PHP2Shell: Critical vulnerabilities in PHP. Are your websites and servers safe?

On Wednesday, 21 October 2026, the PHP team shipped an emergency security release. It fixes two critical vulnerabilities in the PHP core – CVE-2026-109618 and CVE-2026-109619, widely referred to as PHP2Shell. Both are rated CVSS 9.2 out of 10 and, in the worst case, let an unauthenticated attacker run their own code on the server. WordPress, most online stores and many business applications run on PHP, so a large share of websites is affected.

Details leaked a day before the fixes were released and the first public proof-of-concept exploits followed soon after. Security firms report exploitation attempts – so don’t put the update off.

What is PHP2Shell about?

Both flaws relate to how PHP manages memory between individual requests:

• CVE-2026-109618 – when a request hits the memory limit (memory_limit) at the wrong moment, PHP can leave internal data only partially initialised and later treat it as valid during cleanup. The result is memory corruption.
• CVE-2026-109619 – after a fatal error, internal state can keep pointing to memory that belonged to a previous request. A later request handled by the same worker may then use it (a so-called use-after-free).

Every PHP installation serving web requests is at risk – PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest with Apache and mod_php, where the attack can happen before any website code runs, even with default settings.

Which PHP versions are safe?

The fixes are included in:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

PHP 8.1 and older no longer receive updates from the PHP project. For 7.4, 8.0 and 8.1 there are only source patches that your system vendor or server administrator has to apply. If your website still runs on one of these versions, it’s high time to upgrade – ideally straight to 8.3 or 8.4, as PHP 8.2 also reaches end of life on 31 December 2026.

What it means for your business

A successful attack gives the attacker the same permissions your website has on the server. In practice this can mean:

• a takeover of your website or online store and injected malicious code,
• leaked customer data, orders or internal documents,
• your server being abused for spam, crypto mining or further attacks,
• downtime, reputational damage and possibly obligations under GDPR or NIS2.

What to do right now

1. Find out your PHP version. You’ll find it in your hosting control panel, in WordPress under Tools → Site Health → Info → Server, or ask your administrator.
2. Update. On shared hosting, the provider usually applies the fixes – check that they already have. On your own server or VPS, install the patched packages and restart PHP-FPM or Apache.
3. Don’t postpone old versions. Move PHP 8.1 and older to a supported version. Test your website and plugins on a copy first.
4. If you can’t update straight away, reduce the risk with the temporary measures recommended by PHP – for example by disabling session.upload_progress.enabled and setting sensible request size limits in PHP and on the web server. PHP explicitly warns, however, that only updating gives complete protection.
5. Check you haven’t already been hit. Review logs, unknown files in your website directories and new administrator accounts. Make sure you have a working backup.

How we can help

Whether you manage your website or server yourself or with another provider, we’ll be glad to sort it out with you as part of our web support and system and application support:

• Quick check – we find out the PHP versions and settings on your servers and hosting.
• Updates and upgrades – including testing your website and plugins so everything works after the change.
• Server hardening – request limits, process isolation, permissions and monitoring that reduce the impact of similar flaws in the future.

Get in touch – we’ll agree on what needs to be done and take care of it.

Sources: php.net – PHP security release, The PHP Foundation.