PHP2Shell: What WordPress, Magento And PHP Site Owners Need To Do Now

PHP2Shell is the name for two critical remote code execution flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, and the fix is to update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart every PHP worker. Both flaws are rated 9.2 on CVSS v4.0, both can be triggered by an unauthenticated request before any of your application code runs, and attackers have been probing for them since before the patch shipped on October 21, 2026. Because the bug lives in the PHP engine, updating WordPress, Magento, Drupal or your plugins does not fix it. The PHP runtime on your server has to change.

This guide is for people who own or run PHP websites: WordPress and WooCommerce store owners, Magento merchants, agencies managing client sites and in-house teams running Laravel, Symfony or custom PHP. It covers what PHP2Shell is, which versions are affected, how to tell whether your site is patched, what to do if you cannot patch today and how to check for signs that someone got in first.

PHP2Shell At A Glance

Item	Details
Name	PHP2Shell (also written php2shell)
CVE IDs	CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state)
Severity	Critical, CVSS v4.0 score of 9.2 for each
Impact	Unauthenticated remote code execution on the web server
Affected	PHP 5.4 through 8.5.11, every server setup that handles web requests
Fixed versions	8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21, 2026
Exploitation	Public proof-of-concept code exists and both CVEs are in the CISA Known Exploited Vulnerabilities catalog
Related	CVE-2026-115560, a third PHP flaw disclosed October 23, with a configuration mitigation and no patch yet

What Is PHP2Shell?

PHP2Shell is a pair of memory safety bugs in how PHP behaves when something goes wrong partway through handling a request, especially when a request runs out of memory. Details leaked online on October 20, 2026, ahead of the planned coordinated disclosure, and the PHP project responded by pushing out fixed releases the next day. The PHP security team’s security advisory is the primary source for the technical details.

What makes PHP2Shell unusual is where it sits. Most PHP security problems you read about are in a plugin, a theme or an application’s own code. These two are in the language runtime, so a site can be written perfectly and still be vulnerable.

CVE-2026-109618: Out-Of-Memory Corruption

PHP enforces its memory_limit setting by aborting any request that goes over it. If that abort happens while PHP is still setting up request data, for example while it is parsing a form upload, the data is left half built. PHP’s cleanup routine then treats that half-built data as valid and tries to free memory that was never properly set up. An attacker who controls what was in that memory before can turn the mistake into code execution. The PHP project tracks this one as GHSA-w8hw-w9fx-j79w.

CVE-2026-109619: Stale Global State

PHP keeps some internal state that belongs to a single request. After certain failures, such as a fatal error, that state can outlive the memory behind it. When the same PHP worker picks up the next request, it can read that stale state before normal setup resets it, and that gap is enough for code execution. PHP’s session upload progress feature, which is on by default, is one confirmed route to this flaw, and fatal error backtraces on PHP 8.5 are another. The PHP project tracks this one as GHSA-6wmf-4rv5-p3rp.

What About CVE-2026-115560?

On October 23, 2026, the PHP project disclosed a third remote code execution flaw, CVE-2026-115560. PHP says it only affects applications configured in an unusual way and considers it a low likelihood risk, so it will not ship an emergency release. The full advisory will come with the next regular release. Until then, the recommended protection is to turn off session upload progress, which you should do anyway (see the mitigations section below).

Which PHP Versions Are Affected By PHP2Shell?

Treat every unpatched PHP version as affected. The PHP team says any installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php as the highest risk setup, so those servers should be patched first.

PHP branch	Affected	Fixed in	Notes
8.5	Every release before 8.5.12	8.5.12	Also disable fatal error backtraces until patched
8.4	Every release before 8.4.27	8.4.27	None
8.3	Every release before 8.3.36	8.3.36	None
8.2	Every release before 8.2.35	8.2.35	Reaches end of life on December 31, 2026
8.1, 8.0, 7.4	All	No official release	Minimal source backports published; vendor or LTS fixes may exist
7.3 and older (back to 5.4)	All	No official release	Upgrade or get a vendor backport

If you are still on PHP 8.1 or older, PHP2Shell is a strong reason to finally move. The PHP security team published small source backports for 7.4, 8.0 and 8.1 because of how serious these bugs are, but those are for teams that compile PHP themselves. Everyone else should upgrade to a supported branch or ask their Linux distribution or long-term support vendor for a patched package.

Is PHP2Shell Being Exploited?

Yes, attackers are actively trying. Here is how the first two weeks played out:

• October 20, 2026: Details of both flaws leak online before the coordinated disclosure. The PHP project publishes an advance notice.
• October 21, 2026: PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 13:30 UTC. Cloudflare reports exploitation attempts the same day and later rolls out firewall protection for sites behind it, including on its free plan.
• October 23, 2026: PHP discloses the related CVE-2026-115560.
• October 26, 2026: CISA adds CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog. Multiple public proof-of-concept exploits are circulating.
• Late October 2026: Palo Alto Networks’ Unit 42 reports more than 22.6 million exposed instances that are potentially vulnerable.

