PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Is Your Server Vulnerable and What to Do

On 21 October 2026 the PHP project shipped emergency releases for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both are rated 9.2 on the CVSS v4.0 scale, and both let someone with no account and no password run code on a server that serves PHP pages. If you host WordPress, a shop, a client portal, or anything else written in PHP, this applies to you, and it applies whether you run cPanel, Plesk, DirectAdmin, or a plain Ubuntu box. This page explains the problem in plain terms, shows how to find out whether you are exposed, and points to the exact patch steps for each platform.

What the two flaws actually are

Both bugs live in the core of PHP itself, not in WordPress or any plugin, which is why updating a plugin does nothing about them. The PHP Foundation's announcement describes them as memory-safety errors triggered through unusual request handling.

CVE-2026-109618 involves a request that hits PHP's memory_limit at an unlucky moment. PHP can be left holding half-built internal data and later treat it as valid, which corrupts memory. According to the announcement, an unauthenticated request on Apache with mod_php can reach this before any application code runs, and remote code execution was demonstrated on default settings. It was also confirmed on PHP-FPM through application-level code paths.

CVE-2026-109619 is a stale-state problem. A fatal error at the wrong point can leave internal state pointing at memory from a previous request, and a later request handled by the same worker can then use memory that has already been freed. A worker crash is the mild outcome, and code execution was shown against a real application.

The practical point is that an attacker does not need to find a weakness in your website. They only need to send requests to something that runs PHP.

Which PHP versions contain the fix

Upstream, the fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older within those branches is affected. PHP 8.1, 8.0 and 7.4 have reached end of life and do not receive official releases, although several vendors have rebuilt those branches with the fix included. That distinction matters for cPanel, Plesk and Ubuntu servers, and the per-platform guides below cover it.

Why php -v can lie to you

This is the part most people get wrong. Linux distributions and hosting panels usually do not move you to a new upstream version. They take the fix and apply it to the version you already run, a practice called backporting. The result is a server that is fully patched while php -v still prints the old number.

So the version string alone cannot tell you whether you are safe. The reliable check is the package changelog, which names the CVE when the fix is included. On Debian and Ubuntu that is a changelog file, and on RPM-based systems it is rpm -q --changelog. Each platform guide shows the exact command. If you see the CVE identifier in the changelog, you have the fix. If you do not, and the package is older than the vendor's fixed build, you do not.

Find every PHP on the server first

Servers rarely run just one PHP. A cPanel machine may carry several EasyApache versions, a Plesk server ships its own builds alongside the operating system's, and a shared account may select an old version on purpose. Patching the default and forgetting the rest is the most common way a server stays exposed. Start with an inventory:

find / -xdev -type f \( -name "php" -o -name "php-fpm" -o -name "php-cgi" -o -name "lsphp" \) -perm -u+x 2>/dev/null

Check what each of them reports with -v, then check how it was installed. Anything installed from a package manager is patched by updating the package. Anything compiled by hand, or bundled inside another product, needs its own plan.

Patch in this order

First, update the PHP packages through your platform's normal mechanism and restart the services that run PHP. Updating without restarting is not enough, because a long-running process keeps the old code loaded in memory until it is restarted, and mod_php under Apache needs a full restart rather than a graceful reload.

Second, confirm the fix with the changelog, not the version string.

Third, work through the stragglers: other PHP versions, accounts pinned to old versions, containers built from old images, and queue workers or scheduled jobs that have been running for weeks.

Fourth, if the server was reachable from the internet before you patched, check it for signs of compromise. Reports indicate exploitation attempts began before the public announcement, so a server that sat unpatched for several days deserves a look. We cover that in how to check whether PHP2Shell hit your server.

Platform patch guides

We have written step-by-step instructions for the platforms we manage most often:

• cPanel, WHM, CloudLinux and LiteSpeed
• Plesk on Linux
• Ubuntu and Debian
• AlmaLinux, Rocky Linux and RHEL

If you run something else, the principle is identical: update the package, restart the process that runs PHP, and verify with the changelog.

DirectAdmin, Docker and Windows in brief

On DirectAdmin, PHP is compiled by CustomBuild, so the fix arrives as a rebuild: update CustomBuild, then rebuild PHP with da update followed by da build php, or ./build update and ./build php from the CustomBuild directory. Rebuilding recompiles every configured PHP version and takes time, so schedule it. Users can choose their own PHP version, so a patched default slot does not protect an account that selected another one. Check each slot, and expect the version string on a patched older branch to stay the same.

On Docker, running containers never update themselves. Rebuild images with docker build --pull --no-cache, pull the new base image, and recreate the containers. Pin full patch tags instead of a floating tag. On Windows, download the matching build from windows.php.net, replace the PHP folder while keeping your php.ini, and restart IIS or Apache.

A note on the third issue

A separate flaw, CVE-2026-115560, was disclosed around the same time and relates to the session.upload_progress feature. At the time of writing, reports indicate it was not yet fixed and that the interim mitigation is setting session.upload_progress.enabled = 0 in your PHP configuration. If your applications do not use upload progress tracking, which most do not, turning it off costs nothing. Treat this as a stopgap and watch for the next PHP release. Check the current status with your vendor, since this part of the situation is changing quickly.

Do not rely on a firewall rule alone

Web application firewalls and security tools can block known attack patterns and shrink the window while you patch. They are not a substitute for the update, because a new variation can slip past a signature and the flaw remains in PHP. Use them as a second layer, not as the fix. If you run the Imunify or ModSecurity rule sets on a cPanel server, confirm they are current, then patch anyway. Our wider guidance on securing a server effectively and on choosing a firewall for a cPanel server applies here too.

After the emergency: shorten the next one

PHP2Shell was dangerous partly because many servers were running PHP versions that no longer receive official fixes. Moving to a supported branch, keeping automatic security updates enabled, and having a routine like our Linux server maintenance checklist turns the next emergency from a scramble into an ordinary Tuesday.

If you would rather not do this yourself, contact us. Our engineers will find every PHP install on your server, patch and restart it, verify the fix against the changelog and check for signs of compromise, and our server security service can keep it patched afterwards.