PHP2Shell (CVE-2026-109618 / 109619): Check and Patch Your PHP Server

On October 21, 2026 the PHP project shipped emergency releases for two critical bugs in PHP core, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell". Both are rated 9.2 under CVSS v4.0 and both can lead to unauthenticated remote code execution. A leaked report circulated a 10.0 score before release; the PHP team says that number was wrong, but the practical risk is the same: anyone who can send an HTTP request to your PHP application may be able to run code on the server.

Cloudflare has reported attack traffic aimed at these bugs, so this is not a "patch next sprint" issue.

What is actually broken

The two bugs live in request handling, not in a framework or plugin, which is why every PHP application is in scope:

• CVE-2026-109618 is a memory-corruption bug in out-of-memory handling. Request data can be left partly initialized and then treated as valid during cleanup.
• CVE-2026-109619 is a use-after-free. State from one request survives, and a later request served by the same worker can read it.

WordPress, Laravel, Drupal, Magento or hand-written PHP: if it runs on an unpatched PHP binary, it is affected.

Affected and fixed versions

PHP 8.1, 8.0 and 7.4 are end-of-life and will not get an upstream patch. Community source backports exist for 7.4 through 8.1, and some Linux distributions and hosting panels (Plesk among them) ship their own patched builds, but you have to confirm that with your vendor. Do not assume.

How to check your server

On the server, the authoritative answer:

php -v
# PHP 8.3.36 (cli) ...  → patched

Remember that the CLI and the web server can use different binaries. Check what the web server actually runs: a temporary phpinfo() page (delete it right after), your hosting panel's PHP selector, or php-fpm8.3 -v for the FPM pool.

From the outside, many servers still announce their version in the X-Powered-By header:

curl -sI https://example.com | grep -i x-powered-by
# X-Powered-By: PHP/8.1.29   → end-of-life, vulnerable

The free website vulnerability scanner reads that header and tells you whether the version is end-of-life, vulnerable to PHP2Shell, or patched. If the header is missing, that is good practice, but it also means you need to check on the server.

How to patch

1. Upgrade the PHP package to the fixed release for your branch (Debian/Ubuntu via your PHP repository, RHEL via Remi or AppStream, Docker by bumping the php: image tag and rebuilding).
2. Restart every PHP worker. Installing the package is not enough while old PHP-FPM, Apache mod_php or RoadRunner workers keep the vulnerable code in memory. systemctl restart php8.3-fpm (or your equivalent), then confirm the new version from the web.
3. Managed hosting: check your host's status page or changelog for the PHP2Shell update. If it does not mention it, open a ticket and ask which build you are on.
4. On PHP 8.1 or older: plan the upgrade to 8.4 or 8.5 now. A backported build buys time, not safety; the next PHP security bug will not be backported for you.

If you cannot upgrade today

The PHP team published interim mitigations:

• Disable session upload progress: session.upload_progress.enabled = Off.
• On PHP 8.5, disable fatal error backtraces.
• Restart all PHP workers after changing the configuration.

A container or cgroup memory limit makes exploitation harder but is not a full mitigation. A WAF rule from your CDN can block known exploit patterns while you schedule the upgrade.

After you patch

• Re-check the version the web server reports, not just the CLI.
• Turn off version disclosure with expose_php = Off so the next scanner, friendly or not, cannot fingerprint you this easily.
• Look for signs of compromise if the server was exposed for days: unexpected PHP files in upload directories, new admin users, unfamiliar cron jobs.

Then run the scan again to confirm the version banner is gone and nothing else is exposed. If you would rather have someone else handle the upgrade, the fix sprint covers PHP2Shell patching and worker restarts on your server.