PHP2Shell Explained: Who Is at Risk and How to Update

PHP2Shell is the name now widely used for two critical PHP vulnerabilities that can let an unauthenticated attacker run code on a web server before WordPress, Magento or another PHP application processes the request. The flaws—CVE-2026-109618 and CVE-2026-109619—are each rated 9.2 under CVSS v4.0. Update immediately to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or install the security-fixed package supplied by your Linux distribution or hosting vendor. Restart every PHP worker after updating.

What happened?

The PHP project released an out-of-band security update on 21 October 2026 for two vulnerabilities in PHP’s request-memory lifecycle. The flaws are tracked as CVE-2026-109618, an out-of-memory corruption issue, and CVE-2026-109619, a stale global-state use-after-free.

The official advisories rate both vulnerabilities Critical at 9.2 under CVSS v4.0. Their attack vector is network-accessible, they require no privileges and no user interaction, although the score records high attack complexity and additional attack requirements. Successful exploitation can compromise confidentiality, integrity and availability by running code as the PHP web-worker account.

This is a PHP runtime problem, not a vulnerability limited to one content-management system. Any internet-facing service that executes affected PHP code deserves urgent review, including WordPress, Drupal, Magento, Nextcloud, Laravel and Symfony deployments.

Public technical analysis and exploitation tooling are now available. Datadog Security Labs independently reproduced the attack and confirmed that application-level authentication does not stop the malicious request. Sansec has also reported early attack activity. The scale of exploitation will continue to evolve, but defenders should treat this as a patch-now event rather than wait for evidence against their own server.

What is PHP2Shell?

PHP2Shell is an informal security-industry name for the two related PHP core vulnerabilities CVE-2026-109618 and CVE-2026-109619. It is not the name of a new malware family, a WordPress plugin flaw or a separate PHP product. The name describes how a specially prepared web request can turn a vulnerable PHP runtime into a path for remote command execution.

The official PHP project identifies the flaws by their CVE numbers, while incident responders and security researchers use PHP2Shell as a shorter name for the combined risk. The Dutch NCSC operational repository, Datadog and other security teams use the PHP2Shell name in their public guidance.

This distinction is important for administrators: installing a WordPress, Drupal, Magento or Laravel update does not remove PHP2Shell. The vulnerable component is the PHP engine underneath those applications.

What can PHP2Shell let an attacker do?

A successful PHP2Shell attack can execute commands with the permissions of the PHP web-server worker. The attacker does not need to log in to the website, and the malicious request can be processed before application code, authentication checks or WordPress security plugins run.

Depending on the permissions and isolation of the PHP worker, an attacker may be able to:

• read application configuration files containing database passwords, API keys and other secrets;
• access or alter website data through credentials available to the application;
• modify writable files, plant a web shell or establish persistence;
• steal session material or other sensitive data present in worker memory;
• use the compromised application as a starting point for access to connected services; or
• disrupt the website or exhaust server resources.

PHP2Shell does not automatically provide root access. The initial code runs as the PHP or web-server account, so operating-system permissions, containers, mandatory access controls and network segmentation can limit the blast radius. However, web applications commonly have database credentials and write access to parts of their own installation, so compromise of the worker can still mean complete compromise of the website and its data.

Which PHP versions are affected?

Do not assume a distribution package is vulnerable solely because its version is lower than the upstream number. Ubuntu, Debian, Red Hat and other vendors often backport security patches while retaining an older base version. The authoritative check is whether your vendor’s package changelog or security advisory includes both CVE identifiers.

The opposite mistake is equally dangerous: running a numerically recent but unpatched third-party build does not prove safety. Identify who supplied PHP—your Linux distribution, hosting panel, container registry or custom build—and follow that supplier’s advisory.

How do the PHP vulnerabilities work?

CVE-2026-109618: out-of-memory corruption

PHP uses longjmp() to leave the current execution context when an allocation fails. The advisory explains that some request memory can be reachable while it is only partly initialized. If PHP exits at that moment, request shutdown may later read or branch on invalid data.

Multipart request parsing offers ways to reach out-of-memory conditions without being stopped by the obvious PHP size checks. The PHP team validated unauthenticated remote code execution over HTTP against Apache mod_php using normal input and memory limits. Build details, allocator layout and worker scheduling affect exploit reliability, but multiple workers do not remove the vulnerable condition.

