PHP2Shell is a pre-auth RCE in PHP itself. Upgrade PHP, then restart it.
Two memory-safety bugs in the PHP engine (CVE-2026-109618, CVE-2026-109619) let an unauthenticated attacker run code or read server memory — passwords, API keys, session tokens — on almost any PHP version since 5.4, regardless of the app on top.
Not technical? Read PHP2Shell in plain English — what it means for your website or the SaaS tools you use.
Last reviewed 2026-10-22 · independent, vendor-neutral
Paste a version, the output of php -v, or one version per line for a whole fleet. Runs entirely in your browser.
The CLI and the web server can run different PHP builds. Check the version your web server actually uses: php-fpm -v (or php-fpm8.3 -v), or phpinfo() served by that site.
| Branch | Vulnerable | Fixed in |
|---|---|---|
| 8.5 | < 8.5.12 | 8.5.12 |
| 8.4 | < 8.4.27 | 8.4.27 |
| 8.3 | < 8.3.36 | 8.3.36 |
| 8.2 | < 8.2.35 | 8.2.35 |
| 8.1 · 8.0 · 7.4 | all | Source backport only |
| 5.4 – 7.3 | all | No fix |
PHP 8.2 leaves security support on 2026-12-31
Patching to 8.2.35 fixes PHP2Shell, but you will need to move again before the end of 2026. If you are migrating anyway, target 8.4 or 8.5.
Do this now
In this order. Nothing else is a complete fix.
- 01
Find every PHP runtime
Web servers, containers, base images, shared hosting, staging. The CLI version can differ from what PHP-FPM or Apache runs.
How - 02
Install a fixed release
8.5.12 · 8.4.27 · 8.3.36 · 8.2.35, or your distro’s patched package. Updating WordPress/Drupal/Laravel does not update PHP.
How - 03
Restart everything that runs PHP
PHP-FPM pools, Apache (mod_php), FrankenPHP, queue workers, Octane/RoadRunner/Swoole. Old processes keep the old code in memory.
How - 04
Verify, then look back
Confirm the version the web server reports. Review logs since early October 2026 and rotate secrets if anything looks wrong.
How
Can’t upgrade today? Temporary mitigations reduce exposure to the known attack paths. On shared hosting? See hosting.
Guides for your setup
- WordPressIs your WordPress site affected by PHP2Shell? How to find your PHP version in Site Health, why plugin updates do not help, and a message to send your host.
- DrupalIs your Drupal site affected by PHP2Shell? How to check the PHP version in the Status report or with Drush, why a Drupal update is not the fix, and what to ask your host.
- JoomlaIs your Joomla site affected by PHP2Shell? How to check PHP in System Information, why a Joomla update is not the fix, and what to ask your host.
- Hosting providersOn shared or managed hosting you cannot patch PHP yourself. How to check and switch PHP versions in cPanel, Plesk and other panels, what providers have said, and what to ask.
- Cloudflare WAFCloudflare’s PHP2Shell WAF rule IDs for Free and paid plans, how to confirm they are active and blocking, and why you still need to patch PHP behind Cloudflare.
- session.upload_progressWhy disabling session.upload_progress only partly mitigates PHP2Shell, where to set it so it actually applies (not .user.ini or ini_set), how to check it, and what to restart.
Is it being exploited?
Status as of 2026-10-22. Reports differ; assume capable attackers have working exploits.
- Cloudflare (CTO Dane Knecht): “We are seeing early attacks emerging and are updating mitigations as new vectors show up.”
- watchTowr lists exploitation as observed in the wild via its honeypot network as of 21 October.
- The Dutch NCSC said it had not seen abuse at the time and treats every internet-facing PHP system as vulnerable until patched.
- No confirmed successful compromise had been published, and neither CVE was in CISA’s KEV catalog.
- Several “PoC” repositories circulate on GitHub. Tenable could not verify that any of them work — treat them as untrusted, possibly malicious code.
Which server setups are exposed
mod_php is the most clearly exploitable, but every SAPI that serves web requests needs the patch.
| Setup | …109618 | …109619 | Notes |
|---|---|---|---|
| Apache + mod_php | RCE confirmed | RCE confirmed | Both CVEs validated to RCE with default limits. Highest-risk setup. |
| PHP-FPM (nginx, Apache, Caddy…) | Susceptible | RCE confirmed | Session-lifecycle RCE validated on FPM. OOM path confirmed through application-level code paths; no generic FPM exploit published. |
| FrankenPHP / LiteSpeed LSAPI | Likely | Likely | Advisory rates them likely susceptible. Long-lived workers make cross-request state more relevant, not less. |
| CLI (cron, queue workers, artisan) | Not covered | Not covered | Not discussed by the advisories and not reachable by HTTP requests in normal use. Upgrade anyway — it is the same package. |
When was the patch released in my time zone?
