php2shell: two critical PHP flaws, update your servers now

On 21 October 2026, the PHP team shipped emergency releases for two critical vulnerabilities in the PHP engine itself, nicknamed "php2shell". Rated 9.2 out of 10 (CVSS v4.0), they can allow an unauthenticated attacker to run code remotely on the server, with the privileges of the web worker.

Technical details leaked before the coordinated release and security vendors reported exploitation attempts. The US agency CISA and the UK NCSC urge everyone to patch without delay.

Why it matters

• PHP powers a huge share of the web: WordPress, Laravel, Drupal, PrestaShop, Moodle and countless custom sites.

• The flaw is in PHP, not in a CMS or a plugin: updating WordPress or its plugins is not enough.

• No account is needed to attack: a publicly reachable site is enough.

The two vulnerabilities in short

• CVE-2026-109618: faulty out-of-memory handling can leave internal request data partially initialised, then treated as valid during cleanup.

• CVE-2026-109619: request-owned internal state can survive after its memory has been freed (use-after-free) and be reused by a later request handled by the same worker.

Am I affected?

According to published analyses, PHP 5.4 to 8.5.11 are affected. The fixed versions are:

• PHP 8.5.12

• PHP 8.4.27

• PHP 8.3.36

• PHP 8.2.35

For PHP 7.4, 8.0 and 8.1, which are no longer maintained, the PHP team published minimal source-level fixes without new official releases. If you are still on one of these versions, now is the time to upgrade.

To check your version:

php -v

On shared hosting (cPanel, Plesk…), the version is shown in the panel's PHP version selector. Note that the command-line version may differ from the one your site uses. A temporary phpinfo() page, deleted right afterwards, shows the version actually in use.

What to do now

1. Update PHP to a fixed version, then restart PHP-FPM or Apache.

2. On shared hosting, check with your provider that the fix has been applied.

3. With Docker, rebuild your images from an up-to-date official image (for example php:8.3-fpm) and redeploy.

4. Watch your logs: repeated PHP-FPM crashes, memory errors, unexpected files in upload folders. If in doubt, rotate the server's passwords and keys.

On Ubuntu or Debian, once fixed packages are available (distribution or Ondřej Surý's repository):

sudo apt update && sudo apt upgradephp -vsudo systemctl restart php8.3-fpm

A stopgap, not a fix

Until you can update, the PHP team says that disabling session.upload_progress.enabled blocks the known attack paths for the second flaw (CVE-2026-109619), but not every variant. Only updating truly fixes the problem.

; php.ini — temporary measuresession.upload_progress.enabled = Off

As of writing (23 October 2026), the situation is moving fast: check the official advisories for the latest information.

Need help?

Not sure which PHP version runs your site, or no time to deal with it? Our team can check your server, apply the fixes and set up monitoring. Contact us or request a quote.

Sources

• CISA alert (21 October 2026)

• UK NCSC advisory

• Help Net Security

• Rapid7 analysis

• Unit 42 analysis (Palo Alto Networks)