PHP2Shell (CVE-2026-109618, CVE-2026-109619): what happened, who is exposed and how to fix it

PHP2Shell is the name given to two vulnerabilities in the PHP interpreter, CVE-2026-109618 and CVE-2026-109619. Both allow an unauthenticated attacker to run code on the server with the privileges of the web server account, and both are rated CVSS v4.0 9.2 (Critical). They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP 8.1 and older are end of life and did not receive an official release.

What makes PHP2Shell different from most PHP security news is where the bug lives. This is not a flaw in one plugin or one framework. It is in PHP itself, so a WordPress site, a Laravel application, a Drupal portal and a hand-written PHP script on the same unpatched interpreter share the same exposure.

PHP2Shell at a glance

Timeline: from private report to public attacks

The sequence matters because it explains why defenders had so little time. The vulnerabilities were reported privately to the PHP project in August, a fix was prepared, and the plan was a coordinated release followed by technical details. The details became public before that plan finished.

The discovery is credited by watchTowr to researchers at Calif. Cloudflare reported attack traffic aimed at these vulnerabilities, including attempts to evade its protections, according to Qualys. As of 23 October, watchTowr noted the vulnerabilities were not yet on CISA's Known Exploited Vulnerabilities catalogue. That catalogue lags reality; absence from it is not evidence of safety.

How many websites are exposed?

Nobody can count every PHP website on the internet, so treat any single global figure with care. The most useful published data comes from Qualys, which looked at more than 10,000 of its customers and found 167 million PHP package installations. Of those with a known version, about 44 million (28%) were on supported branches 8.2 to 8.5, and about 110 million (71%) were on end-of-life versions 5.4 to 8.1. Qualys also reported that 73% sat on internet-facing assets.

Read that carefully. It is one vendor's customer base, not the whole internet, and installed packages are not the same as reachable websites. What it does show is the uncomfortable part: most PHP in that sample is on versions that will never receive an official PHP2Shell release.

As for websites taken down, no outage or breach count attributable to PHP2Shell had been published by 25 October. The comparison that shows what PHP bugs can turn into is CVE-2024-4577, the PHP-CGI argument injection flaw on Windows from June 2024. It was weaponised within about 48 hours of disclosure and used in TellYouThePass ransomware attacks. GreyNoise counted 1,089 unique IP addresses attempting to exploit it in January 2025 alone, more than six months after the patch.

The root cause, without the jargon

Both bugs are memory-safety mistakes in the C code that runs underneath every PHP script. They are different mistakes that lead to the same place: memory the attacker can influence, which PHP then trusts.

CVE-2026-109619: stale state in upload progress

PHP can report how far a file upload has progressed, a feature controlled by session.upload_progress.enabled, which is on by default. Akamai's analysis describes the engine caching raw pointers into a hash table, then destroying and replacing that hash table without updating the cached pointers. Later code follows those pointers into freed memory, a use-after-free. Qualys describes the same class of problem as PHP keeping references to request data after its memory has been freed, so a later request served by the same worker can touch them.

CVE-2026-109618: corruption when memory runs out

When PHP hits its memory limit partway through setting up a request, it aborts the operation abruptly. Akamai explains that this jump skips local cleanup and initialisation, leaving structures half built. The cleanup code that runs afterwards then trusts those half-built structures. An attacker who can make a request exhaust memory at the right moment can turn that into corruption and, with more work, into code execution.

Exploitation is not trivial: researchers note that a working exploit needs offsets specific to the PHP build. That is a speed bump, not a wall. Popular distributions ship identical builds to millions of servers, so one set of offsets covers a lot of targets.

Are you affected? Check every PHP, not just the one you know about

The common mistake is checking the PHP version on the command line and assuming the web server runs the same one. Servers often have several versions installed, and containers carry their own. Check what actually serves requests.

