PHP2Shell CVE-2026-109618 and CVE-2026-109619: How to Protect Your Server

The PHP2Shell vulnerability refers to two critical PHP security flaws, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated attackers to execute code remotely. PHP published emergency security releases on October 21, 2026, addressing both vulnerabilities. Each has a CVSS v4.0 severity score of 9.2, and successful exploitation may also expose sensitive data in process memory.

If your website or application runs PHP, identify the runtime version, check for a security update, and prioritize internet-facing systems. If patching cannot be completed promptly, assess whether the affected service should be isolated until it is secured.

This guide explains the vulnerabilities, affected versions, remediation steps, and what to do if your server may already be compromised.

What Is the PHP2Shell Vulnerability?

PHP2Shell comprises two vulnerabilities in PHP’s core runtime that can lead to remote code execution (RCE), potentially allowing an attacker to run code with the privileges of the PHP process. Unlike a flaw confined to a specific plugin or application, a PHP runtime vulnerability can affect multiple applications that use a vulnerable PHP installation.

CVE-2026-109618: Remote Code Execution via Out-of-Memory Corruption

This vulnerability involves PHP’s handling of an out-of-memory condition. When a request exceeds its memory limit, execution can be interrupted while internal request data is only partially initialized. During cleanup, PHP may incorrectly process that incomplete state, creating a path to memory corruption and remote code execution.

CVE-2026-109619: Remote Code Execution via Stale Global State

This vulnerability involves request-related internal state that can remain referenced after its underlying memory has been freed. A later request handled by the same worker may access that stale state before it is properly reset, potentially leading to memory corruption and remote code execution.

Both vulnerabilities carry a CVSS v4.0 score of 9.2. PHP’s advisory identifies PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed among the affected execution environments. The PHP team identifies mod_php as the highest-risk configuration in its demonstrated attack scenario. (NHS England Digital security alert)

Which PHP Versions Are Affected by PHP2Shell?

PHP versions below the fixed releases listed below are affected. PHP published these security fixes on October 21, 2026.

These are the first fixed releases announced for each branch, not a guarantee that they remain the latest versions indefinitely. Check the official PHP security advisory before deployment.

PHP 8.1 and older branches are out of upstream support. However, some Linux distributions and long-term support vendors may backport the security fix without changing the displayed PHP version. Confirm the exact package or build status with your provider rather than relying on the version number alone. (CERT-EU advisory)

How to Check Your Current PHP Version

For a command-line installation, run:

php -v

However, the CLI version may differ from the PHP runtime serving your website. Also check the PHP version configured in your hosting panel, PHP-FPM pool, container image, or web-server configuration.

Inventory every relevant environment, including staging systems, background workers, embedded PHP installations, and production servers. Prioritize internet-facing systems and confirm that the running service—not just the command-line binary—uses a fixed build.

Why Legacy PHP Systems Need Immediate Attention

Legacy applications may depend on unsupported PHP branches or extensions that complicate upgrades. Do not assume that an old version is safe because its application still works, or that upgrading the website’s CMS automatically patches the PHP runtime.

For older branches, verify whether your operating-system or hosting vendor provides a specific security backport. If not, plan a migration to a supported PHP release and assess whether the existing application and dependencies require changes.

How to Fix the PHP2Shell Vulnerability

The complete fix is to update PHP to a patched release or install a verified vendor-provided security patch. Temporary configuration changes can reduce exposure, but they do not fully eliminate either vulnerability. (Official PHP security advisory)

Step 1: Upgrade to a Patched PHP Version

1. Identify the runtime: Check the PHP version serving web requests, including PHP-FPM pools, Apache modules, containers, and hosting-managed installations.
2. Check compatibility: Review framework requirements, extensions, libraries, and application dependencies before selecting the target version.
3. Test the update: Deploy the patched PHP release in staging and run regression tests for login, forms, uploads, database connections, scheduled jobs, and other critical functions.
4. Deploy and restart: Update the relevant packages or runtime images, then restart the appropriate PHP workers and services.

Use the fixed release for your branch: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or a later release containing the fixes. For older branches, confirm the vendor’s exact patched package or plan a migration.

Step 2: Apply Temporary Mitigations if Immediate Patching Is Not Possible

If an upgrade is delayed, conduct a risk assessment and consider restricting public access or taking the vulnerable service offline. PHP also documents configuration changes that reduce exposure to specific attack paths:

• Disable session.upload_progress.enabled through an administrative PHP configuration, FPM pool, or server setting, then restart all relevant workers. This blocks confirmed paths associated with CVE-2026-109619, not every possible variant.
• For CVE-2026-109618, PHP recommends reviewing memory-limit and request-size controls, including memory_limit and post_max_size. Follow the official advisory with a qualified administrator, as these settings have operational consequences.
• On PHP 8.5, fatal_error_backtraces=0 can block a specific confirmed path associated with CVE-2026-109619.

