PHP2Shell: What Happened, Who Is Affected, and How to Patch Your PHP Server

If you run a PHP application in production, this is one security update you should not put off.

On October 21, 2026, the PHP development team released emergency security updates for two critical vulnerabilities in the PHP runtime. Together, these flaws are being discussed as PHP2Shell.

The problem is serious: an attacker may be able to execute commands on a vulnerable server without logging in first.

This is not limited to one framework or CMS. The issue affects PHP itself, which means the risk extends to applications running PHP-FPM, Apache with mod_php, CGI-based setups and other PHP server environments.

The good news is that patched releases are available. The important part is making sure the PHP version serving your application is actually fixed.

What is PHP2Shell?

PHP2Shell refers to two PHP runtime vulnerabilities:

• CVE-2026-109618 — remote code execution associated with out-of-memory handling and memory corruption.
• CVE-2026-109619 — remote code execution associated with stale internal request state.

Both vulnerabilities have a CVSS 4.0 severity score of 9.2 out of 10. They can potentially allow an unauthenticated attacker to execute code remotely or access sensitive information in process memory.

The official PHP project recommends upgrading to a patched release. There is no complete workaround that replaces applying the security update.

How does the vulnerability work?

You do not need to exploit a vulnerability in your Laravel application or find a bug in your WordPress plugin for this issue to matter.

The problem is lower down, inside PHP's request-processing machinery.

CVE-2026-109618: Problems during out-of-memory handling

PHP enforces a memory limit on requests. When a request exceeds that limit, PHP needs to stop processing it and clean up the resources it has allocated.

The vulnerability involves what happens when this process is interrupted by an out-of-memory error.

Some internal request data may be only partially initialized. If cleanup code subsequently treats that data as valid, PHP can encounter an unsafe memory operation.

Under the right conditions, an attacker may be able to influence this behaviour and turn the memory corruption into remote code execution.

CVE-2026-109619: Stale internal state

The second vulnerability involves internal state that belongs to a request but can remain accessible after the memory associated with that request has been freed.

If a later request handled by the same worker encounters that stale state before it has been properly reset, PHP may operate on invalid data.

That can create an opportunity for an attacker to corrupt execution or run code in the PHP process.

What can an attacker do with it?

If exploitation succeeds, the attacker may be able to execute commands with the privileges of the affected PHP process.

Depending on the server's permissions and configuration, this could expose application secrets, database credentials, API keys, uploaded files or customer data. It could also provide a way to modify application files or interfere with services.

Remote code execution does not automatically mean an attacker has root access to the entire machine. The extent of the damage depends on the privileges available to the compromised process and the surrounding infrastructure.

However, an internet-facing server should be treated as a priority for patching.

PHP2Shell timeline

Here is the sequence of events based on the published advisories and release announcements.

October 20, 2026 — Advance warning

The PHP announcement mailing list published an advance notice of an upcoming critical security release. Administrators were alerted that a security update was imminent.

October 21, 2026 — Security patches released

The PHP development team published fixed versions across four supported release branches. The updates addressed CVE-2026-109618 and CVE-2026-109619.

October 21, 2026 — Security agencies issue alerts

Security organisations, including CERT-EU and ENISA, urged organisations to identify affected systems and apply the updates. Public advisories described the risk of unauthenticated remote code execution.

October 22 onward — Administrators need to verify deployments

Installing a package is only part of the job. Administrators need to confirm that the correct PHP runtime has been updated, that PHP-FPM or the relevant web server has been restarted, and that production traffic is no longer being served by an affected version.

Which PHP versions are affected?

The PHP team released fixes for these four branches on October 21, 2026.

PHP branch	Fixed version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

Versions earlier than the corresponding fixed release are affected. PHP 8.1 and older branches are also affected, but are end-of-life and do not receive regular security fixes from the PHP project.

If you are running an end-of-life version, moving to a currently supported PHP branch is the safer long-term option. Check your operating system or hosting provider's security advisories as well, since some vendors provide separately maintained security packages.

Source: Official PHP website.

How to patch PHP2Shell

The exact commands depend on your operating system and how PHP was installed. Before making changes, identify which PHP version actually serves your application.

Step 1: Check your installed PHP version

Run:

php -v

This shows the version used by the command-line PHP executable. It does not necessarily tell you which version is serving web requests.

If you use PHP-FPM on Ubuntu or Debian, check its version separately:

php-fpm8.2 -v

Replace 8.2 with your installed PHP-FPM version.

You can also inspect the active service:

systemctl status php8.2-fpm

If you run multiple PHP versions, check each one. Your command-line PHP, PHP-FPM and Apache module may not use the same binary.

Step 2: Update PHP on Ubuntu or Debian

If your distribution provides a patched package for your PHP branch, update using the distribution's package manager.

First, refresh package information:

sudo apt update

For a PHP 8.2 installation, for example:

sudo apt install --only-upgrade php8.2-cli php8.2-fpm

If you use additional PHP extensions, upgrade their corresponding packages too. Package names may differ depending on your repository and installation method.

For example, a server using PHP 8.2 might have extensions such as:

sudo apt install --only-upgrade \
  php8.2-common \
  php8.2-curl \
  php8.2-mysql \
  php8.2-xml \
  php8.2-mbstring

Important: Do not assume that running apt upgrade automatically gives you the fixed PHP version. Confirm that your configured repositories provide a patched build. If they do not, use a trusted repository or follow your distribution's security guidance to install a supported patched version.

Step 3: Restart PHP-FPM

After the update, restart the PHP-FPM service used by your application.

For PHP 8.2:

sudo systemctl restart php8.2-fpm

Check that it is running:

sudo systemctl status php8.2-fpm

If your setup uses Apache with mod_php instead, restart Apache after upgrading its PHP module:

sudo systemctl restart apache2

For other environments, including Nginx with PHP-FPM, containers and managed hosting, follow the relevant service or deployment procedure.

Step 4: Verify the fixed version

Run the version check again:

php -v

For PHP-FPM, verify its binary as well:

php-fpm8.2 -v

You should see the patched release or a vendor-maintained build that includes the security fixes.

If your application runs in Docker or Kubernetes, updating PHP on the host does not automatically update the PHP runtime inside your container. Rebuild or replace the affected image, deploy it, and verify the version in the running workload.

Step 5: Test the application

Once the update is complete:

• Check that PHP-FPM or the web server is healthy.
• Test important application routes and background jobs.
• Inspect PHP and web server logs for errors.
• Verify that the application is using the expected PHP version.
• Confirm that all production instances have been updated, not just one server.

For a cluster, rolling out a patched image to one replica is not enough if other replicas still run a vulnerable build.

What if you cannot patch immediately?

There is no complete mitigation that substitutes for installing the security fix.

If you cannot patch a system straight away, reduce exposure as much as possible. Restrict public access where practical, consider taking the vulnerable service offline if the risk is unacceptable, and follow your vendor's security guidance.

Do not rely on changing memory_limit, disabling file uploads or switching frameworks as a complete fix. These changes do not address both underlying vulnerabilities.

If you suspect exploitation, preserve relevant logs, investigate unexpected processes and file changes, and rotate credentials that may have been exposed. Patching closes the vulnerability, but it does not undo a compromise that has already occurred.

The takeaway

PHP2Shell is a reminder that application security does not stop at your own code.

You can follow good coding practices, validate user input and keep your dependencies updated, yet still be exposed through the runtime executing your application.

Check every PHP environment you operate, install the appropriate security update, restart the affected services and verify the deployed version.

If you maintai