# What the command line sees (may differ from the web server)
php -v

# Every PHP binary on the host
ls /usr/bin/php* /usr/sbin/php-fpm* 2>/dev/null

# PHP inside each running container
for c in $(docker ps --format '{{.Names}}'); do
  docker exec "$c" php -r 'echo PHP_VERSION, PHP_EOL;' 2>/dev/null | sed "s/^/$c: /"
done

# Is upload progress enabled? (CVE-2026-109619 path)
php -i | grep session.upload_progress.enabled

Compare each result with the fixed versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and later in the same branch. Anything on 8.1 or older is vulnerable with no official PHP release, so check whether your operating system vendor ships a backported package. Debian, Ubuntu and Red Hat track these separately from php.net, and their package version numbers do not match upstream numbering.

How to fix PHP2Shell

1. 1

   Inventory

   List every host and container image that runs PHP, including staging and forgotten admin tools. A vulnerable test server on the internet is a production problem.

2. 2

   Upgrade

   Move each one to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to your distribution's patched package. For Docker, rebuild images on the patched base tag rather than patching running containers.

3. 3

   Restart the workers

   PHP-FPM pools and Apache keep the old binary in memory until they restart. A package upgrade without a restart leaves the old code running.

4. 4

   Plan off end-of-life PHP

   8.1 and older will not get an official fix. Use that as the forcing event for the upgrade that was probably already overdue.

5. 5

   Verify

   Re-run the checks above against what serves traffic, and keep the output as evidence.

If you cannot patch today

The PHP project's position, as reported by watchTowr, is that no configuration change fully mitigates these vulnerabilities. The settings below reduce exposure while an upgrade is scheduled; they do not replace it.

• Disable upload progress tracking with session.upload_progress.enabled=0. Qualys lists this as the key interim step for CVE-2026-109619, and most applications do not use the feature.
• Keep sensible request limits (post_max_size, upload sizes and max_input_nesting_level) so a single request cannot drive PHP to its memory limit cheaply.
• On PHP 8.5, set fatal_error_backtraces=0 administratively, as Qualys recommends.
• For PHP-FPM, consider pm.max_requests=1 so state cannot carry from one request to the next. Measure the performance cost first.
• Restrict network access to PHP applications that do not need to be public, such as admin panels and internal tools.
• Put a web application firewall rule in front if your provider has published one, and treat it as a bridge rather than a fix.

On shared hosting or a control panel?

Many business websites run on shared hosting or a server managed through a control panel, where the customer cannot upgrade PHP directly. In that case the provider applies the fix, and your job is to confirm it happened. Ask which PHP builds your account uses and whether they have been updated to the October 2026 releases or to vendor packages that include the fixes.

Control panels usually offer several PHP versions side by side. Check that each site is set to a supported version, not just that a patched version exists on the server. A site left on PHP 7.4 or 8.1 for compatibility will not benefit from a patched 8.3 next to it.

After patching: assume nothing, check for signs

Attempts were seen before the patch existed, so an exposed server that was unpatched between 17 and 21 October deserves a look. A web server compromise usually leaves traces even when the exploit itself does not.

• New or modified .php files in upload, cache or temporary directories, especially files with unfamiliar names.
• Processes started by the web server user that it would not normally run, such as shells, curl or wget, or crypto miners.
• Outbound connections from the web server to addresses your application never talks to.
• Unexpected cron entries, SSH keys or new users created on the host.
• Database credentials or API keys in the application configuration that should now be rotated if any of the above is found.

What PHP2Shell teaches about running PHP in production

Two things decided how exposed an organisation was this week. The first was whether it knew where its PHP ran. Teams with an inventory patched in hours; teams without one spent the first day finding servers. The second was the version line. Being on a supported branch turned a crisis into a routine upgrade, while sitting on end-of-life PHP turned it into an emergency migration under attack.

Container images deserve particular attention. A patched host does not patch the PHP inside a container built three months ago. Rebuilding images on a schedule, rather than only when something breaks, is what makes the next PHP2Shell a one-day job.

Finally, the leak is a reminder that coordinated disclosure can fail. Plan for the case where the fix and the exploit arrive together: keep patch windows short, keep rollback simple, and keep the list of internet-facing PHP endpoints short and known.