PHP2Shell vulnerability is the name security researchers use for two critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, that can let an unauthenticated attacker run code on a web server with a single crafted request. Both flaws score 9.2 out of 10 on the CVSS v4.0 severity scale, and the PHP project released emergency fixes on October 21, 2026.
PHP is used by nearly 70% of websites with a known server-side programming language, according to industry estimates reported by TNND. The same report says Palo Alto Networks identified more than 22.6 million potentially vulnerable internet-connected instances, a figure that does not represent unique websites or confirmed breaches.
That sounds like a lot, and it is. But the fix exists, and acting on it is manageable. We’ll walk through it together.
In this article, we’ll cover what PHP2Shell is, who is affected, whether it is being exploited, how to protect your website, and how to check your site for free.
What Is the PHP2Shell Vulnerability?
PHP2Shell is a pair of separate bugs in the PHP runtime itself. Both can lead to remote code execution (RCE), which means an attacker can make your server run commands of their choosing.
Canada’s Cyber Centre classifies both as use-after-free flaws (CWE-416) and says successful exploitation could allow an unauthenticated threat actor to execute arbitrary code on an affected system.
Let’s look at what makes these two flaws different:
- CVE-2026-109618. This one involves out-of-memory corruption. When a request pushes PHP past its memory limit, PHP can stop while internal request data is only partly set up, and the cleanup step then treats that broken data as valid.
- CVE-2026-109619. This one involves stale global state. Internal data owned by one request can survive after its memory has been freed, which gives an attacker something to reuse.
- No login required. Neither flaw needs a username or password, so any internet-facing PHP server is a potential target.
- The runtime is the problem. The flaws sit in PHP core, not in a plugin or a library. Updating your WordPress plugins or application dependencies does not close them. The PHP version on the server has to change.
Who Is Affected by PHP2Shell?
PHP says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Help Net Security reports that the project sees the highest risk in mod_php setups.
In practice, that includes content management systems like WordPress, online stores, customer portals, and custom web applications built on PHP. If you are not sure which of those you run, your developer or hosting provider can tell you in minutes.
Here are the fixed versions for each branch:
| PHP branch | Fixed version | What to do |
|---|---|---|
| 8.5 | 8.5.12 | Update now |
| 8.4 | 8.4.27 | Update now |
| 8.3 | 8.3.36 | Update now |
| 8.2 | 8.2.35 | Update now |
| 8.1 and older | No fix released | Upgrade to a supported branch |
Linux distributions have published their own fixed packages, and those can carry different version numbers than the upstream releases. If your server reports an older-looking version, confirm the exact package with your hosting provider before you assume you are exposed or safe.
Is PHP2Shell Being Exploited?
As of October 22, 2026, reports of exploitation attempts are circulating, and sources differ on how far they have gone. Details of the flaws leaked on October 20, ahead of the planned disclosure, and PHP announced an emergency release.
On October 21, watchTowr said it was observing active exploitation attempts against both flaws, although no confirmed break-in had been reported at that point. CISA said it had not observed exploitation when it published its alert that day, and neither CVE appeared in CISA’s Known Exploited Vulnerabilities catalog as of October 22.
That mix of signals is worth reading carefully. A flaw missing from the catalog does not mean attempts are not happening. It means the catalog had not been updated yet.
The practical takeaway is simple. Treat PHP2Shell as urgent, not as a reason to panic. Attempts are being seen, and the fix is available.
How Do You Protect Your Website from PHP2Shell?
Updating PHP is the only complete fix. Everything else on this list reduces exposure while you get there.
Here’s what to do, in order:
- Find your PHP version. Ask your developer or hosting provider, or check your hosting control panel. Check every server, container, and staging environment that serves web requests, including the ones people forget about.
- Update to a fixed release. Move to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. If you run PHP 8.1 or older, plan an upgrade to a supported branch, because no fix was released for those versions.
- Restart everything after patching. Restart PHP-FPM or your web server. A patched file on disk does not protect a process that is still running the old code in memory.
- Apply stopgaps if you cannot patch today. For CVE-2026-109618, PHP’s guidance is to set memory_limit=-1 so applications cannot override it, keep post_max_size low, and enforce request-size limits at the web server or proxy. For CVE-2026-109619, turn off session.upload_progress.enabled if you do not use it. That blocks one demonstrated attack path only and does nothing for CVE-2026-109618.
