PHP2Shell Vulnerability: Affected PHP Versions & Fix

Q: How can I check whether my server is vulnerable to PHP2Shell?

Run php -v over SSH to check the command-line PHP version. For websites, also check WordPress Site Health or your hosting control panel, because the web-facing PHP runtime may differ from the command-line version. On servers running multiple PHP versions, check every installation and PHP-FPM service.

PHP2Shell vulnerability — critical PHP remote code execution security flaw

Understand the PHP2Shell vulnerability and learn how to secure vulnerable PHP installations.

PHP2Shell Vulnerability: Critical PHP Remote Code Execution Flaws, Affected Versions, and How to Fix Them

Table of Contents

The PHP2Shell vulnerability is a critical security issue affecting the PHP runtime, the technology that powers millions of dynamic websites, content management systems, and web applications. Disclosed on October 21, 2026, PHP2Shell refers to two vulnerabilities that can allow unauthenticated attackers to execute arbitrary code on vulnerable servers or expose sensitive process memory.

Tracked as CVE-2026-109618 and CVE-2026-109619, these vulnerabilities have a CVSS v4.0 severity score of 9.2 out of 10. The PHP development team has released patched versions, and administrators should update affected installations as soon as possible. Official PHP security advisory.

Unlike vulnerabilities that depend on a particular WordPress plugin or an application-level coding mistake, PHP2Shell affects the PHP runtime itself. Consequently, a website may be at risk even when its WordPress installation, themes, and plugins are properly maintained.

In this guide, you will learn what PHP2Shell is, how the vulnerabilities work, which PHP versions are affected, how to check your server, and what steps administrators should take to secure their websites.

What Is the PHP2Shell Vulnerability?

PHP2Shell is the name used for a pair of critical vulnerabilities in the PHP runtime that can potentially turn specially crafted HTTP requests into remote code execution.

Remote code execution, commonly abbreviated as RCE, occurs when an attacker can make a vulnerable system execute commands or code of their choosing without authorization.

PHP2Shell consists of two related security flaws:

CVE-2026-109618: Remote code execution associated with out-of-memory handling and invalid internal request state.
CVE-2026-109619: Remote code execution associated with stale internal state that can reference memory after it has been freed.

Both vulnerabilities involve unsafe memory handling inside PHP. Successful exploitation can compromise the confidentiality, integrity, and availability of a vulnerable server.

According to the official PHP security advisory, potentially affected deployments include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

The vulnerabilities do not require an attacker to log in to the affected website. The exact exploitability and reliability depend on the PHP build, server configuration, and request-processing environment.

PHP2Shell Vulnerability: Quick Facts

Security detail	Information
Vulnerability name	PHP2Shell
CVE identifiers	CVE-2026-109618 and CVE-2026-109619
Disclosure date	October 21, 2026
Severity	Critical
CVSS v4.0 score	9.2 out of 10
Primary impact	Remote code execution and potential memory disclosure
Authentication required	None for the documented attack scenarios
Affected component	PHP runtime
Commonly affected environments	PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed
Fixed PHP versions	8.2.35, 8.3.36, 8.4.27, and 8.5.12
Recommended action	Update PHP and restart affected workers

These details reflect the PHP security release published on October 21, 2026. Administrators using older or vendor-maintained PHP packages should also check their operating system or hosting provider’s security advisories.

How Does PHP2Shell Work?

To understand PHP2Shell, it helps to know that PHP performs several internal operations before and after executing an application script.

When a web server receives a request, PHP initializes request-specific data, parses incoming parameters, processes the request, and eventually releases the memory associated with that request.

PHP2Shell involves flaws in how PHP handles exceptional conditions during this lifecycle.

1. CVE-2026-109618: Remote Code Execution Through Out-of-Memory Handling

The first vulnerability involves PHP’s handling of out-of-memory conditions.

PHP uses internal control-flow mechanisms to abort an operation when a memory allocation fails. In certain circumstances, an allocation failure can interrupt request processing while internal data is only partially initialized.

