Key Takeaways
- PHP2Shell is two critical flaws in the PHP engine: CVE-2026-109618 and CVE-2026-109619.
- Both PHP2Shell flaws carry a CVSS severity score of 9.2 out of 10.
- An attacker needs no login, only the ability to send a web request to the server.
- PHP fixed PHP2Shell on October 21, 2026, in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- PHP 7.4 to 8.1 have only source backports or vendor fixes. PHP 7.3 and older have no fix.
- Roughly a third of PHP sites still run PHP 7 or older, per W3Techs.
- CISA added both PHP flaws to its Known Exploited Vulnerabilities catalog on October 26, 2026.
- Updating WordPress, Drupal, or plugins does not fix PHP2Shell. Only a PHP update fixes PHP2Shell.
The PHP vulnerability known as PHP2Shell is a pair of critical flaws in PHP itself. Sites on PHP 8.2 or newer should update to the latest patch release and restart PHP today.
Sites on PHP 8.1 or older have no official fix and need a backport or an upgrade. CISA has confirmed attackers are exploiting PHP2Shell. This guide explains what PHP2Shell is, which versions are affected, and what to do now.
What Is the PHP2Shell Vulnerability?
PHP2Shell is a pair of critical flaws in the PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619. The flaws allow an attacker without an account to send a crafted web request to a PHP server. That request can expose server memory and, in some cases, let the attacker run commands. The fix is a PHP update, not a CMS update.
PHP is the programming language behind WordPress, Drupal, Joomla, Magento, and countless custom apps. W3Techs finds PHP on 69.3% of websites whose server-side language it can detect.
PHP2Shell starts when PHP runs out of memory while reading an upload. PHP can then skip its normal cleanup, leaving stale data behind. A PHP worker is a process that serves many requests in a row. The next request on that worker can reuse the stale data.
An attacker can use this flaw to read passwords, tokens, and API keys from server memory. In some cases, the attacker gains remote code execution, allowing them to run commands on the server from anywhere. PHP’s security advisory warns that the attack can trigger before any application code runs.
What Are CVE-2026-109618 and CVE-2026-109619?
CVE-2026-109618 and CVE-2026-109619 are the two official IDs behind PHP2Shell. A CVE is the public ID for a known security flaw. PHP rates both flaws 9.2 out of 10 on the CVSS v4.0 scale, which is critical. Both flaws allow unauthenticated remote code execution, so an attacker needs no account.
The Canadian Centre for Cyber Security classifies both as use-after-free flaws. In a use-after-free flaw, software continues to use memory after releasing it. PHP disclosed a related third flaw, CVE-2026-115560, on October 23 and plans to fix it in a regular release.
When Did PHP2Shell Start Being Exploited?
Attackers began probing for PHP2Shell on October 17, 2026, four days before PHP shipped a fix. Amazon’s honeypots, decoy servers built to attract attackers, recorded the first attempt. The CVE IDs then leaked online on October 20. PHP released fixed versions on October 21, and CISA confirmed active exploitation on October 26.
Sources: PHP Foundation, Amazon Threat Intelligence, Cloudflare, and CISA.
These dates set the starting point for a log review. Check server logs from October 17 onward, not from the day you patched.
Which PHP Versions Are Affected by the PHP Vulnerability?
Every PHP installation that serves web requests is at risk, according to PHP’s advisory. Wiz Research, which helped find the flaws, says every PHP version from the last decade is affected. PHP 8.2 and newer have official patches. PHP 7.4 to 8.1 have only backports, and PHP 7.3 and older have no fix.
PHP2Shell affects every common server setup: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. PHP rates the risk highest for mod_php.
For PHP 7.4, 8.0, and 8.1, the PHP security team published minimal source backports. The backports help teams that build PHP from source or lack a long-term support vendor.
Version numbers can be misleading. Linux distributions and hosting panels such as Plesk ship the fix without changing the version number. Ask for the build date or a changelog entry that names both CVEs.
The unsupported group is large. W3Techs reports that 26.9% of PHP sites run PHP 7 and 7.7% run PHP 5. Tomorrow, we’ll share our guide to checking your PHP version, which will show you how to confirm it.
Which PHP Releases Fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix PHP2Shell. PHP released all four on October 21, 2026. A vendor build whose changelog names both CVEs also counts. The update takes effect only after PHP restarts, so restart Apache, PHP-FPM, and any long-running workers. Then confirm the patched version is serving web requests.
Any running PHP workers keep old, vulnerable code in memory until they restart. A server can show the new version on the command line while the web server still runs the old one. Check the version your website serves, not just the version installed.
Has CISA Confirmed PHP2Shell Attacks?
On October 26, 2026, CISA added both PHP2Shell CVEs to its Known Exploited Vulnerabilities (KEV) catalog. The KEV catalog lists flaws with evidence of real-world attacks. US federal civilian agencies had until October 29 to fix PHP2Shell. CISA urges every other organization to treat the PHP2Shell fix as a priority.
