PHP2Shell (CVE-2026-109618 and CVE-2026-109619), How to Check and Patch Your PHP Servers

Saurav Jagdale

Technical Lead, Unico Connect

PHP2Shell is the name for two critical flaws in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619. The PHP security team says they can allow unauthenticated remote code execution on any PHP installation that serves web requests, and the FBI Cyber Division warned on October 21 that they "could allow malicious cyber actors to remotely execute code in PHP core."

What PHP2Shell Is and Why Application Code Cannot Stop It

PHP2Shell is a PHP vulnerability made of two bugs in how PHP starts and cleans up each request. In CVE-2026-109618, out of memory handling can interrupt PHP while request data is only partly initialized, and cleanup may then treat the invalid data as valid. In CVE-2026-109619, request state can outlive its freed memory, and a later request on the same worker may use it. The PHP security team confirms unauthenticated remote code execution as the web worker account, plus memory disclosure for the second flaw. Wiz, one of the reporting teams, says that could expose passwords, tokens and API keys without code execution.

Datadog reproduced both flaws and found that application level authentication cannot block an attack, because PHP processes the malicious request before any application code runs.

Which PHP Versions Fix CVE-2026-109618 and CVE-2026-109619

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both flaws. Support ends on December 31 of each year shown, per the PHP supported versions page.

Table 1. Fixed PHP releases by branch, read October 22, 2026

The CVE records from PHP formally list only 8.2 to 8.5, but Calif and Wiz, two of the reporting teams, trace affected code back to PHP 5.4, and NVD flags every release before 8.2.35. Treat any older PHP as vulnerable unless your vendor says otherwise. The AWS security bulletin also lists PHP 5.4 to 8.1 with no upstream fix released.

Is My PHP Version Vulnerable, a 10 Minute Check

Your PHP is patched only if the runtime that answers web requests runs a Table 1 release or a vendor package naming both CVE IDs. Every command below only reads.

php -v
# Debian and Ubuntu, use your branch
/usr/sbin/php-fpm8.3 -v
sudo apache2ctl -M | grep -i php
# RHEL family and Amazon Linux
/usr/sbin/php-fpm -v
sudo httpd -M | grep -i php

# Debian and Ubuntu, use your branch
dpkg-query -W 'php*-fpm' 'libapache2-mod-php*'
zgrep 'CVE-2026-10961[89]' /usr/share/doc/php8.3-common/changelog.Debian.gz
# RHEL family
rpm -q --changelog php-fpm | grep 'CVE-2026-10961[89]'

docker ps --format '{{.Names}} {{.Image}}'
docker exec CONTAINER_NAME php -v

What to Patch First Across Your PHP Servers

CISA tells organizations to inventory every system running PHP, including PHP bundled inside other software, and to patch internet facing systems first. Finish rows 1 and 2 before anything else.

Table 2. Patch order for a mixed PHP fleet, read October 22, 2026

Give one person, usually the DevOps engineer who sees every host and image, the inventory and restart checks. That person gives the business three counts, hosts patched and restarted, hosts offline or on interim settings, and hosts showing a sign from the checklist below.

PHP2Shell Mitigations If You Cannot Patch Today

Only the update fully fixes PHP2Shell. CISA says systems that cannot be updated now, or that run PHP 8.1 or older, should go offline until patched.

If the app takes no multipart form data, the CVE-2026-109618 advisory suggests blocking it at the proxy, but Sansec warns that some checkouts post as multipart, so test first. Sansec also says to confirm each value in a request served by PHP-FPM and to restore the memory limit after you update. For PHP-FPM, the CVE-2026-109619 advisory adds pm.max_requests=1 if performance is not a concern.

AWS warns that one of the two flaws "is largely outside the reach of any web application firewall," and requests sent straight to your origin skip an edge WAF, so close the origin to direct traffic.

Table 3. What WAF vendors say they cover, read October 22, 2026

PHP2Shell on WordPress, WooCommerce and Headless Sites

A WordPress or WooCommerce site is exposed through the PHP underneath it, and Calif lists demonstrated attacks on WordPress, Drupal and Magento. WordPress.org confirms that the flaws affect any server that hosts a PHP application and that no WordPress update is required or planned. On a headless build the storefront may run on React or Next.js, but the WordPress admin and REST API still run on PHP, so that server needs the fix too.

Whoever keeps core, themes and plugins updated, your own team or WordPress developers you hire, still has to update PHP separately. Agencies should list every client site by host and PHP build, since one forgotten VPS stays open. GoDaddy patched PHP on its managed WordPress hosting, but VPS customers update PHP themselves.

Signs a PHP Server Was Already Compromised

Amazon advises looking back to October 17, 2026, when its honeypots saw the first attempt. Patch every host now, but isolate any host that shows a sign below, copy its logs and take a disk snapshot before you patch or restart it, then rebuild it from a clean image.

Datadog found that a successful attack can return HTTP 200 and leave the worker running, and the PHP advisory says a missing error is not proof of safety. So rotate the database passwords, API keys and session secrets the PHP worker could read, on any host with a match and on every internet facing host that ran unpatched PHP since October 17, because memory disclosure can leak them without code execution.

CVE-2026-109618 Exploitation Reports and Timeline

Amazon reported broad exploitation late on October 21, the same day Cisco Talos and CISA reported none. Times are UTC unless marked.

Table 4. PHP2Shell timeline, with who reported exploitation and when

Help With a PHP2Shell Response

Unico Connect builds WordPress and WooCommerce sites, and our cloud and DevOps team helps you inventory your PHP runtimes, confirm which carry the fix and patch the rest, starting with a free architecture and security review. It covers 1 to 2 business days of work from our team, and we share the initial findings with you. If you need a deeper audit, it is paid, and its scope depends on the scale of the project.

Frequently Asked Questions