Questions and answers

Every release before 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The researchers found affected code going back to PHP 5.4, and nearly every version in between is hit by at least one of the two CVEs.

PHP 8.1, 8.0, 7.x and 5.x are end-of-life and get no new release. The PHP team published minimal source backports for 7.4, 8.0 and 8.1 for people who build PHP themselves; OS vendors with extended support ship their own patched packages.

No. Those were the demo targets. The bug is in the PHP interpreter, so any site on a vulnerable PHP — Laravel, Symfony, Magento, Moodle, Nextcloud, MediaWiki, custom code, even a “Hello World” script — is exposed.

No. The demonstrated attacks are pre-authentication and work over plain HTTP requests. No login, plugin or special endpoint is needed.

Both. Apache with mod_php is the most clearly exploitable (RCE confirmed for both CVEs with default limits). On PHP-FPM, RCE via the session path was validated, and the OOM path is vulnerable by analysis. FrankenPHP and LiteSpeed LSAPI are rated likely susceptible.

The advisories focus on web request handling. CLI scripts are not reached by HTTP requests in normal use, but they come from the same package, so they get upgraded anyway. Long-running workers that serve requests (Octane, RoadRunner, Swoole, FrankenPHP worker mode) should be treated as web-facing.

Not necessarily. Debian, Ubuntu, RHEL and SUSE backport security fixes without changing the upstream version (for example 8.3.6-0ubuntu0.24.04.x). Check the package changelog for CVE-2026-109618 — the patch guide has the exact commands.

Install a fixed PHP release (or your vendor’s patched package) on every runtime, then restart PHP-FPM, Apache and any long-running PHP processes. That is the only complete remediation. Application updates and config changes do not replace it.

Select the newest PHP version in your control panel and ask your host to confirm their build includes the fix and that workers were restarted. If your plan only offers PHP 8.1 or older, the host cannot fix this for you.

Check whether your OS vendor (RHEL, Ubuntu Pro / ESM, Debian LTS, CloudLinux) ships a patched package — LTS vendors received the fixes in advance. If you build PHP yourself, apply the PHP team’s source backport for 7.4, 8.0 or 8.1. Meanwhile apply the temporary mitigations, keep a WAF in front, and plan the migration to 8.4 or 8.5.

Partly. Cloudflare, Akamai, Imperva and others published rules or guidance, and Cloudflare covers its Free plan. But coverage depends on the provider and the attack path, and attackers are already mutating payloads to get around them. Treat a WAF as time bought to patch, not as the fix.

These are patch releases within the same branch, so application compatibility is normally unaffected. One behavioural change: the new hard memory limit ends the process immediately, so shutdown functions do not run in that case. Test memory-heavy paths.

Anything in the PHP worker’s memory: database passwords, API keys, session cookies, other users’ request data, and certificates or keys PHP has loaded. This path does not need code execution, so it is quieter.

Cloudflare reported early attacks on 21 October 2026, with payloads mutating to evade rules, and watchTowr reported exploitation in its honeypots. No confirmed compromise had been published. The embargo leaked before release, so assume capable attackers have working exploits.

Not with certainty. Useful signals are memory-limit fatal errors after multipart requests, bursts of HTTP 500s, worker segfaults, and unusually long or percent-encoded PHPSESSID cookies. Their absence does not prove you are safe, and app logs may show nothing because the bug runs below the application.

Preserve logs, patch or isolate the host (rebuilding from a clean image is best), rotate every secret PHP could see in memory, invalidate sessions, and review where those credentials grant access.

php2shell is the name of the combined exploit script researchers used to show unauthenticated remote code execution on WordPress, Drupal and Joomla. It also became the name of the research.

Wiz Research, OpenAI Codex Security and Calif, reporting independently between August and September 2026, with the PHP security team developing the fix. Wiz says AI models helped with discovery, exploit development and patch validation.

The CVE IDs leaked before release with an incorrect 10.0 score. The official CVSS 4.0 score for both CVEs is 9.2.