LeptisCode
    Back to Writing

    Everything You Need to Know About PHP2Shell, the Critical PHP Flaws of October 2026

    Mohanid Elragel

    Two critical PHP vulnerabilities require server updates. What is affected, how to check your version, and what to do next.

    Everything You Need to Know About PHP2Shell, the Critical PHP Flaws of October 2026

    On 21 October 2026, PHP shipped emergency updates for two critical flaws, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Both let an attacker run code on a web server without logging in. If anything you run is built on PHP, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 today.

    What happened

    The PHP security team announced a critical release on 20 October. Details leaked before the fix arrived on 21 October, and Cloudflare saw attacks that same morning. The bugs were found by Wiz Research, and both score 9.2 out of 10 on CVSS v4.0.

    What the two flaws do

    • CVE-2026-109618: if PHP runs out of memory in the middle of a request, some internal data is left half set up. The cleanup step then trusts that broken data, and an attacker can turn this into code execution.
    • CVE-2026-109619: some data from one request survives after its memory has been freed, so a later request can reuse it. Known paths include session upload progress, fatal error backtraces in PHP 8.5, and OPcache shared memory. JFrog's researchers add that the same bugs can leak server memory to an attacker, in a way similar to Heartbleed.

    Who is affected

    Every PHP version from 5.4 up to 8.5.11 is vulnerable. It does not matter how PHP runs: PHP-FPM, Apache with mod_php, CGI, FrankenPHP and LiteSpeed are all exposed. Apache with mod_php carries the highest risk, because the attack fires before your application code even loads.

    PHP branchFixed versionNotes
    8.58.5.12Also turn off fatal_error_backtraces if you cannot patch yet
    8.48.4.27Official fix
    8.38.3.36Official fix
    8.28.2.35Official fix
    8.1 and olderNone from PHPFix only through your Linux distro, host or a paid support vendor

    The flaw sits below your framework or CMS. Updating WordPress, Laravel, Drupal or your plugins does not fix it. WordPress.org has confirmed that no WordPress update is needed: the PHP update is the fix.

    How to check your servers

    1. Run php -v on the server, or look in your hosting control panel. In WordPress, go to Tools, then Site Health, then Info, then Server.

    2. Be careful with the number you see. Linux distributions often apply the fix without changing the version string, so check your distro's changelog or ask your host directly.

    What to do now

    1. Update and restart. Install the fixed PHP release, then restart PHP-FPM or Apache so every worker loads the new version.

    2. Managed or shared hosting: confirm with your host. Kinsta, WP Engine, Pantheon, OVHcloud, Plesk and cPanel have all shipped or are rolling out fixes.

    3. Your own VPS: nobody will patch it for you. Ubuntu and Ondřej Surý's packages already carry the fix. The Remi repository was slower.

    4. PHP 8.1 or older: plan the move to 8.2 or newer, and test on a staging copy first. If you run the server yourself and cannot upgrade, the UK's NCSC and WordPress.org suggest taking the site offline until you can.

    5. Behind Cloudflare: firewall rules against these attacks are live on every plan, including free. On paid plans, set managed rules to block, not just log. Treat this as an extra layer, not a fix.

    If you cannot patch today

    These steps reduce exposure but do not make a server safe:

    • Set session.upload_progress.enabled = 0 and restart PHP. This blocks one attack path for CVE-2026-109619.
    • On PHP 8.5, turn off fatal_error_backtraces, which is on by default.
    • Removing PHP's own memory limit and keeping upload sizes low narrows CVE-2026-109618, but you then need a memory limit at server level instead.

    After you patch

    Attacks started before the fix was public, so patching does not tell you whether you were hit. Check logs from 20 October onward for unusual requests, look for new files in your web root and unknown admin accounts, and rotate database passwords and API keys if anything looks wrong.

    How LeptisCode can help

    We can check which of your servers are exposed, apply the update, and test your application afterwards so nothing breaks in production. Get in touch with LeptisCode.

    Sources

    • PHP2Shell, Wikipedia
    • Responding to core PHP vulnerabilities, Google Cloud
    • PHP2Shell: All You Need to Know, JFrog Security Research
    • PHP Security Release on 21 October 2026, Codeable
    • Critical PHP Security Release, InMotion Hosting
    • Critical PHP vulnerabilities, University of Washington IT