PHP2Shell Explained: Critical PHP Vulnerabilities CVE-2026-109618 and CVE-2026-109619 (What to Do Now)

PHP2Shell critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 explained

Picture a small online store run from a rented server. It sells handmade notebooks, runs on WordPress, and nobody has touched the server settings since the day it was set up. On a quiet Tuesday night, someone halfway across the world sends that site a few strange-looking form submissions. No password. No login page. No plugin bug. A few minutes later, the attacker's code is running on the server, under the same account as the website itself.

That's the scenario security teams around the world have been racing to prevent this week. It has a name: PHP2Shell. It's two critical flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. If your website, blog, client portal or internal tool runs on PHP, this post explains what happened, what researchers have found so far, and exactly what to do, in plain language.

Short version: update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your Linux vendor's patched package), then restart every PHP process. Configuration tweaks only reduce the risk; they don't fix it.

Why this one is a big deal

Most website vulnerabilities live in a plugin, a theme or an app's own code. You fix them by updating that one piece. PHP2Shell is different: the bug is in PHP, the engine that runs the website. That's like finding a fault in a car's engine rather than in one model's radio.

And PHP runs a huge part of the web. According to W3Techs figures quoted by researchers, PHP powers about 69% of websites whose server-side language is known: WordPress, Drupal, Joomla, Magento, Moodle, countless custom portals. Researchers estimate more than a million internet-exposed servers may be vulnerable.

Three things together make it serious:

No login needed. An attacker on the internet doesn't need any account.
Remote code execution. If it works, the attacker can run their own commands on your server.
Default settings are affected. The vulnerable paths are reachable with PHP's normal, out-of-the-box configuration.

PHP's security team rated both flaws 9.2 out of 10 (Critical) on CVSS v4. Early identifiers that leaked before release showed 10.0, which was later corrected.

The story of the week, day by day

October 17: Amazon's threat intelligence team said its honeypots (decoy servers built to attract attackers) caught an exploitation attempt, four days before the public announcement.
October 20: The CVE numbers started circulating publicly before PHP was ready. PHP moved its release forward by a day and announced patches for October 21 at 14:00 UTC (7:30 PM IST).
October 21: PHP released fixed versions and its advisories. The UK's NCSC and other national agencies issued alerts. Cloudflare said it was seeing early attacks and pushed WAF rules to its customers. watchTowr reported exploitation attempts on its honeypots.
October 22: Rapid7 and others published lab results. Multiple proof-of-concept exploits were public, but each worked only on a specific mix of operating system, PHP version and web server.

The two bugs, explained like a story

Bug 1: CVE-2026-109618, the "ran out of memory mid-setup" bug

Every time someone visits a PHP page, PHP sets up a little workspace for that request: it reads the form fields, uploaded files and cookies, and organizes them in memory.

Imagine a waiter setting a table. Halfway through, the kitchen runs out of plates, so the waiter stops suddenly. Then the cleaner comes along and starts "clearing" a table that was never fully laid, picking up things that aren't really there. Confusion follows.

That's roughly what happens here. An attacker sends a specially crafted multipart request (the kind browsers use for forms and file uploads) that makes PHP run out of memory while the request is only half set up. PHP's cleanup code then treats half-ready data as if it were valid. With careful crafting, that memory confusion can be turned into running the attacker's code. The attack works even within PHP's normal upload size limits.

Researchers say Apache with mod_php is the riskiest setup, because the cleanup runs even when request startup fails, so the attack can happen before your website's own code runs at all. PHP-FPM handles a failed startup differently, which blocks that particular sequence.

Bug 2: CVE-2026-109619, the "leftover note from the last customer" bug

Web servers reuse the same PHP worker process for many visitors, one after another. Between visitors, PHP is supposed to wipe the slate clean.

Now imagine a hotel room where housekeeping is interrupted before finishing. The next guest walks in and finds a note on the desk pointing to a locker that's already been emptied and given to someone else. If the guest trusts that note, things go wrong.

In technical terms, this is a use-after-free. If one request ends with a fatal error (for example, it runs out of memory or times out), some internal state can be left pointing at memory that has already been freed. The next request on the same worker can read that stale pointer. PHP lists memory disclosure as a confirmed impact, and researchers confirmed code execution through two default features:

Session upload progress (on by default), on both mod_php and PHP-FPM. Your app doesn't even need to call session_start().
Fatal error backtraces on PHP 8.5 (on by default), on mod_php.

Busy servers with many workers make the attack less reliable per attempt, but they don't remove the risk.

Which versions are affected?

PHP branch	Vulnerable	Fixed in
8.5	Before 8.5.12	8.5.12
8.4	Before 8.4.27	8.4.27
8.3	Before 8.3.36	8.3.36
8.2	Before 8.2.35	8.2.35
7.4, 8.0, 8.1	Yes	No official release; PHP published minimal source patches. Use your Linux vendor's package or upgrade.
7.3 and older	Yes (affected code dates back to PHP 5.4)	No fix. Upgrade.

All common ways of running PHP are affected: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.