Public, confirmed break-ins have been slower to appear than scanning activity. Unit 42 linked one attack on a European government agency to PHP2Shell and then withdrew that link on October 25 because it could not confirm the entry point. That is not a reason to wait. Mass scanning, public exploit code and a CISA listing are exactly the conditions under which unpatched small business sites get compromised.

Am I Affected? A Quick Check By Hosting Type

Almost every WordPress, WooCommerce, Magento, Drupal, Joomla, PrestaShop, Laravel and Symfony site runs on PHP. Whether the fix is your job depends on how you host.

Shared Or Managed Hosting

If you are on shared hosting or a managed WordPress or Magento host, your provider runs PHP for you and is responsible for patching it. Check your host’s status page or announcements for PHP2Shell, and if you see nothing, open a support ticket and ask directly whether PHP on your plan has been updated to a fixed release or a vendor-patched build. If your control panel lets you choose a PHP version, pick the newest supported branch. If you are not sure how good your host’s security response is, our list of managed WordPress hosting providers is a starting point for comparing alternatives.

VPS, Dedicated Server Or Cloud Instance

If you or your developer manage the server, the patch is yours to apply. That includes servers managed through cPanel, Plesk or similar panels, which often run several PHP versions side by side. Every one of them needs updating, not just the default.

Containers And CI Images

If you deploy PHP in Docker or another container platform, rebuild your images from a patched base and redeploy. Patching a running container leaves the image underneath exposed, and the next deploy brings the bug back.

Software That Bundles PHP

Some commercial and open source products ship their own copy of PHP, including some appliances, admin panels and Windows tools that include php.exe or php-cgi.exe. The Dutch National Cyber Security Centre keeps a list of affected third-party software on GitHub. Check it for anything you run.

How To Patch PHP2Shell

1. Find every PHP installation. Include parallel PHP branches, staging servers, containers, CI images and any PHP bundled inside other software. The UK NCSC advises not limiting the search to old PHP versions, since every unpatched release is affected.
2. Update to a fixed release. Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your Linux distribution’s patched package. Distributions and long-term support vendors received the patches in advance, and they often backport fixes without changing the version number.
3. Restart every worker. Restart PHP-FPM, Apache and any long-running PHP processes, or redeploy containers. An old worker left running is still vulnerable, and CVE-2026-109619 specifically abuses state carried between requests in the same worker.
4. Keep session upload progress off. Set session.upload_progress.enabled=0 in php.ini or your FPM pool configuration and leave it that way after patching. Very few sites use this feature, and it is also the protection against CVE-2026-115560.
5. Prioritize by exposure. Internet-facing servers first, starting with any running Apache mod_php, then internal systems.

If you use the Remi repository (rpms.remirepo.net) on Red Hat style systems, note that PHP said it would not have updates on release day. Check its current status, or switch to your distribution’s packages.

How To Check That Your Site Is Patched

Do not rely on php -v alone. It reports the command-line PHP, which can be a different build from the PHP-FPM pool or Apache module actually serving your website. Instead:

• Check the package changelog for the CVE IDs. On Debian or Ubuntu, run apt changelog php8.3-cli | grep -E "CVE-2026-109618|CVE-2026-109619" (swap in your package name). On RHEL, Rocky Linux or AlmaLinux, run rpm -q php-cli --changelog | grep -E "CVE-2026-109618|CVE-2026-109619". A match means your vendor has shipped the fix even if the version number looks old.
• Check the version the web server reports. A temporary phpinfo() page, removed straight after, shows the version and loaded configuration that web requests actually use. Your host’s control panel may show the same information.
• Confirm no old workers are left. After restarting, check process start times or redeploy timestamps so you know nothing from before the update is still serving traffic.
• Scan from the outside. Several security vendors and researchers have released PHP2Shell checkers that test a public URL. Only scan sites you own or are authorized to test.

If You Cannot Patch Today: Temporary Mitigations

Only an update fully fixes PHP2Shell. The measures below, taken from the PHP advisory and summarized by CERT-EU, each close specific known attack paths and buy time. They do not make a server safe on their own. If you cannot patch or mitigate quickly, CERT-EU advises taking internet-facing PHP applications offline until the fix is applied.

For CVE-2026-109618

• Set memory_limit=-1 in a way applications cannot override, such as php_admin_value in the FPM pool or Apache configuration, and confirm nothing else sets a finite limit. This removes the memory limit failure an attacker can trigger, but it also means a runaway request can use all the server’s memory, so pair it with the next two steps.
• Lower post_max_size to 8M for applications that do not need uploads, or 32M if they do, and keep upload_max_filesize below it.
• Enforce limits on request size, number of form fields, multipart parts, headers and nesting depth at the web server, proxy or firewall.
• Use a container or cgroup memory limit as a safety boundary, ideally one that kills only the affected worker. Do not use RLIMIT_AS or RLIMIT_DATA, which can trigger the vulnerable code path.

