PHP2Shell: A Plain-English Patch Guide for Website Owners

PHP quietly runs a huge share of the web — around seven in ten websites, including most WordPress, Drupal and Joomla sites. So when the PHP project shipped emergency fixes on October 21, 2026 for two critical flaws nicknamed PHP2Shell, it set off one of the busiest weeks the security world has seen in years. Some governments even switched their own websites off while they waited for patches.

If you run a website, an online store, or a client project on PHP, this guide explains what you need to do — no security degree required.

What is PHP2Shell?

PHP2Shell is the nickname for two vulnerabilities in the PHP engine itself:

• CVE-2026-109618 — a memory-corruption bug triggered when PHP runs out of memory while it's still setting up a request.

• CVE-2026-109619 — a "stale state" bug where PHP keeps a reference to memory that has already been freed.

Both are rated 9.2 (critical) and both can let an attacker run their own code on your server without logging in. Researchers demonstrated working attacks against standard installs of WordPress, Drupal and Joomla. Crucially, the flaw sits in how PHP parses incoming form uploads — before your application code even runs — so updating your CMS or plugins does not fix it.

Is it being exploited?

Yes. The US Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by October 29. Amazon's threat researchers reported attack attempts four days before the patches were even public, after technical details leaked early. Public proof-of-concept code is now widely available.

The fixed versions

Update to at least the release for your branch:

• PHP 8.5 → 8.5.12 (active support)

• PHP 8.4 → 8.4.27 (active support)

• PHP 8.3 → 8.3.36 (security fixes only)

• PHP 8.2 → 8.2.35 (security support ends December 31, 2026)

• PHP 8.1 and older → no official release; you need a vendor backport or an upgrade

How to check and patch your site

On shared hosting: your host controls PHP, so you can't install the fix yourself. Ask them in writing whether your server has the PHP2Shell fix, and check the PHP version shown in your hosting panel or a phpinfo() page.

On a VPS or your own server: install your Linux distribution's updated PHP packages (Debian, Ubuntu, Red Hat, AlmaLinux, CloudLinux and cPanel have all shipped them), then restart every PHP process — PHP-FPM, Apache with mod_php, or whatever serves your site. A patch that isn't loaded doesn't protect you.

Watch out for version numbers. Distributions often backport the fix without changing the version number, so php -v alone may not tell you the truth. Check the package changelog for the two CVE numbers instead.

Containers and Docker images: rebuild from an updated base image and redeploy. Old images keep the old PHP.

Appliances and SaaS tools: some third-party products bundle their own PHP. Check vendor advisories for anything you self-host.

If you can't patch right away

Patching is the only complete fix, but the PHP team published temporary mitigations, including disabling the session upload-progress feature (session.upload_progress.enabled = 0) and adjusting memory settings. Agencies such as CISA and CERT-EU go further: if you're on PHP 8.1 or older and can't update, take internet-facing PHP apps offline until they're patched.

After patching: check you weren't already hit

Because attacks began before the fixes landed, it's worth a quick health check:

• Look for unfamiliar PHP files in upload, cache, or theme folders, especially recently modified ones.

• Review new admin users and unexpected scheduled tasks (cron jobs).

• Scan your web server logs for unusual multipart/form-data requests around October 17–25.

• Rotate database passwords, API keys, and other secrets stored on the server if anything looks off.

The bigger lesson

AI tools helped researchers find these bugs — and helped attackers weaponise them within hours of disclosure. The window between "patch released" and "attacks everywhere" is shrinking. Turning on automatic security updates, knowing exactly which PHP version your sites run, and staying off end-of-life branches are no longer nice-to-haves.

Sources

BleepingComputer — CISA confirms PHP2Shell vulnerabilities now exploited: https://bleepingcomputer.com/news/security/cisa-confirms-php2shell-vulnerabilities-now-exploited-in-attacks

BleepingComputer — Amazon says exploitation began 4 days before patches: https://bleepingcomputer.com/news/security/amazon-says-php2shell-exploitation-began-4-days-before-patches

Pentest-Tools — PHP2Shell: what it is, how to detect, how to patch: https://pentest-tools.com/research/php2shell-rce

Recorded Future — PHP2Shell exploitation explained: https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation

GuidePoint Security — Keep Calm and Patch PHP2Shell: https://www.guidepointsecurity.com/blog/how-to-patch-php2shell/

endoflife.ai — PHP2Shell fixed releases: https://endoflife.ai/article-php2shell-cve-2026-109618