If PHP subsequently performs request cleanup using that invalid state, it may access memory incorrectly. Under the right conditions, this can lead to memory corruption and remote code execution.

Crafted multipart HTTP requests can trigger problematic memory usage. For example, multipart request structures may require considerably more internal memory than their apparent size suggests.

The PHP security advisory identifies several relevant conditions, including multipart requests with problematic content-length handling, excessive multipart headers, empty file controls, and nested input field names.

Why this matters: The problem exists inside PHP’s request-processing machinery. In susceptible configurations, the vulnerable code can be reached before the application script itself starts executing.

Simply updating a WordPress plugin or improving application-level input validation does not fix this underlying runtime flaw.

2. CVE-2026-109619: Remote Code Execution Through Stale Internal State

The second vulnerability involves internal state that can outlive the memory it references.

During request processing, PHP maintains internal variables and references to request-specific memory. Under certain circumstances, an error-handling path may fail to reset those references correctly.

When the associated memory is released, an internal reference can become stale. If PHP subsequently uses that reference, the result can be a use-after-free vulnerability.

A use-after-free bug occurs when software continues accessing memory after that memory has been released. Depending on what happens to the memory afterward, this can cause crashes, memory corruption, information disclosure, or code execution.

The PHP2Shell research identifies request handling and internal state management as important parts of the vulnerability.

Why this matters: A website does not necessarily need an obvious vulnerable plugin or a dangerous PHP function in its own code to be affected. The vulnerability resides in the runtime that executes the application.

For the authoritative technical details, see the PHP advisories:

Which PHP Versions Are Vulnerable?

PHP2Shell affects a broad range of PHP releases, including legacy branches. The PHP development team has published patched releases for supported branches.

The following table lists the fixed versions announced on October 21, 2026.

PHP branch	Vulnerable versions	Fixed version
PHP 8.5	Earlier than 8.5.12	8.5.12
PHP 8.4	Earlier than 8.4.27	8.4.27
PHP 8.3	Earlier than 8.3.36	8.3.36
PHP 8.2	Earlier than 8.2.35	8.2.35
PHP 8.1 and older	Affected legacy releases	Upgrade or obtain an applicable vendor-supported backport

Source: PHP 2026 security announcements.

Important: The fixed version numbers apply to the relevant PHP branches. A newer supported release containing the security fixes is also suitable. For operating-system packages, the version string alone may not tell the whole story because vendors sometimes backport security fixes without adopting the upstream version number.

PHP 8.2 reaches the end of its scheduled support period on December 31, 2026. If your website still uses PHP 8.2, consider upgrading to a newer supported branch after checking compatibility.

Older PHP installations require special attention. PHP 8.1 and earlier releases may be end-of-life and may not receive standard upstream security updates. Check whether your distribution or hosting provider supplies a verified security backport. If no suitable fix is available, plan a migration to a supported PHP release.

How to Check Your PHP Version

Before applying an update, identify the PHP versions running on your server.

Method 1: Check PHP Through the Command Line

If you have SSH access, run:

php -v

The output displays the PHP version associated with the command-line executable.

For example, a result such as PHP 8.3.35 indicates that the command-line installation is older than the fixed PHP 8.3.36 release.

However, this command does not necessarily show the version used by your website. Servers can have multiple PHP installations, and command-line PHP may be different from PHP-FPM or Apache’s PHP runtime.

On a Linux server, you can also inspect available PHP-FPM services:

systemctl list-units --type=service --all | grep -i php

To see which PHP-related processes are running:

ps aux | grep '[p]hp-fpm'

Use these commands to identify the services that need further investigation. The exact service names depend on your operating system and hosting setup.

Method 2: Check PHP in WordPress

WordPress administrators can check the PHP version used by their website without using SSH.

Sign in to the WordPress dashboard.
Open Tools → Site Health.
Select the Info tab.
Expand the Server section.
Locate the PHP version information.