CISA’s KEV announcement followed its October 21 alert. That alert told organizations on PHP 8.1 or older to take PHP systems offline until patched. CISA also flags PHP worker processes launching shells or downloading tools as a warning sign.
Amazon Threat Intelligence advises starting investigations from the earliest known exploitation. For PHP2Shell, that date is October 17.
Why Doesn’t Updating WordPress Fix the PHP Vulnerability?
Updating WordPress does not fix PHP2Shell because the flaw sits in PHP, beneath WordPress. A CMS update or security plugin changes the code that runs on top of PHP. PHP2Shell can fire before WordPress loads. WordPress’s own security team says no WordPress update is required or planned for PHP2Shell.
Wiz Research showed code execution before login on default WordPress, Drupal, and Joomla installs. The WordPress security notice confirms the flaws affect any server hosting a PHP application. Drupal’s advisory says a PHP update is the only complete fix.
PHP2Shell also reaches past the website. Any PHP software on a server is in scope:
- Custom apps built on Laravel or Symfony
- Database tools such as phpMyAdmin
- File sharing and webmail, such as Nextcloud and Roundcube
- Billing and support portals, such as WHMCS
- Internal wikis built on MediaWiki
CISA notes that PHP often sits inside other software, so teams may not know every PHP system they run.
Managed hosts such as WP Engine or SiteGround may have patched PHP already. In WordPress, find the PHP version under Tools, then Site Health, then Info, then Server. Ask the host to confirm the version and patch date in writing. Check back on Wednesday for a how-to on checking your WordPress site to see if it’s affected; it will cover what questions to ask.
What Should You Do About the PHP Vulnerability Now?
Start by identifying all PHP systems and checking which PHP version each serves. Patch internet-facing systems first, then restart PHP so the fix takes effect. On PHP 8.1 or older, apply a backport or take the system offline. Then review logs from October 17 and rotate any secrets on exposed servers.
- List every system running PHP, including staging sites, vendor portals, webmail, and internal tools.
- Confirm the PHP version and build that serve web requests, not just the command-line version.
- Patch internet-facing systems first, then restart Apache, PHP-FPM, and long-running workers.
- On PHP 8.1 or older, apply a vendor backport, or isolate the system until it is patched.
- Review logs from October 17 for unusual uploads followed by memory errors or HTTP 500 bursts.
- Watch for PHP worker processes launching shells or downloading tools.
- Rotate passwords, tokens, and API keys on servers exposed before patching.
Stopgaps buy time but do not fix PHP2Shell. PHP lists configuration changes, such as turning off session upload progress, that reduce exposure only. A cloud firewall, such as Cloudflare’s, only helps when all traffic reaches the server through it.
How Can Taazaa Help with PHP2Shell?
Taazaa helps teams find every PHP server, check for signs of compromise, and fix what the patch cannot. For PHP 8.2 or newer, PHP2Shell is a one-day job. For PHP 8.1 or earlier, the fix is more complex. Upgrading PHP can break older application code that was never built for newer versions.
Taazaa’s engineers can map every PHP server you run within 48 hours. The review checks for signs of intrusion since October 17 and ends with a ranked fix plan. If an application is too old to take the patch, Taazaa works with your team to upgrade or rebuild it.
Start with a quick look at where you stand. Check your domain free.
FAQs
What is the PHP vulnerability in 2026?
The PHP vulnerability in 2026 is PHP2Shell, a pair of critical flaws in the PHP engine. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, both rated 9.2. PHP2Shell allows an attacker without a login to read server memory. In some cases, the attacker can run commands on the server.
Which PHP versions are affected by PHP2Shell?
Every PHP installation serving web requests is at risk from PHP2Shell. PHP 8.2 through 8.5 have official patches. PHP 7.4, 8.0, and 8.1 have only source backports or vendor fixes. PHP 7.3 and earlier have no fix, so those sites need an upgrade or a rebuild.
What is the PHP2Shell fix?
The PHP2Shell fix is updating to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. After updating, restart PHP so the patched code runs. On PHP 8.1 or earlier, apply a vendor backport and plan an upgrade to a supported version. Configuration changes reduce exposure but do not fix PHP2Shell.
Does updating WordPress fix the PHP vulnerability?
Updating WordPress does not fix PHP2Shell because the flaw sits in PHP, which runs underneath WordPress. WordPress core and plugin updates never touch the PHP engine. WordPress says no update is planned for PHP2Shell. The host or server team must update PHP itself.
What should I do about the PHP vulnerability right now?
First, find every PHP server and check the PHP version each one serves. Next, patch internet-facing systems and restart PHP. On PHP 8.1 or earlier, apply a backport or take the system offline. Finally, review logs from October 17 and rotate secrets on servers exposed before patching.
