PHP2Shell (CVE-2026-109618, CVE-2026-109619): Check Your Site and Patch PHP

PHP2Shell is the name given to two critical vulnerabilities in PHP itself, fixed on 21 October 2026. Both let an attacker who isn’t logged in run their own code on a web server, and both affect PHP regardless of the application on top: WordPress, Laravel, Drupal or a hand-written site are all in scope. Attacks started within days of the release, and on 26 October CISA added both CVEs to its catalog of actively exploited vulnerabilities.

• CVE-2026-109618 (memory corruption): when PHP runs out of memory while it is still setting up a request, some request memory can be left uninitialised and later used during cleanup.
• CVE-2026-109619 (stale request state): some internal state can keep pointing at memory from an earlier request, so the next request handled by the same PHP worker acts on leftover data. It can also disclose memory.

NVD scores them 9.8 and 8.1 (CVSS 3.1); the PHP project rates both 9.2 (CVSS 4.0).

Who is affected

Every PHP installation that serves web requests: PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP, on Linux and Windows. The PHP project rates Apache mod_php as the highest risk, because an attack can succeed before any of the site’s own code runs.

PHP branch	Fixed in	Status
8.5	8.5.12	Supported
8.4	8.4.27	Supported
8.3	8.3.36	Security fixes only
8.2	8.2.35	Security fixes until 31 December 2026
7.4, 8.0, 8.1	No official release	Source backports or your vendor’s packages
7.3 and older	No fix	Upgrade to a supported branch

What our check looks at

We load your page like a visitor would and read the PHP version your server announces, usually in the X-Powered-By header. We compare it with the affected ranges above. We send no exploit and no special request.

Two things a version check can’t see:

• Distribution packages. Ubuntu, Debian, Red Hat, AlmaLinux and other vendors patch PHP without changing its version number (for example 8.1.2-1ubuntu2.x). We report those builds as “may be patched”; your vendor’s security notice is the authority.
• Hidden versions. If the header is switched off, or a proxy such as IIS or a CDN sits in front of PHP, we can’t tell which PHP runs behind it. That is not proof of safety: check on the server with php -v.

How to fix it

1. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later) from php.net, or install your distribution’s security update:

   # Debian / Ubuntu
   sudo apt update && sudo apt install --only-upgrade 'php*'
   # RHEL / AlmaLinux / Rocky
   sudo dnf upgrade 'php*'
   

2. Restart every PHP process afterwards (PHP-FPM, Apache with mod_php, LiteSpeed). Updated packages don’t patch workers that are already running:

   sudo systemctl restart php8.3-fpm   # use your version's service name
   sudo systemctl restart apache2      # or httpd
   

3. On shared hosting or a control panel (cPanel, Plesk, DirectAdmin), pick an updated PHP version for each site or ask your host which patched build they run.

4. On PHP 7.4, 8.0 or 8.1, move to a supported branch. If you can’t yet, use your vendor’s patched packages or the PHP project’s minimal source backports.

5. Hide the version afterwards: set expose_php = Off in php.ini.

If you can’t update today

The PHP project says no configuration change makes an installation safe; these only reduce the risk until you update. Set them in php.ini or the FPM pool (not with ini_set()), then restart PHP:

; CVE-2026-109619
session.upload_progress.enabled = 0
; PHP 8.5 only
fatal_error_backtraces = 0

Restricting who can reach the server, and a web application firewall with rules for PHP2Shell, also help in the meantime.

Known regression

PHP 8.4.27 and 8.5.12 can crash PHP processes in some applications that use the SimpleXML extension (php-src issue #24488). The cause is a separate garbage-collector fix in the same releases, not the security patch. Stay on the fixed release and watch for the next bugfix release rather than downgrading.

FAQ

How do I know if my site is affected?

Run php -v on the server and compare it with the table above, or check your distribution’s security notice for its package version. Our scan shows the version your site exposes publicly, but only the server can confirm installed packages and backported fixes.

Is it being exploited?

Yes. Attack attempts were seen from the day of the release, and CISA lists both CVEs as known exploited vulnerabilities since 26 October 2026. Treat an unpatched, internet-facing PHP server as urgent.

Our version is hidden. Are we safe?

Not necessarily. Hiding the version only stops strangers from reading it. Confirm the version on the server, and update if it is below the fixed release of its branch.

Is a firewall or CDN enough?

A web application firewall may block known attack patterns, but it doesn’t remove the flaw. Update PHP and restart its workers regardless.

Where can I read more?

The PHP security advisory, the GitHub advisories for CVE-2026-109618 and CVE-2026-109619, and CISA’s Known Exploited Vulnerabilities catalog. Imperva also runs a separate PHP2Shell checker.