PHP published the fixed releases at 14:00 UTC on Tuesday 21 October 2026. On that date the US and Europe were still on summer time, so “EST” really meant EDT (UTC−4).
| Time zone | Patch released | Date |
|---|---|---|
| UTC | 14:00 | Tue 21 Oct 2026 |
| US Pacific (PDT, UTC−7) | 07:00 | 21 Oct |
| US Central (CDT, UTC−5) | 09:00 | 21 Oct |
| US Eastern (EDT, UTC−4) | 10:00 | 21 Oct — “EST” searches mean this |
| UK (BST, UTC+1) | 15:00 | 21 Oct |
| Central Europe (CEST, UTC+2) | 16:00 | 21 Oct — NL, BE, LU, DE, AT, FR… |
| India (IST, UTC+5:30) | 19:30 | 21 Oct |
| China / HK / SG (UTC+8) | 22:00 | 21 Oct |
| Japan (JST, UTC+9) | 23:00 | 21 Oct |
| Sydney (AEDT, UTC+11) | 01:00 | 22 Oct |
What an attacker can do
Run code without logging in
Code execution as the PHP worker user (e.g. www-data): web shells, data theft, defacement, lateral movement.
Read other requests’ memory
Worker memory can hold DB passwords, API keys, session cookies, TLS material and other users’ form data.
Leak data quietly
The memory-disclosure path needs no code execution, so tools that watch for malicious processes may never fire.
Common mistakes
The fastest ways to think you are safe when you are not.
| If you think… | Reality |
|---|---|
| “I updated WordPress / my plugins.” | The bug is in the PHP interpreter. Application updates do not touch it. A plain “Hello World” script on a vulnerable PHP is exposed. |
| “I set session.upload_progress.enabled = 0.” | That blocks some confirmed paths of one CVE. It does nothing for CVE-2026-109618. PHP’s own developers say the only mitigation is upgrading. |
| “I ran apt upgrade, so I’m done.” | Running PHP-FPM / Apache processes keep the old binary in memory until restarted. |
| “php -v says I’m patched.” | That is the CLI. The web server may use a different package, container or version. Check php-fpm -v or phpinfo(). |
| “I’m behind Cloudflare / a WAF.” | WAF rules reduce risk on known payloads; attackers are already mutating them, and origins are often reachable directly. It buys time, it is not the fix. |
| “My version looks old, so I’m vulnerable.” | Maybe not. Debian, Ubuntu and RHEL backport fixes without changing the upstream number. Check the package changelog. |
The two CVEs at a glance
RCE via out-of-memory (OOM) corruption
Unauthenticated code execution as the PHP web-worker user.
Demonstrated: Pre-auth RCE on WordPress, Drupal and Joomla (mod_php, default limits).
RCE via stale global state across requests
Use-after-free leading to worker memory disclosure or code execution.
Demonstrated: Pre-auth RCE on WordPress and Drupal; application-agnostic remote memory disclosure.
Why some sites say 10.0: CVSS 9.2 vs 10.0 →
How it unfolded
- 2026-10-20 15:00 UTCCVE IDs start circulating on forums and social media, with an incorrect CVSS 10.0.
- 2026-10-20 19:30 UTCPHP publishes its pre-announcement early.
- 2026-10-20 ~20:00 UTCCalif mistakenly publishes a video showing its proof of concept.
- 2026-10-20 23:00 UTCMitigation advice goes out to some critical-infrastructure providers, and may have leaked.
- 2026-10-21 03:02 UTCCloudflare WAF rules go live for all plans, including Free.
- 2026-10-21 07:41 UTCChainguard ships fixed images, breaking the embargo by more than six hours.
- 2026-10-21 11:51 UTCBambooHR takes its service offline as a precaution (US, Canada, Ireland).
- 2026-10-21 (CEST)Dutch government and education sites, including DigiD and MijnOverheid, go offline as a precaution.
- 2026-10-21 14:00 UTCCoordinated release: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, plus source backports for 7.4, 8.0, 8.1. Originally planned for Oct 22.
- 2026-10-21 15:03 UTCBambooHR reports the fix applied and testing under way.
Full timeline from the 2024 audit → · Compared with 2021’s Java bug: PHP2Shell vs Log4Shell →