Compare the reported version with the fixed releases listed above.

If your website uses a hosting control panel, you should also check the PHP version assigned to the specific domain. A server may have several PHP versions installed, with different websites assigned to different versions.

Method 3: Check PHP Through Your Hosting Control Panel

Many hosting providers allow administrators to manage PHP versions through a control panel.

Depending on your environment, look for settings such as:

PHP version selection
PHP-FPM configuration
Domain-specific PHP settings
Installed PHP versions
PHP service management

If you manage websites through HestiaCP, for example, check the PHP version assigned to each domain and verify which PHP-FPM service handles its requests.

Do not assume that updating the system-wide PHP executable also updates every website.

How to Fix the PHP2Shell Vulnerability

The primary remediation is to install a PHP release containing the security fixes. The PHP development team states that configuration changes alone are not a complete solution.

Step 1: Back Up Your Website and Server Configuration

Before making changes to a production server, prepare a recovery plan.

Back up:

Website files
Database contents
PHP and PHP-FPM configuration
Web server configuration
Relevant hosting control panel settings

Confirm that the backup is usable and that you can restore the website if the update causes compatibility problems.

For production environments, test the update on a staging system when practical. However, do not delay urgent security remediation unnecessarily on an exposed server.

Step 2: Upgrade PHP to a Fixed Release

Install the appropriate security update for the PHP branch you use.

For reference, the fixed upstream versions are:

PHP 8.2.35
PHP 8.3.36
PHP 8.4.27
PHP 8.5.12

The exact installation command depends on your operating system, repository, hosting panel, and PHP installation method.

On systems that use distribution-managed PHP packages, install the vendor’s updated package rather than mixing unrelated PHP binaries or repositories.

For custom installations, follow the official PHP upgrade instructions and ensure the installed build includes both security fixes.

Official resources:

Step 3: Update Every PHP Installation

A common server-management mistake is updating only the PHP version used by the command line.

A single server may run PHP 8.2 for one domain, PHP 8.3 for another, and a different PHP-FPM service for a third.

Create an inventory of all PHP installations and their associated websites. Check each version, including custom installations and services managed separately from the operating system’s default PHP package.

Pay particular attention to:

PHP-FPM pools
Apache mod_php installations
php-cgi services
LiteSpeed PHP handlers
Containerized PHP applications
Background workers that execute PHP code

Any internet-facing PHP runtime must be checked independently.

Step 4: Restart PHP Services

After upgrading PHP, restart the relevant services so that running workers load the patched runtime.

For example, on a system using a standard PHP-FPM service:

sudo systemctl restart php8.3-fpm

The service name shown above is an example. Your actual service might use a different PHP version or a hosting-panel-specific name.

On a HestiaCP server or another multi-PHP environment, identify the correct service before restarting it. Restarting the wrong service will not protect websites using a different runtime.

If Apache, LiteSpeed, or another web server directly loads PHP, follow the appropriate service-reload or restart procedure for that configuration.

Step 5: Verify the Update

Check the PHP version again:

php -v

Then verify the web-facing runtime through WordPress Site Health, your hosting control panel, or an appropriately configured diagnostic page.

For PHP-FPM environments, inspect the relevant service status:

systemctl status php8.3-fpm

Replace the example service name with the actual service used by your website.

Check the PHP and web server logs for startup failures or application errors after the update. Test important website functions, including login, forms, uploads, and database-backed pages.

Do not consider the issue resolved until every exposed PHP runtime has been updated or otherwise addressed through a verified vendor-supported security fix.

Can PHP2Shell Affect WordPress Websites?

Yes. WordPress uses PHP to execute its core files, themes, plugins, and other server-side functionality. A vulnerable PHP runtime can therefore put a WordPress website at risk even if the WordPress installation itself is up to date.

The same concern applies to other PHP applications, including Drupal, Joomla, and custom PHP websites.

