Key takeaways
- Two PHP engine bugs, nicknamed PHP2Shell, let an unauthenticated attacker run code on a web server. Both are scored 9.2 (CVSS v4) and hit the PHP runtime itself, so every framework on top of it — WordPress, Laravel, Magento, custom code — inherits the risk (Qualys).
- What changed this week: CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on 26 October, after honeypots recorded successful code execution over the weekend (BleepingComputer).
- Fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older on those branches is in scope. PHP 8.1 and below get no regular release (NCSC-NL).
- Apache with mod_php is the most urgent case. PHP-FPM, php-cgi, LiteSpeed and FrankenPHP are also affected, but exploitation there needs more specific conditions.
- If you can't patch today, set
session.upload_progress.enabled=0in the main php.ini and restart workers. It narrows the attack surface but is not a fix.
1. What PHP2Shell is, in plain terms
PHP's security team shipped fixes on 21 October 2026. Details and CVE numbers leaked before the patches landed, and Amazon's threat intelligence team reported probing starting about four days before release (BleepingComputer).
The two bugs are both memory-safety problems in how PHP cleans up after a request:
| CVE-2026-109618 | CVE-2026-109619 | |
|---|---|---|
| Bug type | Out-of-memory handling leaves request data half-initialised; shutdown trusts it | Request-owned global state survives after being freed; a later request on the same worker reuses it (use-after-free) |
| Requests needed | One per attempt (demonstrated on mod_php, prefork) | Two, landing on the same worker |
| Shown working on | Apache mod_php, default limits | mod_php (PHP 8.5 fatal-backtrace path); mod_php and PHP-FPM via session upload progress |
| Auth needed | None | None |
| CVSS v4 | 9.2 | 9.2 |
"High attack complexity" in the score means the exploit depends on memory layout, build and worker scheduling, so it does not work first time on every box. Attackers deal with that by retrying thousands of times. That is exactly what scanners now do.
A third, related issue, CVE-2026-115560, needs an unusual mix of configuration and application code. PHP published mitigations for it on 23 October; the same session.upload_progress setting below is the main lever.
2. Which version do you need?
Check with php -v on the CLI, but trust a phpinfo() page or your control panel for the web version — the CLI and the web SAPI are often different builds on the same server.
| Branch | Patched upstream release | Status |
|---|---|---|
| PHP 8.5 | 8.5.12 | Supported |
| PHP 8.4 | 8.4.27 | Supported |
| PHP 8.3 | 8.3.36 | Supported |
| PHP 8.2 | 8.2.35 | Security fixes only |
| PHP 8.1, 8.0, 7.4 | No release; minimal source backports only | End of life |
| PHP 7.3 and older | Nothing | End of life |
Two traps:
- Distro packages keep old version numbers. Ubuntu, Debian and RHEL backport fixes, so
8.1.2-1ubuntu2.xcan be patched while showing "8.1.2". Check your distro's security tracker for the CVE, not the version string. - Old branches are the majority. Qualys counts about 110 million of 156 million versioned PHP installs — 71% — on end-of-life branches (5.4 to 8.1). For those, the real fix is a branch upgrade.
3. Who is most exposed
| Setup | Risk | Why |
|---|---|---|
| Apache + mod_php (older VPS images, legacy cPanel/WHM, XAMPP-style servers exposed online) | Highest | One unauthenticated request can trigger the bug before your app code runs |
| PHP-FPM behind Nginx or Apache | High | 109619 path demonstrated; PHP-FPM startup blocks one 109618 path |
| LiteSpeed (lsphp), common on Indian shared hosts | High until host patches | Affected SAPI; you depend on the host's build |
| FrankenPHP, php-cgi | High | Listed as affected |
| Appliances with embedded PHP (NAS, firewalls, UPS/printer web UIs, CRM boxes) | Often forgotten | Need vendor firmware; e.g. Ubiquiti fixed UISP CRM in 3.1.70 (NCSC-NL) |
4. The 48-hour plan
Today (hour 0–4)
- Inventory. List every server, container image and appliance that serves PHP. Include staging sites and old microsites — they are the ones nobody patches.
- Patch what you can.
apt update && apt upgrade php*ordnf update php*, then restart PHP-FPM and Apache. A reload that leaves old workers alive does not count. - Container images: rebuild from a patched base (
php:8.4-fpmtags pull 8.4.27 or later once published) and redeploy. A patched host doesn't fix an old image.
If you can't patch yet — PHP's temporary guidance, summarised by Qualys:
| Setting | Value | Trade-off |
|---|---|---|
session.upload_progress.enabled |
0 in main php.ini, then restart |
Breaks upload progress bars (rarely used) |
fatal_error_backtraces (PHP 8.5) |
0 |
Less detail in fatal-error logs |
post_max_size |
8M (no uploads) or 32M (uploads) |
Large uploads fail |
PHP-FPM pm.max_requests |
1 if load allows |
Real CPU cost; test first |
| Multipart requests | Block at proxy/WAF where the app doesn't need them | Breaks forms that upload files |
Set these in the main config — ini_set() and .user.ini are not enough. None of this is a complete fix; it buys days, not months.
Tomorrow (hour 24–48)
- Hunt. Look at web and PHP-FPM logs from 17 October onwards for bursts of malformed multipart POSTs, spikes of
Allowed memory size exhaustedfatals, and worker segfaults (child exited on signal 11). Then check for new PHP files in upload folders, unknown cron entries and new admin users in your CMS. - Plan the branch upgrade for anything on 8.1 or older. WordPress and Laravel both run on 8.3+; most of the work is plugin and dependency testing.
5. Shared hosting: what you can and can't do
Most Indian small businesses run on shared or "managed" hosting, where you choose the PHP branch but the host controls the patch level.
- In hPanel, cPanel or Plesk, open the PHP version selector and note the exact version. If it is below the fixed release for your branch, raise a ticket and ask for the date they will roll out patched builds.
- If you're still on PHP 7.4 or 8.0 because "the site works", switch to 8.3 or 8.4 now on a staging copy, test, then flip production. Many hosts let you do this in one click.
- A WAF in front of the site helps. Cloudflare says it has shipped managed rules for these bugs (Cloudflare); check which of its plans include those rules before relying on them. A WAF reduces noise, it does not replace the patch.
- If your host hasn't answered within two working days, that tells you something about the host.
6. The India angle: CERT-In, DPDP and cost
- CERT-In's April 2022 directions require reportable incidents — including compromise of websites and servers — to be reported within six hours of noticing them. If your hunt finds a web shell, the clock starts then. Keep the CERT-In reporting format handy.
- The DPDP Act, 2023 expects "reasonable security safeguards" for personal data. A customer portal running an end-of-life PHP branch with a public RCE is hard to defend.
- Cost reality: patching a typical VPS takes 15–30 minutes. Upgrading a WordPress or Laravel site from 7.4 to 8.3 typically takes a developer one to three days of testing — far less than cleaning a compromised server, restoring from backup and dealing with a blacklisted domain or payment-gateway suspension.
- Agency-built sites: if a vendor built your site years ago and no one owns the server now, find out today who has root access. Unowned servers are the ones that get popped.
Bottom line
PHP2Shell is no longer theoretical: it is on CISA's exploited list, with code execution seen in the wild. Get every web-facing PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a distro build that carries the fix), restart workers, and switch off session.upload_progress until you do. Anything on 8.1 or older needs a branch upgrade, not a patch.
Need a hand patching a fleet of PHP servers or hunting for web shells? See our system administration and incident monitoring services, and check your site's response headers with the free HTTP headers checker.