CVE-2026-109619: stale state between requests

Persistent PHP workers retain global runtime structures while serving many HTTP requests. Some of that global state can point to memory owned by a single request. A fatal error or other interruption can leave a stale reference behind after the request memory is freed. A later request handled by the same worker may consume that reference before normal initialization resets it, creating a use-after-free.

The advisory documents confirmed remote-code-execution paths involving mod_php and PHP-FPM. Session upload progress is one early consumer, and a PHP 8.5 fatal-error-backtrace path is another confirmed case. Exploitation still depends on a suitable producer, consumer and worker sequence, which is why attack complexity is rated High, but the outcome is critical when those conditions are met.

Who needs to act immediately?

Inventory every runtime, not just the default php command. A server may simultaneously contain command-line PHP, several PHP-FPM pools, Apache modules, hosting-panel builds and containers. Updating one binary while an older pool continues serving requests leaves the application exposed.

How to check your PHP version

Start with the command-line version:

php -v
php --ini

Then identify active FPM and web-server processes:

systemctl list-units --type=service | grep -E 'php.*fpm'
ps -eo pid,cmd | grep -E '[p]hp-fpm|[a]pache2|[h]ttpd'

The CLI and web server may use different binaries or configuration trees. Confirm the web-facing version through your hosting panel, application health page or a temporary authenticated diagnostic. Do not leave a public phpinfo() file online; it exposes configuration details that attackers can use.

How to update PHP on Linux

Ubuntu and Debian systems

Refresh package metadata, apply available security updates and restart the relevant FPM or Apache service:

sudo apt update
sudo apt upgrade
sudo systemctl restart php8.3-fpm
sudo systemctl restart apache2

Restart only the services that actually exist, substituting your installed PHP branch. On a production system, review the proposed package transaction before approving it and use your normal maintenance and rollback process.

A distribution may publish a fixed package such as an Ubuntu revision based on PHP 8.3.6 rather than renaming it to upstream PHP 8.3.36. Check the vendor notice and installed package revision:

apt-cache policy php8.3-fpm
dpkg-query -W 'php*' | grep -E 'php(8.|-fpm|-cli)'

RHEL, Rocky Linux, AlmaLinux and Fedora systems

Use the repository that supplied PHP and inspect the security transaction before restarting the service:

sudo dnf check-update --security
sudo dnf upgrade --security
sudo systemctl restart php-fpm
sudo systemctl restart httpd

Module streams, third-party repositories and control panels can each provide different PHP packages. Do not mix repositories merely to chase a version number; wait for or obtain the security-fixed build from the supported source for that server.

Plesk, cPanel and other hosting panels

Panels commonly maintain their own PHP packages in parallel with the operating system. Use the panel’s official updater and confirm each enabled handler or PHP branch is patched. A system-level apt upgrade or dnf upgrade may not update panel-managed runtimes.

For critical customer-facing systems, take a fresh backup, record active PHP handlers, apply the panel vendor’s update, restart the affected services and test representative sites. If the panel vendor has not yet published a fixed package, ask for its CVE-specific status instead of assuming protection from a web application firewall.

What should WordPress and managed-hosting users do?

No WordPress core update is planned for these two flaws because the vulnerable component is PHP beneath WordPress. In the WordPress dashboard, open Tools → Site Health → Info → Server to see the reported PHP version. That is an inventory clue, not complete proof that a distribution backport is present.

If your provider fully manages PHP, ask a precise question: “Has the PHP runtime serving my site been patched for CVE-2026-109618 and CVE-2026-109619, and have its workers been restarted?” A response that mentions only WAF protection or the WordPress version is incomplete.

Self-managed WordPress servers should patch the OS or hosting-panel package, restart PHP-FPM or Apache and then test login, publishing, uploads, scheduled tasks and checkout or membership flows. The latest stable WordPress security guidance remains relevant, but it does not replace this PHP update. See our WordPress 7.1.3 security update guide for the separate core fixes.

What about Docker containers and Kubernetes?

Restarting an old container does not patch its image. Pull a base image that contains one of the fixed upstream PHP releases or a vendor-confirmed backport, rebuild the application image without stale build cache where appropriate, push the new immutable image and replace every running replica.

docker pull php:8.3.36-fpm
docker build --pull -t example/app:php-security-20261021 .
docker run --rm example/app:php-security-20261021 php -v

Adapt the tag to the PHP branch and web-server variant your application uses. In Kubernetes, verify that Deployments, CronJobs, Jobs and one-off maintenance pods all reference the rebuilt image digest. Old nodes or completed-but-reusable images in a private registry can reintroduce the vulnerable runtime during rollback.