An attacker who successfully achieves remote code execution may be able to perform actions available to the compromised PHP worker account. Depending on the server’s permissions and isolation, the impact may include:

Reading accessible configuration files
Accessing database credentials stored in application files
Modifying website content
Installing malicious PHP files
Creating unauthorized persistence mechanisms
Accessing data belonging to the affected application
Disrupting website availability

The extent of the damage depends on the environment, permissions, and exploitation path. Remote code execution as a web server account does not automatically mean unrestricted root access, but it can still lead to a serious compromise.

Is Updating WordPress Enough?

No. Updating WordPress core, themes, and plugins is good security practice, but it does not patch the PHP runtime itself.

Administrators must update PHP independently through their hosting provider, operating system, or PHP installation method.

Likewise, installing a security plugin or a web application firewall does not replace the required PHP security update.

Does a Web Application Firewall Protect Against PHP2Shell?

A web application firewall (WAF) can help reduce exposure by detecting or blocking suspicious HTTP requests before they reach a vulnerable application.

Some security providers have reported deploying PHP2Shell-specific protections. For example, Cloudflare published an update about its PHP2Shell protections.

A WAF may be useful as an additional defensive layer, especially when administrators need time to coordinate updates across multiple servers.

However, a WAF should not be treated as a complete fix.

PHP2Shell affects the runtime, and exploitability can depend on the request-processing environment. No single generic rule can be assumed to protect every vulnerable deployment.

The recommended priority is:

Patch the PHP runtime.
Restart affected workers.
Verify the running versions.
Retain appropriate WAF, firewall, and monitoring protections.

Temporary Mitigation If You Cannot Update Immediately

If an immediate update is impossible, reduce exposure while arranging remediation.

The PHP security advisories discuss configuration and request-handling measures that may reduce certain attack paths. These are temporary risk-reduction measures, not substitutes for a fixed PHP release.

Consider the following steps:

Restrict public exposure. Where feasible, temporarily take vulnerable services offline or restrict access to trusted networks until a fix can be installed.

Review multipart request handling. If an application does not need multipart form uploads, consider blocking those requests at the frontend. For applications that require uploads, enforce sensible request-size and parsing limits.

Apply resource controls carefully. Follow the official PHP advisory for memory-related mitigations. Some settings may reduce a particular exploitation path while leaving other paths open.

Use vendor guidance. If your server uses a hosting panel or an operating-system-maintained PHP build, consult its security documentation for supported mitigation options.

Do not rely on disabling a single feature. Disabling session upload progress, changing PHP limits, or adding a WAF rule should not be assumed to resolve both vulnerabilities.

The official PHP security guidance is clear that updating to a fixed release is the only complete remediation.

How to Investigate a Potential PHP2Shell Compromise

Patching protects against future exploitation of the fixed vulnerabilities, but it does not automatically remove malicious changes made before the update.

If your server was exposed while running a vulnerable PHP version, review its security posture and logs, particularly if you observe unusual activity.

1. Review Web Server and PHP Logs

Look for unexpected request patterns, repeated PHP worker crashes, unusual memory errors, and abnormal multipart POST traffic.

These indicators are not conclusive by themselves. High traffic, legitimate file uploads, and application bugs can produce similar events.

Correlate suspicious requests with timestamps, source addresses, PHP errors, and system activity.

2. Inspect Recently Modified Website Files

Review web roots for unexpected or recently modified PHP files, unfamiliar scripts, and unauthorized changes to WordPress core, themes, or plugins.

Pay attention to files that do not belong to the application’s normal installation and deployment process.

File timestamps alone cannot establish whether a file is malicious. Compare suspicious files with trusted backups or official package contents.

3. Check Processes and Scheduled Tasks

Investigate unexpected child processes launched by PHP or the web server, unfamiliar scheduled tasks, and unauthorized system or application accounts.

Look for changes that cannot be explained by legitimate deployments or administrative activity.

4. Check Database and Account Activity

For WordPress sites, review administrator accounts, unexpected changes to users or permissions, suspicious database modifications, and unfamiliar plugins.

