PHP2Shell Explained (CVE-2026-109618 and CVE-2026-109619): What Happened and What Website Owners Must Do Now

Updated 24 October 2026. This is a fast-moving security story; check the official PHP advisory and your hosting provider for the latest status.

PHP runs a huge share of the web: most WordPress sites, many online shops, college portals, booking systems and business websites across India. On 21 October 2026, the PHP project released emergency fixes for two critical vulnerabilities that security researchers nicknamed PHP2Shell.

If your business has a website, there is a good chance it runs on PHP. Here's what you need to know.

What PHP2Shell is, in one paragraph

PHP2Shell is two bugs in the core PHP engine (not in WordPress or any plugin) that can let an attacker run their own code on your web server by sending specially crafted requests, without logging in. Running code on your server means they could read your database, steal customer data, plant malware, send spam, or deface your site.

The two vulnerabilities

CVE	What goes wrong	Severity
CVE-2026-109618	If PHP runs out of memory while its internal request data is only partly set up, the clean-up treats that half-built data as valid, which can corrupt memory	CVSS v4.0 9.2 (critical)
CVE-2026-109619	A "use-after-free": leftover state from one request points to freed memory that a later request on the same worker can use	CVSS v4.0 9.2 (critical)

PHP says both can be exploited by an unauthenticated remote attacker. Early CVE listings showed a score of 10.0; the PHP Foundation said that was incorrect, and the correct score is 9.2.

Who is affected

According to PHP and security researchers:

• Every PHP installation serving web requests is at risk: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed
• mod_php is the highest-risk setup: a demonstrated exploit can trigger before any of your application code runs
• Researchers demonstrated pre-login code execution against default WordPress, Drupal, Joomla and Magento installs, with no plugin or theme bug needed
• The earliest affected code dates back to PHP 5.4, so very old servers are affected too

Fixed versions

Branch	Fixed in	Notes
PHP 8.5	8.5.12	Supported
PHP 8.4	8.4.27	Supported
PHP 8.3	8.3.36	Supported
PHP 8.2	8.2.35	Security support ends 31 Dec 2026
PHP 7.4 to 8.1	No official release	Minimal source backports only; many hosts and Linux vendors have shipped their own patched builds
PHP 5.4 to 7.3	No fix from PHP	End of life: upgrade

Linux distributions (Ubuntu, Debian, Red Hat and others) received patches in advance and ship their own updated packages. On those systems, the version number shown may not change even when the fix is applied; check your vendor's security notice.

Timeline

• 19–24 August 2026: researchers find the first bug, confirm pre-login code execution against Drupal and WordPress, and report it to PHP
• 21 September: PHP acknowledges and begins a coordinated fix
• 17 October: Amazon's threat intelligence sees an exploit attempt against its honeypots, four days before disclosure
• 20 October: CVE IDs leak; PHP announces an emergency release for the next day
• 21 October: patched PHP releases and public disclosure; CISA (US) and CERT-In (India) issue alerts
• 21–22 October: Cloudflare reports attempts rising from tens of thousands within 45 minutes to millions by the next morning
• 23 October: PHP discloses a third, lower-risk issue, CVE-2026-115560

Researchers say a reliable exploit is harder to build than first feared, and confirmed successful compromises have been limited so far. But mass scanning is happening, and attackers have tried to install botnet malware. Treat this as urgent.

What you should do today

If you're on shared or managed hosting (Hostinger, GoDaddy, SiteGround, Bluehost and similar):

1. Check your host's status page or email. Most large hosts patched within a day or two. See PHP2Shell hosting patch status.
2. Check your PHP version and build date. See how to check your PHP version.
3. If you're on PHP 8.1 or older, ask your host whether they've applied a patched build, and plan an upgrade.

If you run your own VPS or server (AWS, DigitalOcean, Azure, a local data centre):

1. Update PHP to a fixed version or your distribution's patched package
2. Restart every PHP worker (PHP-FPM, Apache, queue workers, Octane/FrankenPHP)
3. If you can't patch immediately, apply the interim settings below
4. Step-by-step: patching PHP2Shell on a VPS

If you run containers: pull and rebuild with the patched php image tags. See PHP2Shell for Docker and Laravel.

Interim mitigations (only until you patch)

PHP and security vendors list these temporary measures. They reduce risk but updating is the only complete fix:

• session.upload_progress.enabled = 0 in php.ini or the FPM pool config (not via ini_set() in code), then restart workers. This also covers CVE-2026-115560
• memory_limit = -1 set so applications can't override it (for CVE-2026-109618)
• On PHP 8.5, also fatal_error_backtraces = 0
• A web application firewall (Cloudflare deployed rules for all plans) as an extra layer, not a replacement
• CISA advises taking PHP systems offline if they can't be patched, or if they run PHP 8.1 or earlier

Updating WordPress isn't enough

This is the most common misunderstanding. WordPress, plugin and theme updates don't touch the PHP engine. Security plugins like Wordfence can't fix a bug in PHP itself. You (or your host) must update PHP. See is my WordPress site affected by PHP2Shell?

Check whether you were attacked

Patching closes the door, but doesn't tell you whether someone walked through it earlier. Look for unknown PHP files, new admin users and odd outbound connections, and rotate passwords and API keys if in doubt. Our guide: was my website hacked through PHP2Shell?

The bigger lesson

PHP2Shell was found with heavy help from AI tools (how AI found it), which researchers say made it far faster to turn old bugs into working exploits. Expect more of this. Small businesses that stay on supported PHP versions, use managed hosting or a maintained server, and keep backups will be fine. Those on abandoned servers running PHP 7.x are the ones at real risk. Start with PHP end-of-life dates.

Where we fit

We build and maintain websites for founders and local businesses in Bangalore and Shivamogga, on supported PHP or modern stacks, with managed hosting, updates and backups in place. If you're not sure whether your site is patched, we can check it with you. See website development or website design in Shivamogga.

Worried about your website? Get in touch for a free check.

Sources

• CISA: Critical vulnerabilities in PHP require immediate patching
• Tenable: php2shell FAQ
• Help Net Security: PHP2Shell patched, update now
• The Hacker News: PHP warns of another RCE risk
• Wiz: PHP2Shell research