every internet facing host that ran unpatched PHP since October 17, because memory disclosure can leak them without code execution.

CVE-2026-109618 Exploitation Reports and Timeline

Amazon reported broad exploitation late on October 21, the same day Cisco Talos and CISA had seen none. By October 22, Talos was reporting attempts, mostly scanning, and Amazon had changed its wording to broad exploitation attempts. Times are UTC unless marked.

Table 4. PHP2Shell timeline, with who reported exploitation and when

Help With a PHP2Shell Response

Unico Connect builds WordPress and WooCommerce sites, and our cloud and DevOps team helps you inventory your PHP runtimes, confirm which carry the fix and patch the rest, starting with the free architecture and security review offered above. If you need a deeper audit, it is paid, and its scope depends on the scale of the project.

Frequently Asked Questions