Rotate credentials when compromise is suspected, particularly database credentials, hosting control panel credentials, SSH keys, and application secrets that may have been accessible to the compromised process.

5. Isolate the Server if Necessary

If you find evidence of unauthorized code execution or persistence, isolate the affected server where practical and preserve relevant logs and forensic evidence.

Do not assume that installing the patch is sufficient to restore trust in a potentially compromised host. A confirmed compromise may require incident response, clean restoration, credential rotation, and verification of the entire environment.

PHP2Shell Security Checklist for Website Administrators

Use this checklist when reviewing your server.

Identify every PHP version installed on the server.
Determine which PHP runtime serves each website.
Upgrade vulnerable supported branches to fixed releases.
Confirm vendor security fixes for distribution-managed or legacy packages.
Restart the relevant PHP and web server processes.
Verify the PHP version used by each website.
Review web server, PHP, and system logs for suspicious activity.
Inspect website files, database changes, and administrator accounts if compromise is suspected.
Rotate exposed credentials if there is evidence of unauthorized access.
Maintain tested backups and a documented recovery procedure.

Completing the checklist helps establish whether remediation has been applied consistently across a multi-site hosting environment.

Conclusion

PHP2Shell is a serious reminder that application security depends on more than keeping website code up to date. Vulnerabilities in the PHP runtime itself can expose websites even when their application code is correctly maintained.

The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated remote code execution in susceptible environments. PHP has released patched versions, including PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.

If you administer a WordPress website, custom PHP application, or multi-site hosting server, identify every exposed PHP runtime, install the appropriate security update, restart affected services, and verify the result.

Do not rely on a security plugin, firewall rule, or configuration change as a replacement for patching PHP. Timely updates, restricted permissions, tested backups, and effective monitoring remain essential to protecting your websites and server infrastructure.

Frequently Asked Questions About PHP2Shell

1. What is the PHP2Shell vulnerability?

PHP2Shell is the name given to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. These flaws involve unsafe memory handling and can allow unauthenticated attackers to execute arbitrary code on vulnerable PHP servers.

2. Which PHP versions are affected by PHP2Shell?

PHP versions earlier than 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are affected in their respective release branches. PHP 8.1 and older versions are also affected, although some may require vendor-provided security patches or an upgrade to a supported version.

3. How do I fix the PHP2Shell vulnerability?

Update PHP to a fixed release: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or a later patched release. Restart the affected PHP services and verify the runtime used by each website. Check your operating system or hosting provider’s advisory if security fixes are distributed through vendor packages.

4. Can PHP2Shell affect WordPress websites?

Yes. WordPress runs on PHP, so a vulnerable PHP runtime can expose a WordPress website even when WordPress core, themes, and plugins are up to date. Updating the PHP runtime is necessary to address these vulnerabilities.

5. Does PHP2Shell allow remote code execution without authentication?

Yes. The documented vulnerabilities can allow unauthenticated remote code execution in susceptible environments. Successful exploitation may let an attacker run code with the privileges of the affected PHP worker or web server account.

6. Can a security plugin or firewall prevent PHP2Shell?

A web application firewall or security plugin may block some suspicious requests and reduce exposure, but it cannot guarantee protection against every exploitation path. Updating PHP to a fixed release remains the primary remediation.

7. How can I check whether my server is vulnerable to PHP2Shell?

Run php -v over SSH to check the command-line PHP version. For websites, also check WordPress Site Health or your hosting control panel, because the web-facing PHP runtime may differ from the command-line version. On servers running multiple PHP versions, check every installation and PHP-FPM service.

8. What should I do if my website may already have been compromised?

Update the vulnerable PHP runtime, review web server and PHP logs, inspect recently modified files and unexpected processes, and check for unauthorized accounts or scheduled tasks. If you find evidence of compromise, isolate the server where practical, rotate potentially exposed credentials, and follow an appropriate incident-response process

…