For CVE-2026-109619 (And CVE-2026-115560)

• Set session.upload_progress.enabled=0 in php.ini, the FPM pool or server configuration, then restart every worker. Do not rely on ini_set() or .user.ini files, which apply too late.
• On PHP 8.5, set fatal_error_backtraces=0 and restart every worker.
• Remove invalid or deprecated per-request settings that produce warnings before a request starts. Hiding warnings with display_errors or error_reporting does not help.
• Fix fatal errors and timeouts an outsider can trigger, for example in upload or import handling.

If your application never accepts file uploads, blocking multipart/form-data POST requests before they reach PHP removes a large part of the attack surface. A web application firewall in front of the site, such as Cloudflare’s, adds another layer while you work on the real fix.

Once the patched runtime is confirmed, restore a finite memory_limit and review your upload limits. Leave session upload progress off.

Signs Your Site Was Compromised Before You Patched

Patching closes the hole. It does not remove anyone who already got in, so check for signs of compromise on any server that was exposed after October 20, 2026:

• Unusual multipart POST requests in access logs, followed by memory limit errors or bursts of HTTP 500 responses.
• Oversized or malformed PHPSESSID cookies in responses.
• New or modified PHP files in the web root, especially in upload folders, and anything that looks like a web shell.
• New administrator accounts in WordPress, Magento or your application.
• Unexpected processes started by PHP or the web server user, and unusual outbound connections.
• SEO spam pages, redirects to unfamiliar sites or a Google Safe Browsing warning.

Code execution gives an attacker everything the PHP process can read, including database passwords, API keys and payment integration secrets in configuration files. If you find any sign of compromise, rotate those credentials after the cleanup, not before, and treat customer data as potentially exposed until you know otherwise.

When To Bring In Outside Help

Many site owners can apply the patch themselves or get their host to do it. The harder parts are confirming that nothing was compromised and making sure the next PHP emergency is handled faster. Depending on where you are, these are the specialists to look at:

• Your site is already showing signs of a hack. Start with a cleanup specialist from our list of hacked website repair and malware removal companies, which compares response times, manual versus automated cleanup and backdoor checks.
• You want to know whether your PHP application is exposed beyond PHP2Shell. Our list of PHP application penetration testing companies covers firms that test Laravel, Symfony, WordPress and Drupal applications the way an attacker would.
• You run custom PHP code and want it reviewed. Our list of PHP security audit companies compares firms that read PHP source for security flaws and send back fixes.
• You keep falling behind on updates. A managed service from our list of vulnerability remediation and patch management services can own patching across servers so the next critical CVE does not depend on someone noticing the news.
• Your PHP version is too old to update easily. Moving off PHP 8.1 or older usually means code changes. A partner from our list of PHP development companies can handle the upgrade.

PHP2Shell FAQ

Does updating WordPress or my plugins fix PHP2Shell?

No. PHP2Shell is in the PHP engine, not in WordPress, Magento or any plugin. Keeping those up to date is still good practice, but only a PHP update or a patched vendor package closes these two flaws.

Can visiting an unpatched website infect my computer?

No. PHP2Shell runs on the server. Browsing a vulnerable site does not put your device at risk, although a compromised site could later be used to serve malware or phishing pages.

My host says I am on PHP 8.3. Am I safe?

Only if it is 8.3.36 or a vendor build that includes the fix. Ask your host to confirm the exact build or check the package changelog for the CVE IDs.

Is a web application firewall enough?

No. A firewall rule that blocks known PHP2Shell requests is a useful extra layer, especially in the first days, but attackers adapt payloads to get past filters. Patch PHP and treat the firewall as backup.

Do I need a penetration test after patching?

Not necessarily for PHP2Shell itself. If your site handles payments, personal data or logins, though, a test or code audit is a sensible follow-up, because a runtime bug this serious is a reminder that application flaws can sit unnoticed for years.

How long do I have before PHP 8.2 stops getting fixes?

PHP 8.2 reaches end of life on December 31, 2026. After that it will not receive official security releases, so plan a move to 8.3 or newer now.

Conclusion

PHP2Shell is one of the most serious PHP security events in years: two critical bugs in the language itself, leaked before the patch, with public exploit code and confirmed attack attempts. The response is straightforward. Update PHP to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a vendor-patched build, restart every worker, turn off session upload progress, and check exposed servers for signs of compromise. If your host runs PHP for you, get written confirmation that it has been patched. If any part of that is beyond your team, bring in a specialist now rather than after something goes wrong.