PHP2Shell: Two Critical PHP Flaws and How to Patch Them

PHP2Shell Explained: Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)

Two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, are being called PHP2Shell. Each is rated 9.2 on CVSS v4.0, and each lets an attacker run code on your web server without logging in. The only complete fix is to upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to a vendor-patched build.

What is going on

Both bugs are in the PHP engine, not in your application, so clean code won’t protect you. PHP handles the malicious request before your application code runs, which means login screens can’t stop it.

• CVE-2026-109618: If PHP runs out of memory mid-request, it can be interrupted while its internal data is half set up. Cleanup code then treats that broken data as valid.

• CVE-2026-109619: Request state can outlive the memory behind it, so a reused worker may touch stale data on a later request.

Every PHP setup that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The vulnerable code goes back to PHP 5.4 in 2012. Researchers report working attacks against current versions of WordPress, Magento, Drupal, Joomla, Nextcloud and phpMyAdmin.

Where things stand

Details leaked a day before the coordinated release, and Cloudflare saw exploit attempts on October 21, before patches were public. PHP shipped fixes later that day, and public proofs of concept followed on October 22. Vendors report attempts but no confirmed large-scale breaches so far. Treat it as active anyway, because an earlier flaw, CVE-2024-4577, was probed within 24 hours of disclosure.

Who is affected

Any PHP release older than the fixed version in its branch is vulnerable. PHP 8.1 and older get no official fix from php.net. If you run one of those, you need a backport from Debian, Ubuntu, Red Hat or an extended-support provider such as TuxCare, and then a planned upgrade. Plesk, cPanel and Palo Alto Networks have also published fixes or guidance.

What it can cost you

Code execution means the attacker acts as your web server. That can lead to:

• Stolen customer data

• Skimmed payments on stores like Magento or WooCommerce

• Ransomware

• Backdoors that survive the patch

• SEO spam and downtime

• Breach-notification duties under laws like the GDPR

Risk is highest on shared hosting, servers with many sites, and anything running end-of-life PHP.

How to patch

The PHP team says there is no complete mitigation, so update first.

1. Find every PHP install. Check servers, containers, staging sites, hosting accounts and control panels. Forgotten test servers are a common weak spot.

2. Check the version your web server actually uses. The command php -v shows the command-line version, which can differ from PHP-FPM or mod_php.

3. Install the patched release. On Debian or Ubuntu run sudo apt update && sudo apt upgrade, and on RHEL-family systems run sudo dnf upgrade. Rebuild container images from a patched base, because updating the host does not fix a container. On Plesk, cPanel or managed hosting, apply the vendor update or get your host to confirm in writing.

4. Restart PHP. Running processes keep the old code until they are restarted, for example with sudo systemctl restart php8.3-fpm, followed by a reload of your web server.

5. Verify the fix, not just the version number. Distributions often backport fixes without changing the version, so check the package changelog for both CVE IDs.

If you can’t patch yet

CERT-EU advises isolating internet-facing PHP apps from public networks. CISA goes further for PHP 8.1 and older and says to take them offline until patched. A web application firewall adds a layer, but it is not a substitute for the update.

Check for compromise

Assume exposure if you were online on October 20 or 21, and review logs from October 20 onward. Look for:

• New or recently modified .php files, especially in upload, cache or temp folders

• New admin users, changed passwords or unfamiliar scheduled tasks

• Memory spikes, crashes, or large or malformed requests

• Unexpected outbound connections from the server

If you find signs of a breach, isolate the server, restore from a clean backup, rotate database passwords and API keys, and call an incident-response professional.

FAQ

Is it being exploited?
Cloudflare, Amazon and watchTowr have reported attempts, and public exploit code exists. Patch as if attacks are happening.

Is my WordPress, Magento or Laravel site at risk?
Yes, if PHP is unpatched. Update PHP on the server, not just the application.

Can a firewall or login page stop it?
Not reliably, because PHP processes the request before your application sees it.

Do earlier PHP patches cover this?
No. These flaws are separate from earlier 2026 issues like the SOAP extension bugs, so you need the October 21 release.

Quick tip

Patching the application is not enough here. Update PHP itself on every server, restart it, and confirm the fix in the package changelog.

I left tables out since they were the main thing that broke formatting. The meta fields and tags are new, since the original SEO block wasn’t in what you sent, so edit them to fit your site.

How GTIS Can Help

Not sure whether your servers are patched or already compromised? GTIS offers VAPT, SOC monitoring, managed security and consulting to help you find exposed systems, patch them and check for compromise.

Contact Us

Talk to GTIS about a PHP2Shell patch review or compromise check.

• Website: https://gtisec.com/contact

• Email: sales@gtisec.com

• Phone: +91 98183 98494

GTIS: Defending the Digital Frontier.