Security briefs

Is my server exposed to PHP2Shell, and which PHP version fixes it?

By Brandon Da Costa, founder of Digiton Dynamics

Published 26 October 2026Updated 26 October 2026Editorial policy

Yes, if PHP serves web requests on your server and runs a release older than 8.2.35, 8.3.36, 8.4.27 or 8.5.12. PHP shipped the fixes on 21 October 2026 for two critical flaws. Updating is the only complete fix. The sources disagree on how much exploitation there is.

Who should act: Anyone who runs PHP behind a web server, including WordPress, Laravel and vendor apps, and cannot say which PHP version answers requests.

What happened

On 21 October 2026 PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35, scheduled for 14:00 UTC. They fix CVE-2026-109618, out-of-memory corruption, and CVE-2026-109619, stale global state. PHP rates both 9.2 on CVSS 4.0 and says both can allow unauthenticated remote code execution. It calls the risk highest for Apache mod_php, where one request can trigger the attack before any application code runs (php.net and the php-src advisories, 21 October).

The disclosure broke early. The PHP Foundation (21 October) says the CVE IDs began circulating around 15:00 UTC on 20 October with a wrong score of 10.0, that Calif mistakenly published a proof-of-concept video, and that Chainguard released fixed images at 07:41 UTC on 21 October, over six hours before the release. A Hacker News user who posted about the coming CVEs wrote on 22 October that he was told there was no embargo.

The sources split on exploitation. Amazon (21 October) caught a first attempt on a honeypot on 17 October, and Cloudflare saw attack traffic before the release. CISA (21 October), CrowdStrike (23 October) and Sophos, which withdrew an earlier compromise claim on 22 October, report no confirmed successful exploitation. A researcher's honeypot report (24 October) logs 35 shells started by Apache on unpatched PHP 8.4.26.

They also split on range. Sansec and Vercel say the flaws reach back to PHP 5.4, while PHP names only the fixed branches. Sansec ties the upload-progress path to CVE-2026-109618. PHP lists it under CVE-2026-109619.

Who is affected

• Any PHP serving web requests below those versions: PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed (php.net).
• WordPress, Drupal, Magento, Laravel and similar apps, because the bug is in the engine. A plugin update does not fix it (Sansec, Vercel).
• PHP 8.1 and older, which PHP no longer updates. It offers source patches for 7.4, 8.0 and 8.1, and some distributions backport fixes.
• Vendor sites and container images built on an old PHP base.

What we checked

Run on 26 October 2026 on the Mac that builds this site. Each command and its output are copied as they ran.

$ curl -s 'https://www.php.net/releases/index.php?json&version=8.[2-5]' | grep -o '"version":"[^"]*"'
"version":"8.2.35"
"version":"8.3.36"
"version":"8.4.27"
"version":"8.5.12"

$ command -v php || echo "php not installed"
php not installed

php.net lists the four fixed releases as the latest on each branch. No PHP runs on this Mac, so there was nothing here to patch.

What to do now

1. Find the PHP that answers web requests. A laptop check shows the laptop. Ask the server and each container image.

   php-fpm -v
   apachectl -M | grep php
   docker ps --format '{{.Image}}' | sort -u

2. Update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or to your vendor's fixed package. Restart PHP-FPM or Apache, then confirm the CVE in the package changelog (Debian and Ubuntu shown).

   zgrep CVE-2026-109618 /usr/share/doc/php8.3-common/changelog.Debian.gz

3. On 8.1 or older, move to a supported branch or install a vendor backport.
4. If you cannot update today, set these in the FPM pool or server config, not ini_set(), and restart workers. PHP says they reduce exposure and do not make a server safe. Use 32M if you accept uploads.

   php_admin_value[memory_limit] = -1
   php_admin_flag[session.upload_progress.enabled] = off
   php_admin_value[post_max_size] = 8M

5. Hunt from 17 October, the earliest reported attempt. Look for shells under the web user and new PHP files.

   ps -eo user,ppid,cmd | grep -E 'www-data|apache|nginx' | grep -E 'sh -c|/bin/sh'
   find /var/www -type f -name '*.php' -newermt 2026-10-17

6. If anything matches, rotate every secret the PHP worker could read.

What should have been in place

• An inventory of every PHP runtime, host, image and vendor site, each with a version and an owner. CISA (21 October) asks for one because PHP is often a component of other software.
• Images rebuilt on a schedule from a current PHP base.
• Patch windows measured in hours for critical flaws. Amazon says a 7-day or 30-day window assumes a delay that no longer exists.
• Web workers that cannot spawn shells or write to web folders, with an alert when they try.
• A WAF as a second layer. Vercel and Cloudflare both say it does not replace patching.

Questions people ask

Digiton's production review starts by listing what runs where, runtimes and versions included, and the checks it runs are on the vibe coded app audit page.

How this brief was made: researched from the sources below, drafted with AI assistance and checked against each source on the dates shown. See the editorial policy.

Sources

1. PHP.net, security advisory of 21 October and informational advisory of 23 October, 21 October 2026, read 26 October 2026. https://www.php.net/archive/2026.php
2. The PHP Foundation, the security release and the leak, 21 October 2026, read 26 October 2026. https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
3. PHP, php-src security advisory for CVE-2026-109618, 21 October 2026, read 26 October 2026. https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
4. Vercel, PHP security bulletin, 21 October 2026, read 26 October 2026. https://vercel.com/kb/bulletin/php2shell-security-bulletin
5. watchTowr, report of exploitation and the limits of .ini mitigations, 21 October 2026, read 26 October 2026. https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/
6. Sophos, advisory with updates to 23 October, 21 October 2026, read 26 October 2026. https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619
7. Amazon Threat Intelligence, exploitation seen before disclosure, 21 October 2026, read 26 October 2026. https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
8. Cloudflare, protections against php2shell, 21 October 2026, read 26 October 2026. https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
9. CISA, alert on critical PHP vulnerabilities, 21 October 2026, read 26 October 2026. https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
10. CrowdStrike, obstacles to widespread exploitation, 23 October 2026, read 26 October 2026. https://www.crowdstrike.com/en-us/blog/obstacles-to-weaponizing-php2shell-likely-constrain-exploitation/
11. Sansec, PHP2Shell analysis and temporary mitigations, 21 October 2026, read 26 October 2026. https://sansec.io/research/php2shell
12. Researcher honeypot report of confirmed shells, 24 October, 24 October 2026, read 26 October 2026. https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md
13. Hacker News, post about the PHP embargo, 22 October 2026, read 26 October 2026. https://news.ycombinator.com/item?id=50193416

More security briefs

How these briefs are sourced and corrected. All security briefs