PHP2Shell: Two Critical PHP Vulnerabilities Allow Web Server Takeover

• What happened: on October 21, 2026, the PHP project released patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Both have a CVSS 4.0 score of 9.2.
• The risk: an attacker with no username or password can end up running code on your web server and taking control.
• Who is affected: any PHP installation that serves web requests, including sites built with WordPress, Drupal, Joomla or Laravel.
• What to do today: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you use PHP 8.1 or earlier, migrate to a supported version.

PHP is the language behind a huge part of the web: WordPress, most online stores built on WooCommerce, forums, intranets and thousands of custom applications. When the flaw is in PHP itself, not in a plugin or a theme, the problem reaches every site that uses it, no matter how well maintained the rest is.

On October 20, the PHP team announced a critical security update for the following day. On October 21 it released the fixed versions and an advisory with a direct message: update now. That same day, the cybersecurity center of the European institutions (CERT-EU) and Spain's INCIBE-CERT issued their own alerts, both rated critical.

According to CERT-EU, public proofs of concept are already circulating and attackers may be using them. The demonstrated exploit needs a single unauthenticated request, and it can be triggered before any line of your application's code runs. That is why having well-written code is not enough: the flaw is in the layer underneath.

CVE-2026-109618: memory corruption when running out of memory

PHP limits the memory each request can use with the memory_limit directive. When that limit is reached, PHP abruptly stops execution. The problem is that this interruption can happen while PHP is still processing the request data, for example while a file is being uploaded from a form. During cleanup, PHP may free memory that was never fully initialized, and that corruption can be exploited to run code.

INCIBE notes that remote code execution was validated against Apache with mod_php, and that PHP-FPM is considered susceptible, although a complete exploit through that path has not been demonstrated.

CVE-2026-109619: global state that survives between requests

A single PHP process serves many requests in a row. This flaw makes part of a request's internal state keep existing after its memory is released, for example after a fatal error. The next request handled by that same process can use that state before it is reset, which can lead to information leaks and code execution. There are confirmed exploitation paths in Apache mod_php and in PHP-FPM, and PHP 8.5 has an additional route related to fatal error backtraces.

According to CERT-EU, every PHP installation that serves web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team itself considers mod_php the highest-risk configuration.

• PHP 8.5: versions before 8.5.12 are affected. Fixed version: 8.5.12.
• PHP 8.4: versions before 8.4.27 are affected. Fixed version: 8.4.27.
• PHP 8.3: versions before 8.3.36 are affected. Fixed version: 8.3.36.
• PHP 8.2: versions before 8.2.35 are affected. Fixed version: 8.2.35 (end of support: December 31, 2026).
• PHP 8.1 and earlier: all versions affected. No official update; minimal source patches exist for 7.4, 8.0 and 8.1, but migrating is the recommended path.

The impact is already visible. According to RedesZone, Cloudflare reported the first attacks and rolled out web application firewall (WAF) rules for all its customers, including the free plan. Several government sites in Finland and the Netherlands, the University of Vienna and the University of Freiburg took services offline as a precaution. The same outlet cites an estimate from the firm Mallory of about 884,000 exposed servers still running PHP 8.1 or earlier.

• Check your PHP version. If you have server access, run php -v. On shared hosting, look in the control panel (cPanel, Plesk or similar), usually under "PHP version".
• Compare it with the list. If it is older than the fixed version for its branch, or it is 8.1 or older, your site is exposed.
• Don't forget products that bundle their own PHP. Some panels, applications and appliances include their own PHP. The Dutch NCSC maintains a public list of affected products.
• If you don't know how to check, ask your hosting provider. Ask in writing for the exact PHP version on your account and the date they will apply the patch.

• Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch. It is the only complete fix.
• If you use packages from your Linux distribution (Debian, Ubuntu, Red Hat and others) or from a vendor with extended support, confirm the update already includes the fix. Distributors received the patches in advance.
• If you use the rpms.remirepo.net repository, note that it will not have the update on release day. PHP recommends switching to your distribution's packages or building from source.
• If you are still on PHP 8.1, 8.0, 7.4 or earlier, plan the migration to a supported version. The minimal patches for 7.4, 8.0 and 8.1 are a stopgap, not a permanent solution.
• If you cannot update a system exposed to the internet, isolate it from the public network until the patch is applied and verified, as CERT-EU recommends.
• Restart all PHP processes (PHP-FPM and the web server) after updating or changing configuration.

If you need a few hours to update, the official advisory and CERT-EU describe measures that reduce exposure but do not remove it. Apply them only as a stopgap and with help from whoever manages your server:

For CVE-2026-109618

• Set memory_limit=-1 in a way the application cannot change (for example, with php_admin_value in PHP-FPM or Apache) and verify that no other setting fixes a limit again. A value such as memory_limit=128M does not disable the vulnerability.
• Keep post_max_size as low as possible: 8M if the site does not receive files, 32M if it needs them, with upload_max_filesize below it.
• Limit memory with the container or a cgroup, not with RLIMIT_AS or RLIMIT_DATA, which can trigger the vulnerable path.
• Limit the size and number of request fields at the web server or proxy.