A WAF and tighter origin-access restrictions can provide additional defense, but they are not substitutes for a patched runtime. Review the PHP advisory’s complete mitigation guidance, including its limitations.

Step 3: Validate the Upgrade and Monitor the Server

After deployment, confirm the version or vendor build used by the web-facing runtime. Test critical application functions, check service and error logs, and verify that every relevant worker has restarted. Continue monitoring for unusual requests, processes, file changes, and outbound connections.

Why Upgrading PHP Is Not Enough If Your Server Has Been Compromised

Patching removes the known vulnerability from the updated runtime, but it does not remove a backdoor or reverse actions an attacker may already have taken.

Signs of a Potential PHP2Shell Attack

Investigate unexpected PHP files or modified application code, unusual child processes launched by PHP or the web server, unfamiliar outbound connections, unexpected account changes, and suspicious activity in web, authentication, and endpoint logs.

These indicators do not prove PHP2Shell was the cause. They are signals that warrant investigation.

What to Do If Your Server May Have Been Compromised

Activate your incident-response process and preserve relevant logs and forensic evidence. Isolate the affected host when warranted, especially if continued access could cause further damage. Investigate persistence mechanisms, review potentially exposed credentials and secrets, and rotate them from a trusted environment.

If system integrity cannot be established, restore from a known-clean backup or rebuild the host. Apply the PHP fix and verify the environment before returning the service to production.

Why Patching Does Not Remove an Existing Compromise

An attacker who previously gained code execution may have altered files, added accounts, stolen credentials, or installed persistence mechanisms. A PHP version upgrade does not automatically reverse these changes.

Follow the applicable incident-response process and consult the IT security guidance for SMBs when reviewing broader server security and recovery controls. The Canadian Centre for Cyber Security advisory also recommends monitoring logs and investigating unexpected processes, files, accounts, and outbound connections.

PHP Upgrade Checklist for Businesses

Use this checklist to prioritize remediation and confirm that the fix is complete.

• Inventory all PHP applications, runtimes, containers, and embedded installations.
• Prioritize internet-facing systems and unsupported PHP branches.
• Verify a fixed release or vendor-provided security patch.
• Investigate potential compromise before assuming patching is sufficient.
• Test dependencies and critical application functions in staging.
• Deploy the fix and restart the appropriate PHP workers.
• Confirm the running runtime is patched and monitor for suspicious activity.

When Should You Consider Professional PHP Upgrade Services?

Professional support can be useful when an application depends on unsupported PHP versions, has complex legacy dependencies, or cannot tolerate unplanned downtime. It is also worth considering when the team lacks the capacity to test a migration or determine whether a suspected compromise requires a broader investigation.

A responsible upgrade engagement should begin with a technical assessment, followed by compatibility planning, regression testing, deployment validation, and a documented recovery plan.

AMELA Technology can help assess existing applications, identify upgrade risks, review compatibility, and plan the technical work required to modernize a PHP environment. Depending on the findings, the scope may include runtime upgrades, dependency updates, testing, and ongoing maintenance.

Contact AMELA to discuss a free initial check.

FAQs

Does PHP2Shell affect WordPress websites?

Potentially, yes. WordPress runs on PHP, so the server’s PHP runtime must be checked even if WordPress core and plugins are up to date.

Can a WAF fix PHP2Shell?

No. A WAF may reduce exposure to certain requests, but it does not repair the underlying PHP vulnerabilities.

Is PHP 8.1 still vulnerable?

PHP 8.1 is an end-of-life upstream branch. Check whether your hosting provider or Linux distribution has backported the fixes; otherwise, plan to migrate to a supported release.

Should I take my PHP server offline?

If immediate patching is not possible, assess the risk and consider isolating the vulnerable service from public access until the fix is applied and verified.

Conclusion

PHP2Shell is also an opportunity to identify legacy-system risks and plan a safer PHP upgrade. Fixing the immediate vulnerability is essential, but reviewing runtime versions, dependencies, and compatibility can reveal wider maintenance needs.

AMELA Technology offers a free initial PHP environment check to help identify the runtime in use, flag potential compatibility concerns, and outline the next steps. If patching, remediation, or migration is required, we can scope the engineering work separately as a paid engagement.