PHP2Shell: critical PHP vulnerabilities
Security · Oct 22, 2026 · Alert
On October 21, 2026, emergency patches were released for two critical PHP vulnerabilities, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10 (CVSS 4.0) and let an attacker run code on your server with no username or password.
What it is, in plain terms
The flaw isn't in your website or your application: it's in PHP, the engine that powers most of the world's websites. That means a site can be perfectly coded and still be vulnerable, because the problem lives one layer below.
An attacker can send a single malicious request to your site and get the server to run their commands. From there they can steal information, install malware, or take over the server. One of the flaws also allows reading the memory of PHP processes, where passwords, tokens, and API keys from other visitors may remain.
Who does it affect?
Practically any site that uses PHP: WordPress, WooCommerce, Joomla, Drupal, Magento, Laravel, and custom builds. It affects every way of running PHP (Apache mod_php, PHP-FPM, php-cgi, LiteSpeed, FrankenPHP), with mod_php the highest risk because the attack triggers before your application code even runs.
According to researchers, affected versions go back as far as PHP 5.4. Cloudflare and others already reported active exploitation attempts right after disclosure.
What you need to do (in order)
- Update PHP to a patched version. It's the only real fix.
- Restart the web service (Apache, PHP-FPM) after updating, or reboot the server.
- If your site is on managed hosting (SiteGround, managed cPanel, etc.), confirm with your provider that the patch is applied. Many do it automatically, but it's worth verifying.
Already-fixed PHP versions
- PHP 8.5 → 8.5.12
- PHP 8.4 → 8.4.27
- PHP 8.3 → 8.3.36
- PHP 8.2 → 8.2.35
PHP 8.1 and older no longer receive official updates. If you're on one of those, the priority is to plan a migration to 8.2 or newer. (Note: some hosts backport the patch and keep the same version number; in that case check the package changelog for the CVE IDs.)
Temporary mitigations (if you can't update yet)
These don't replace the patch, they only reduce risk while you update:
- For CVE-2026-109618: set
memory_limit=-1so applications can't override it, keeppost_max_sizelow, and limit request size at the web server. - For CVE-2026-109619: set
session.upload_progress.enabled=0and restart workers. On PHP 8.5, also setfatal_error_backtraces=0.
How to know you're protected
Check which PHP version your site runs (in cPanel/Site Tools it's usually under "PHP Manager") and compare it with the list above. If your provider says "it updates automatically," ask them to confirm the PHP2Shell patch is already applied.
Signs of a possible attack
- Unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses.
- Abnormally large
PHPSESSIDcookies. - Unexplained restarts of PHP processes.