For CVE-2026-109619

• Set session.upload_progress.enabled=0 in php.ini, in the PHP-FPM pool or in the server configuration, and restart all processes. CERT-EU warns that ini_set() or .user.ini are not enough.
• On PHP 8.5, also set fatal_error_backtraces=0.
• Remove obsolete or invalid directives and fix fatal errors and timeouts that a visitor can trigger. Hiding errors with display_errors or @ does not protect you.

If your site is behind Cloudflare, its WAF rules add an extra layer while you update, but they do not replace the patch either.

2021: a backdoor in PHP's source code

On March 28, 2021, someone compromised PHP's official Git server (git.php.net) and pushed two malicious commits to the source code, impersonating two of its main developers, Rasmus Lerdorf and Nikita Popov. The changes were disguised as a minor fix ("Fix typo") and included a backdoor: it executed the code sent in a manipulated HTTP header if the text started with the word "zerodium". The maintainers detected and reverted it quickly, and the project moved its official repository to GitHub.

The lesson: the risk is not always in your code. It can also be in the supply chain of the software you use.

2024: CVE-2024-4577, the PHP-CGI flaw on Windows

In June 2024, the DEVCORE research team reported an argument injection vulnerability in PHP when used in CGI mode on Windows. Because of an automatic Windows character conversion ("Best-Fit"), an attacker could bypass an old protection (from CVE-2012-1823) and run code remotely. It affected, among others, the default XAMPP configuration on Windows. It was fixed in PHP 8.3.8, 8.2.20 and 8.1.29, received a CVSS score of 9.8 and was actively exploited shortly after publication; the US cybersecurity agency (CISA) added it to its catalog of known exploited vulnerabilities.

The lesson: when a serious flaw is published, attacks arrive within days. The window to update is very short.

• Always use a supported PHP version. Check the dates on the official supported versions page. PHP 8.2 stops receiving patches on December 31, 2026.
• Have someone responsible for server updates, not just for WordPress and its plugins.
• Put a web application firewall (WAF) in front of your site. It does not replace patches, but it buys you time.
• Keep automatic backups stored off the server, so you can recover quickly if something goes wrong.
• Monitor your site: unexpected file changes, new users in the admin panel or unusual traffic spikes can be signs of an attack.

What is PHP2Shell?

It is the name given to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, published on October 21, 2026. Both have a CVSS 4.0 score of 9.2 and can allow an unauthenticated attacker to run code on the web server.

Which PHP versions fix the vulnerabilities?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Branch 8.1 and earlier no longer receive official updates; minimal source patches exist for 7.4, 8.0 and 8.1, but the recommended path is to migrate to a supported version.

Is my WordPress site at risk?

WordPress runs on PHP, so any site served by an unpatched PHP version is exposed, even if WordPress and its plugins are up to date. What you need to update is the PHP version on your server or hosting.

How do I know which PHP version I am using?

On the server, run php -v. On shared hosting, look in the control panel (cPanel, Plesk or similar), usually in the PHP version section. You can also ask your hosting provider directly.

Are the temporary mitigations enough?

No. The PHP team, CERT-EU and INCIBE agree that only updating fully fixes the problem. Mitigations reduce exposure while the patch is applied.

My host says it takes care of everything. Do I need to do anything?

Confirm it. Ask in writing which PHP version your account uses and whether it already has the patch. Many hosts let you choose the PHP version, and if your site was left on an old branch, the automatic update does not always cover it.

• PHP. "Security advisory: Critical remote code execution vulnerabilities, update now" and releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (October 21, 2026). php.net/archive/2026.php
• CERT-EU. "Security Advisory 2026-018: Critical Vulnerabilities in PHP" (October 21, 2026). cert.europa.eu
• INCIBE-CERT. "Multiple vulnerabilities in PHP" (October 21, 2026, in Spanish). incibe.es
• RedesZone. "Two critical PHP vulnerabilities put the web at risk" (October 21, 2026, in Spanish). redeszone.net
• NCSC-NL. List of products affected by PHP2Shell. github.com/NCSC-NL/php2shell
• PHP. Supported versions. php.net/supported-versions.php
• DEVCORE. "Security Alert: CVE-2024-4577 - PHP CGI Argument Injection Vulnerability" (June 6, 2024). devco.re
• NIST. CVE-2024-4577 entry in the National Vulnerability Database. nvd.nist.gov
• CISA. Known Exploited Vulnerabilities Catalog. cisa.gov
• PHP.Watch. "git.php.net server compromised, move to GitHub, and delayed updates" (March 2021). php.watch
• BleepingComputer. "PHP's Git server hacked to add backdoors to PHP source code" (March 2021). bleepingcomputer.com