PHP2Shell vulnerability: patch PHP today, both RCE flaws already exploited
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated code execution and are exploited in the wild. Fixed releases came out on 21 October.
The PHP2Shell vulnerability is really two critical flaws in the PHP language, CVE-2026-109618 and CVE-2026-109619, that let an attacker with no credentials run code on a web server. The PHP project shipped fixed releases on 21 October 2026, and the first attacks were observed the same day. If a server of yours, or of a customer's, runs PHP, update it today.
The PHP project received the first reports on 11 August 2026. Amazon Threat Intelligence reported an exploitation attempt on 17 October, before public disclosure. On 20 October the details leaked online ahead of the agreed date, and PHP brought the emergency release forward to 21 October. That day watchTowr saw active exploitation on its honeypot network.
CVE-2026-109618 is in the handling of out-of-memory errors: if PHP runs out of memory while setting up the request data, that data is left partly initialised and the final cleanup treats it as valid. CVE-2026-109619 is a stale global state bug that leads to a heap use-after-free, with memory disclosure and code execution. Both allow remote code execution, without authentication, with the privileges of the web server account. Security vendors' advisories rate them 9.2 on CVSS v4.0.
Every PHP installation that serves web requests is in scope: Apache with mod_php, PHP-FPM, php-cgi, LiteSpeed and FrankenPHP. The PHP project considers the risk highest for mod_php, because the attack can succeed before any application code runs. For the same reason a web application firewall or a RASP agent inside the PHP process may not stop it.
PHP2Shell vulnerability: which PHP versions are safe
PHP 8.5: update to 8.5.12.
PHP 8.4: update to 8.4.27.
PHP 8.3: update to 8.3.36.
PHP 8.2: update to 8.2.35.
PHP 8.1, 8.0 and 7.4: no official release. Minimal backports exist only as source code, or as packages from distributions and LTS vendors.
PHP 7.3 and older, including PHP 5: no fix, you need to move to a supported branch.
Linux distributions often fix a flaw without changing the version number: check the package changelog, not only the output of php -v.
Rumour
What people are saying
Sources disagree on the state of the exploit. Some researchers say the two flaws are already chained in a single working script and that write-ups and a tool are public. Huntress wrote that it had not reproduced a proof of concept, and JFrog warned that fake exploits are circulating. Anyone downloading a supposed PHP2Shell exploit from a forum risks installing malware.
As of 22 October the flaws were not in the CISA KEV catalogue, according to watchTowr. The UK National Cyber Security Centre (NCSC) urged organisations to update at once or take exposed systems offline. VirusTotal estimates more than 5.1 million PHP hosts are reachable from the internet.
Why it matters to you
If you run IT for an SME or for several customers, PHP does not live only in the sites you wrote yourself. It is in WordPress, Joomla, Magento, PrestaShop, webmail, old line-of-business apps and any container whose base image ships PHP. A container keeps the PHP it was built with: you need to rebuild, or pull a fixed image, and redeploy.
What to do today
Take inventory: php -v on every host and docker exec <container> php -v on every container that serves PHP.
Update to the fixed version, or to your vendor's fixed package, then restart PHP-FPM or Apache.
If you cannot update right away, take that system off direct internet access.
As stop-gaps that do not fully protect: session.upload_progress.enabled=0 and a worker restart, a low post_max_size (8M, or 32M if you need uploads) and memory limits at container level.
Review access logs from 17 October and, if you suspect process memory was read, rotate passwords, tokens and API keys.
The PHP project is clear that no configuration fully mitigates these flaws and that updating is the only lasting defence. For help setting priorities and patching fast, see our cybersecurity services.
In 5 minutes, check whether your SME or MSP falls under NIS2 and score your readiness on risk management and incident reporting. Free, stays in your browser.
We use technical cookies to keep the site running. With your consent we also use analytics and marketing cookies to improve the product. You can change your mind at any time.
01
NecessaryAlways on
Required for the site to work (login, preferences, security). Always on.
02
Help us understand how the site is used, in aggregate and anonymous form.
03
Let us measure how well our campaigns perform. Off by default.
