PHP2Shell: How to Check and Patch CVE-2026-109618 and CVE-2026-109619

Short answer: PHP2Shell is the nickname for two critical, unauthenticated remote-code-execution vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), patched in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026. The bug sits in the engine, not in WordPress, Laravel, Magento or any framework running on top of it, so updating your CMS or your Composer packages does nothing by itself. You have to patch the PHP runtime.

Key Takeaways

• PHP2Shell is two separate PHP-core RCE bugs, not a plugin, theme or framework issue, so application-level updates alone will not fix it.
• Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and every earlier branch, including all of PHP 7 and PHP 5, has no official fix from the PHP Foundation.
• Distro-packaged PHP on Ubuntu, Debian or RHEL can carry the backported fix without the version string changing, so php -v alone can mislead you.
• Disabling session.upload_progress is a partial stopgap reported for one of the two bugs, not a substitute for patching.
• Because the flaws can expose process memory, treat credential rotation as part of the response, not an optional extra step.

What PHP2Shell Actually Is

On October 21, 2026, the PHP Foundation released emergency security updates fixing two critical vulnerabilities that security researchers quickly nicknamed PHP2Shell. Both are rated CVSS 9.2 and both allow unauthenticated remote code execution, the most severe outcome a web vulnerability can have. Coverage of the disclosure put the number of affected live sites above 70% of the web, because the bug lives in the language runtime that WordPress, Laravel, Magento, Drupal and most custom PHP applications all sit on top of.

Public reporting disagrees on some of the technical detail. Several outlets tie the vulnerabilities to PHP's handling of session.upload_progress, which is enabled by default; others describe a separate memory-corruption issue in a different part of the engine. Sources also disagree on which of the two CVE numbers owns which mechanism, and a leaked proof-of-concept forced the PHP Foundation to release the patch earlier than its originally planned, coordinated disclosure date. Treat the exact internals as unsettled and focus on the part that is not in dispute: the fix is out, and the fastest path to safety is applying it.

Who Is Affected

If you run WordPress, Laravel, Magento, Drupal, or a custom PHP application, the question that matters is not "is my CMS current" but "what PHP version is actually executing my requests, on every server that handles them." A fully updated WordPress install on an unpatched PHP runtime is still exposed, because the application's own checks, and the framework's, never get a chance to run before the engine-level flaw is reachable.

How to Check If You Are Actually Patched

1. Run php -v on every server, container and serverless environment that serves web requests, including PHP-FPM, mod_php and php-cgi specifically, not only your primary application host.
2. If you are on Ubuntu, Debian or RHEL and the version string looks old, do not assume you are vulnerable or safe either way. These distributions backport security fixes into their packages without changing the upstream version number, so confirm directly with your distro's security advisories or your host.
3. If you are on shared or managed hosting, ask your host in writing, by name, whether the server-level PHP runtime behind your account has been patched, and when. Independent monitoring of live sites found that only a small fraction had moved to a fixed version in the hours after release, so do not assume it has already happened for you.
4. If you cannot get a clear answer within a day, treat the site as unpatched and apply the mitigations below until you can confirm otherwise.

If You Cannot Patch Today

Patching the PHP runtime is the only complete fix, but if you are waiting on a host, a change window, or a vendor, two interim steps reduce exposure without eliminating it.

• Disable session upload progress. Setting session.upload_progress.enabled = Off closes one reported attack path. It is on by default, which is part of why exposure is so broad. Treat it as a stopgap, since researchers differ on whether it blocks one or both of the two underlying bugs.
• Isolate what you can. Where immediate patching is not feasible, pulling an internet-facing application behind a VPN, IP allowlist, or a WAF rule that blocks the known trigger pattern reduces the window of exposure while you arrange the real fix.

Neither step replaces the patch. Both only reduce how long you are exposed while you get it applied.

After You Patch: What to Rotate

Security researchers reported that the underlying flaws can expose process memory, which may include database credentials, session secrets, API keys, and certificates handled by the same worker process. That does not mean every credential on every patched server was definitely read, but it means you cannot rule it out from the outside. The reasonable response is to rotate anything sensitive that the affected application touches once you have patched, rather than assume nothing happened. We cover exactly what to prioritize and in what order in our credential rotation checklist.

A Short Checklist

1. Identify every server, container, and host that executes PHP for this application.
2. Confirm the real patch status of each one directly with the distro or host, not just the version string.
3. Patch anything not already on 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
4. Apply the interim mitigations above to anything still waiting on a patch window.
5. Rotate credentials the application had access to once every instance is confirmed patched.
6. If you are still on PHP 8.1 or earlier, treat the migration itself as the real fix, since no further patch is coming.

If you would rather have someone else run this checklist against your actual infrastructure, our web development team can audit your stack, confirm patch status across every environment, and handle the migration if you are stuck on an unsupported PHP branch. Tell us what you are running and we will respond within 24 hours. If your team is also asking what an incident like this should change about your ongoing security posture, see why "we updated WordPress" was not enough.

Frequently Asked Questions