- Do not rely on a firewall alone. Cloudflare deployed emergency web application firewall rules on October 21 and reported that attackers were already changing their payloads to get around them. Rules can buy you time. They do not replace the update.
- Watch for unusual activity. Alert when a PHP or web server process starts a shell such as sh or bash. If you suspect a server was already compromised, capture evidence before you restart it and bring in an incident response team.
Agencies including CISA and CERT-EU have advised isolating or taking PHP-based systems offline when they cannot be updated promptly. For a business website, that is a hard call, so it is worth deciding in advance who makes it.
How Can You Check Whether Your Website Is Affected?
The fastest first step is a version check. It tells you whether the PHP version your site is running falls in the affected range.
PentX, CyberGlobal’s autonomous AI penetration testing platform, includes a free, read-only PHP2Shell checker. You enter your website, and it detects whether the site runs a vulnerable PHP version. Read-only means it does not change anything on your site.
Check your website for PHP2Shell, free: https://pentx.ai/php2shell
Let’s be clear about what a version check can and cannot do. It can only report what a server exposes about itself. It is not a full security assessment, and it does not replace patching.
That is where a broader look helps. An infrastructure vulnerability assessment shows what else is out of date, and external network penetration testing shows how an outsider would see your systems. If your website handles customer data, web application security testing covers the application layer too.
Why Does Speed Matter More With AI-Assisted Attackers?
PHP2Shell shows how quickly the gap between disclosure and attack can close. Wiz researchers said the underlying flaws had been present for decades, but turning them into working exploits took an exceptionally complex chain of steps, and frontier AI models substantially lowered that barrier.
For defenders, that changes the math. Testing once a year leaves long stretches where a new flaw can sit unnoticed. If you are new to how fast an attack can follow a disclosure, our guide to what a zero-day exploit is explains the timeline.
The same technology can work for you. Autonomous testing can run continuously, flag new exposure quickly, and free up people for the judgment calls. Our guide to AI penetration testing explains how it works and where it still needs human review.
Frequently Asked Questions
What is the PHP2Shell vulnerability?
PHP2Shell is the nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that can allow an unauthenticated attacker to execute code on a web server. Both score 9.2 on the CVSS v4.0 scale. PHP released fixes on October 21, 2026, for versions 8.2 through 8.5.
Which PHP versions fix PHP2Shell?
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. No fix was released for PHP 8.1 and older, so those systems need an upgrade to a supported version. After updating, restart PHP-FPM or your web server so running processes use the patched code.
Is PHP2Shell being exploited in the wild?
Security researchers, including watchTowr, reported active exploitation attempts against both flaws on October 21, 2026. As of October 22, 2026, neither CVE was listed in CISA’s Known Exploited Vulnerabilities catalog. Treat it as urgent and patch internet-facing systems first.
How do I check whether my website is vulnerable to PHP2Shell?
Find the PHP version running on every server that serves your website and compare it to the fixed releases. For a quick outside-in check, CyberGlobal’s free, read-only PHP2Shell checker at https://pentx.ai/php2shell tests whether a site runs a vulnerable PHP version. Confirm the result with your hosting provider.
Can a web application firewall stop PHP2Shell?
A web application firewall can reduce exposure, but it does not fix the flaws. Cloudflare deployed emergency rules on October 21, 2026, and reported that attackers were already changing their payloads to get around them. Patching PHP is the only complete fix.
Strengthen Your Website’s Security with CyberGlobal
PHP2Shell is a reminder that even the software underneath your website needs regular attention. The update is straightforward. Knowing where to apply it is the part that takes some effort.
But with the right partner by your side, that effort gets lighter. At CyberGlobal, we work with businesses to find weak points before attackers do, from a quick version check to full penetration testing.
Our global network supports organizations of every size, and our clients include global brands like Mercedes-Benz, Red Bull, and Emirates. But behind our advanced technology, there are real people. They are happy to look at your setup with you, explain the results in plain English, and help you decide what to fix first.
Start with the free check, and get in touch if you would like an ally for the next step. Reach out today!
Check your website for PHP2Shell, free
One read-only check shows whether your site runs an affected PHP version.