Important for Linux servers: Ubuntu, Debian, Red Hat and other distributions received the patches in advance. Their packages often keep the old version number (for example 8.3.6) but include the fix. So check your distribution's security advisory, not just the number from php -v.

What researchers have found so far (as of October 23)

Attacks have started, but the picture is still unclear. Amazon says it is seeing broad exploitation attempts, likely from multiple groups. Cloudflare and watchTowr report attacks too. Rapid7 and Expel say they have seen attempts but haven't confirmed a successful compromise in their own data.
Public exploits exist but are fragile. Rapid7 found every public proof of concept it tested worked only for one specific combination of OS, PHP version and web server. PHP's own team found no fully working exploit in the early public code. Researchers warn that a more reliable version could appear quickly.
Popular apps are reachable. Security firm Calif, crediting researcher LCFR, confirmed pre-login code execution against specific versions of WordPress, Drupal, Joomla and Magento. That's because the bug sits in PHP, below the app.
Config tricks are only partial. Every major write-up agrees: patching is the only complete fix.
Some hosts acted early. Managed hosts such as SiteGround said they applied server-level protections before the release, so their customers didn't need to act.

What should you do? A checklist by situation

If you're on shared or managed hosting (most bloggers and small businesses)

Log in to your hosting panel (cPanel, hPanel, Plesk) and note your PHP version.
Check your host's blog or status page, or open a support ticket asking: "Are your servers patched for PHP2Shell, CVE-2026-109618 and CVE-2026-109619?"
If you're on PHP 8.1 or older, switch to 8.3 or 8.4 in the panel after testing your site on a staging copy.
Update WordPress, plugins and themes while you're at it, and take a fresh backup.

If you manage your own server (VPS, cloud VM, on-premises)

Find every PHP installation. Web servers are obvious, but don't forget old intranet tools, monitoring dashboards and test servers.

Patch. For example:

# Ubuntu / Debian
sudo apt update && sudo apt upgrade

# RHEL / Rocky / Alma
sudo dnf update 'php*'

Restart every PHP process (PHP-FPM and Apache). Old workers keep running vulnerable code until they restart.
```
sudo systemctl restart php8.3-fpm
sudo systemctl restart apache2
```
If you truly can't patch today, apply the temporary settings researchers recommend in the server-level config (php.ini, FPM pool or Apache config, not .user.ini or ini_set(), which are too late), then restart:
```
session.upload_progress.enabled = 0
; PHP 8.5 only
fatal_error_backtraces = 0
```
Researchers also mention setting memory_limit=-1 for the first bug, but that removes PHP's own memory safety net and only partly helps, so treat it as an emergency measure. Blocking multipart requests at your WAF or reverse proxy, for sites that don't need uploads, also reduces exposure. If the server can't be patched soon, restrict who can reach it from the internet.

If you're on a security or SOC team

Researchers suggest looking for:

Unusually large or deeply nested multipart requests in web server logs.
PHP workers crashing or hitting memory limits, especially in bursts.
Web server or PHP processes starting a shell, curl, wget or similar tools.
New or changed .php files in web folders (a classic sign of a web shell), unknown cron jobs and new user accounts.
Unexpected outbound connections from web servers.

Save logs and config snapshots before you change anything. And remember: no suspicious log entries doesn't prove you're safe. If you use Microsoft Defender for Endpoint on your Linux servers, our Defender XDR advanced hunting queries guide shows how to hunt for suspicious process chains, and you can turn a good query into an alert with custom detection rules.

The lesson behind the headlines

PHP2Shell is a reminder of something IT teams learn the hard way: the software you forget is the software that hurts you. That one-off feedback form from 2019, the old PHP 7.4 test server, the dashboard that "just works" — these are the machines attackers find first.

So this week, make a list. Every server, every PHP version, every owner. Patch what you can today, restrict what you can't, and keep the list for the next time. Because there will be a next time.

FAQ

Is my Blogger or WordPress.com site affected?

No action is needed on your side. Blogger doesn't run your site on PHP, and fully hosted platforms like WordPress.com manage their servers for you. Self-hosted WordPress (WordPress.org on your own hosting) does run on PHP, so check with your host.

I updated WordPress. Am I safe?

Not necessarily. This bug is in PHP, not WordPress, so a WordPress update doesn't fix it. PHP itself must be patched by you or your host.

How do I check my PHP version?

In WordPress, go to Tools > Site Health > Info > Server. On a server, run php -v, but remember that Linux vendors may ship the fix without changing the main version number.

Does a WAF like Cloudflare protect me?

It helps. Cloudflare added rules for known attack patterns, but it calls them a stopgap, and they only protect traffic that actually goes through Cloudflare. Patch anyway.

Is it in CISA's Known Exploited Vulnerabilities list?

At the time of writing, the reports we checked didn't show these two CVEs in the KEV catalog. Given the reported attacks, that may change soon, so check CISA's site for the latest.

Sources: PHP security advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, Rapid7, Tenable, watchTowr, Expel and SiteGround analyses, October 21–23, 2026. This post will be updated as the situation develops.