Our Blog
PHP2Shell: The Critical PHP Flaw Every Website Owner Must Patch Now
Published By Fisher Media at 24-10-2026
Last updated: 24 October 2026
PHP runs most of the web. It powers WordPress, Drupal, Joomla, Laravel and countless custom sites. So when two critical flaws were found in PHP itself this week, it became one of the biggest security stories of the year.
The flaws are being called PHP2Shell. They let an attacker run their own code on a website's server, often without logging in. If your site runs on PHP, you should patch it now.
Here is what happened, who is affected and exactly what to do, in plain language.
What is PHP2Shell?
PHP2Shell is the name for two vulnerabilities in the core PHP engine:
- CVE-2026-109618: When PHP runs out of memory while it is still setting up a request, some data is left half ready. PHP later treats that data as valid, which gives an attacker a path to run code.
- CVE-2026-109619: PHP can keep pieces of one request in memory after that memory has been freed. If the same worker then handles another request, it can reuse that stale data. This can leak secrets from memory or lead to code execution.
Both are rated 9.2 out of 10 (critical) on the CVSS 4.0 scale. "Shell" in the name refers to what an attacker gets if the attack works: a command line on your server.
Why this one is so serious
- It is in PHP itself. This is not a bad plugin or theme. The flaw sits underneath your CMS, so being careful with plugins does not protect you.
- No login needed. Researchers showed attacks against WordPress, Drupal and Joomla sites without any username or password. On some setups the attack happens before your site's own code even runs.
- Secrets can leak. The memory bug can expose passwords, session tokens, API keys and certificates.
- The scale is huge. Palo Alto Networks counted over 22.6 million internet-facing PHP instances that may be vulnerable.
- Attacks are already happening. AWS reported exploit attempts from 17 October, before the fix was public. Reports of attack attempts rose into the millions within a day of release.
How it unfolded
- 17 October: AWS later reported seeing exploit attempts from this date.
- 20 October: Details leaked online before the planned disclosure date. The PHP security team confirmed the issue and moved the fix forward.
- 21 October: PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Security firms published technical write-ups the same day.
- 23 October: PHP shared a separate, lower-risk issue (CVE-2026-115560). More on that below.
Am I affected?
If your website runs on PHP and serves web pages, assume yes until you check. PHP says every setup that handles web requests is in scope. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
You are safe from PHP2Shell only if your PHP is at or above the fixed version for your branch:
- PHP 8.5: 8.5.12 or later
- PHP 8.4: 8.4.27 or later
- PHP 8.3: 8.3.36 or later
- PHP 8.2: 8.2.35 or later
- PHP 8.1 and older: these are out of official support. PHP published source patches for 7.4, 8.0 and 8.1, but the safest move is to upgrade to a supported version.
How to check: your hosting control panel usually shows the PHP version. In WordPress, go to Tools, then Site Health, then Info, then Server. Developers can run php -v, but note that the command line PHP can differ from the PHP that serves your website. Some Linux and hosting providers also patch older version numbers quietly, so check your provider's security notice too.
What to do right now
- List every PHP site you own. Include old microsites, staging servers, landing pages and any tools with a web panel. Forgotten sites are the easiest targets.
- Patch internet-facing sites first. Upgrade to the fixed version for your branch. On shared hosting, ask your host to confirm they have patched.
- Restart PHP after patching. Old PHP workers keep running the old code until they restart. Rebuild any Docker images too.
- Test your site. Check forms, logins, checkout and other key pages after the upgrade.
- Change secrets if you were exposed. If your site was unpatched and public, consider rotating admin passwords, API keys and database passwords.
If you cannot patch today
Only patching fully fixes PHP2Shell. These steps just lower the risk while you plan the upgrade:
- Put the site behind a firewall or WAF, or limit who can reach it.
- Ask your developer or host to set
session.upload_progress.enabled = 0in php.ini and restart PHP. On PHP 8.5, also setfatal_error_backtraces = 0. - Limit the size of incoming requests at your web server or proxy.
Signs your site may already be hit
- New or unknown PHP files in your website folders, especially in upload or temp folders
- New admin users you did not create
- New scheduled tasks or cron jobs
- PHP processes starting shells or download tools like curl or wget
- Sudden spikes in traffic, CPU use or outgoing connections
If you see any of these, take the site offline or isolate the server, keep your logs and get expert help before you clean up.
One more issue to know about
On 23 October, PHP shared a separate flaw, CVE-2026-115560. It only affects sites with an unusual session setup. PHP calls exploitation unlikely and no attacks have been reported. The fix will come in a normal future release. Until then, setting session.upload_progress.enabled = 0 protects you. If you already did this for PHP2Shell, you are covered.
The bigger lesson
PHP2Shell was being used before most site owners had even heard of it. The teams that stayed safe were the ones who knew what each site ran on and could patch within hours. Regular updates, monitoring and a simple list of every site you own make all the difference.
Frequently asked questions
What is PHP2Shell in simple words?
PHP2Shell is the name for two critical bugs in PHP itself (CVE-2026-109618 and CVE-2026-109619). They can let an attacker run their own code on a website's server, often without logging in.
Is my WordPress or Drupal website affected?
If your server runs PHP below 8.5.12, 8.4.27, 8.3.36 or 8.2.35, yes. The flaw is in PHP, not in WordPress or Drupal, so plugin and theme updates alone do not fix it.
Will updating PHP break my website?
Usually not when you update within the same branch, for example from 8.3.30 to 8.3.36. Moving to a new major branch can affect old plugins or custom code, so test on a staging copy first.
I am on shared hosting. Do I need to do anything?
Your host controls the PHP version. Ask them to confirm in writing that your server runs a patched version. If they cannot, it may be time to move to a better host.
How can Fisher Media help secure my website?
We check which PHP version each of your sites runs, patch and test on a staging copy first, then update the live site with as little downtime as possible. We also look for signs of an attack and help you clean up if needed. Talk to us.
Does Fisher Media offer ongoing website maintenance?
Yes. We maintain websites for brands like Asian Paints Berger. Our plans cover regular updates, security monitoring, backups, speed fixes, SEO and GEO, so issues like PHP2Shell are handled before they become a problem.
Need help?
Fisher Media looks after websites built on WordPress, Drupal and custom PHP. We can check your PHP version, patch and test your sites and set up monitoring so you hear about the next issue early. Talk to us and we will help you get secure fast.