Are temporary mitigations enough?

No generic configuration change covers both vulnerabilities completely. The PHP advisory is explicit: updating to a release containing the full patches is the only reliable mitigation.

If an immediate update is impossible, the CVE-2026-109619 advisory describes risk-reduction measures for demonstrated paths. Administrators can disable session.upload_progress.enabled when it is not required and, on PHP 8.5, disable fatal_error_backtraces. Every worker must be restarted after administrative configuration changes. These settings do not cover all possible stale application or extension state.

A WAF may block known request shapes and buy time, but it cannot prove that every producer and consumer path is unreachable. National and European cyber-security authorities advised isolating internet-facing PHP systems when immediate remediation was unavailable. For a high-value server with no patch path, temporarily removing public access is safer than treating an incomplete workaround as a fix.

How to verify that the PHP fix is active

1. Confirm the package source. Identify whether PHP came from the OS, a panel, a container image or a custom build.
2. Confirm both CVEs. Check the supplier’s advisory or changelog for CVE-2026-109618 and CVE-2026-109619.
3. Restart all workers. Replace containers and restart every PHP-FPM pool or Apache worker set.
4. Check every interface. Compare the CLI version with each web-facing pool and hosting-panel handler.
5. Test the application. Verify authentication, uploads, background jobs, APIs and business-critical transactions.
6. Monitor after patching. Review error, access and security logs for unexpected behavior without interpreting quiet logs as proof that exploitation never occurred.

Do not run public exploit code against a production server. Version, package and process verification provides a safer remediation check and does not risk corrupting the worker or application state.

Our assessment

This is an unusually urgent PHP update because the flaws sit below application frameworks, are reachable over the network and have confirmed remote-code-execution impact in common deployment models. The attack is not described as trivial—its CVSS metrics include high complexity and attack requirements—but defenders should not confuse lower reliability with low impact.

The most likely operational mistake is checking only php -v. Modern servers frequently run multiple PHP branches and packaging systems. The correct response is an inventory-and-restart exercise: locate every runtime, match it to a vendor-fixed package, patch it, replace long-running workers and containers, and confirm the live application uses the updated build.

For managed customers, this is also a test of provider communication. Ask for both CVE numbers and the runtime actually serving your site. Clear confirmation is more valuable than a generic statement that “security measures are in place.”

Frequently asked questions

Is PHP2Shell one vulnerability or two?

PHP2Shell is the common name for two related PHP engine vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Administrators should confirm that their package fixes both CVEs.

Are CVE-2026-109618 and CVE-2026-109619 being actively exploited?

Independent researchers have reproduced exploitation, public exploitation tooling is available and security researchers have reported early attack activity. The exact scale can change quickly, so internet-facing PHP systems should be patched immediately rather than waiting for a campaign-specific indicator.

Does updating WordPress fix these PHP vulnerabilities?

No. The vulnerabilities are in PHP itself. Update the PHP package or runtime supplied by your operating system, host, panel or container vendor.

Is PHP-FPM affected?

Yes. The official stale-global-state advisory says remote code execution was validated against PHP-FPM for a session-lifecycle path. Apache mod_php is also affected.

Do I need to restart PHP after installing the update?

Yes. Restart PHP-FPM pools or Apache workers, or replace containers, so no process continues running the old vulnerable binary and memory state.

Is disabling session upload progress enough?

No. It removes one demonstrated path for CVE-2026-109619 but does not cover every stale-state path or CVE-2026-109618. Apply the complete vendor patch.

What if my Linux distribution still shows an older PHP version?

Check the distribution’s security advisory and package revision. Vendors often backport fixes without changing the upstream base version. You need confirmation for both CVEs, not just a numerical comparison.

Sources

• PHP project: critical security release and fixed versions
• PHP security advisory: CVE-2026-109618, RCE via OOM corruption
• PHP security advisory: CVE-2026-109619, RCE via stale global state
• NCSC-NL: PHP2Shell operational guidance
• Datadog Security Labs: PHP2Shell analysis and reproduced impact
• Sansec: PHP2Shell threat research and reported attack activity
• UK NCSC: critical security issue affecting PHP
• CERT-EU: critical vulnerabilities in PHP
• WordPress.org: critical PHP security release guidance
• Ubuntu: PHP2Shell vulnerability fixes and package guidance
• Plesk: CVE-2026-109618 and CVE-2026-109619 status for Plesk PHP