PHP2Shell is the name associated with two critical security vulnerabilities in the PHP programming language that can allow attackers to execute code remotely on vulnerable servers without logging in. Disclosed in October 2026, these flaws affect PHP's core runtime rather than a particular website application or plugin. Website owners, developers, hosting providers, and system administrators should check their PHP versions and install the appropriate security updates immediately.
What Is PHP2Shell?
PHP2Shell refers to research into two critical vulnerabilities in PHP's underlying engine and the exploit techniques used to demonstrate their impact. PHP is a server-side programming language used by millions of websites and web applications, including sites built with content management systems such as WordPress, Drupal, and Joomla.
Unlike a vulnerability limited to one plugin or theme, PHP2Shell affects the PHP runtime itself. An application may contain no obvious vulnerable code and still be exposed if it runs an affected PHP build. Depending on the execution environment and the vulnerability, successful exploitation can lead to remote code execution or disclosure of sensitive information held in PHP process memory.
The term PHP2Shell is also used for demonstrations that turn a vulnerability in PHP into shell-level command execution. It should not be confused with a single universal exploit that works identically on every server. Actual exposure depends on the PHP version, the execution model, configuration, and whether the relevant security fixes have been installed.
PHP2Shell CVEs Explained
The PHP2Shell disclosure covers two separate vulnerabilities. Both involve unsafe handling of internal memory or state in PHP, but their underlying failure conditions differ.
1. CVE-2026-109618: Out-of-Memory Corruption
CVE-2026-109618 involves PHP's handling of out-of-memory conditions. When an operation fails because memory is exhausted, internal request data may be left partially initialized. If later cleanup code treats that data as valid, memory corruption can occur. Under the relevant conditions, an attacker can use this behavior to achieve remote code execution.
2. CVE-2026-109619: Stale Global State
CVE-2026-109619 involves request-specific state that can remain accessible after the memory it refers to has been released. A later request handled by the same worker may use that stale reference before normal initialization replaces it. This use-after-free condition can potentially be exploited to execute code remotely.
Both vulnerabilities are serious because exploitation may not require an authenticated account. The PHP security advisories explain the individual flaws and their patched versions.
Which PHP Versions Are Affected by PHP2Shell?
The PHP project published security releases on October 21, 2026. The following table lists the affected release ranges and the corresponding upstream fixed versions for the maintained branches.
| PHP branch | Affected versions | Fixed version |
|---|---|---|
| PHP 8.5 | Versions before 8.5.12 | 8.5.12 or later |
| PHP 8.4 | Versions before 8.4.27 | 8.4.27 or later |
| PHP 8.3 | Versions before 8.3.36 | 8.3.36 or later |
| PHP 8.2 | Versions before 8.2.35 | 8.2.35 or later |
| PHP 8.1 and older | Older unsupported branches may also be affected | Check vendor backports and migrate to a supported release |
How to Check Your PHP Version
The first step in protecting your website is to identify every PHP runtime that handles web requests. A server may have multiple PHP versions installed, and the command-line version can differ from the version used by PHP-FPM or a web server.
Check PHP from the Linux Terminal
Connect to your server using SSH and run the following command:
php -vThis displays the PHP version used by the command-line interface. If your server uses PHP-FPM, list the installed PHP-FPM services and packages as well. For example, on Debian-based systems, you can inspect installed PHP packages with:
dpkg -l | grep -E 'php[0-9.]*-(fpm|cli|common)'Confirm which PHP-FPM socket or service your web server configuration uses. If you manage multiple sites or containers, check each environment individually.
Check PHP Used by a Website
The PHP version serving website requests may differ from the CLI version. Check the PHP version in your hosting control panel, inspect the configured PHP-FPM service, or ask your hosting provider to confirm that the PHP2Shell security fixes are installed. Avoid leaving a public phpinfo() page on your website because it can disclose sensitive server configuration.
How to Fix the PHP2Shell Vulnerability
The primary remediation is to upgrade PHP to a security-fixed release. PHP's security team states that there are no complete configuration-only mitigations that replace installing the fix. Prioritize internet-facing production servers and all environments that handle public requests.
- Identify every PHP runtime used by your websites, APIs, background workers, and containers.
- Determine the installed version and whether your operating system or hosting provider has applied a security backport.
- Upgrade PHP to a fixed, supported release appropriate for your application and operating system.
- Restart or reload the relevant PHP-FPM services and web server where required by the upgrade process.
- Verify the running version or vendor security status after the update.
- Test your website, database connections, scheduled jobs, uploads, and important application workflows.
- Review server logs and investigate suspicious activity if the server was exposed while running a vulnerable version.
Updating PHP on Debian or Ubuntu
For Debian or Ubuntu servers, first check which PHP packages and repositories manage your installation. If the security-fixed package is available through your configured repository, update the relevant packages using the package manager. Package names and service names vary by PHP branch and installation method.
sudo apt update
apt policy php8.4-fpm php8.4-cliThe example checks package availability for PHP 8.4; it does not install an update by itself. Review the candidate version and repository before proceeding. If your distribution does not provide the required fix, consult its security advisory or an appropriate supported PHP package source rather than assuming that a routine update has resolved the vulnerability.
After installing the correct fixed package, restart the relevant service if required. For a PHP 8.4 FPM installation, the service commonly uses the following name:
sudo systemctl restart php8.4-fpmReplace the service name with the version and service actually used on your server. If PHP runs inside Docker, a hosting platform, or a managed control panel, follow the update procedure for that environment and rebuild or redeploy affected images where necessary.
Can Disabling PHP Functions Fix PHP2Shell?
No. Disabling functions such as exec(), shell_exec(), system(), or passthru() is not a reliable fix for PHP2Shell. The vulnerabilities affect PHP's internal memory handling, and demonstrated exploitation can bypass restrictions that only disable particular PHP functions. Function restrictions may still be useful as an additional security control, but they do not replace a patched PHP runtime.
Is Disabling session.upload_progress Enough?
Some public proof-of-concept research describes exploitation paths involving session upload-progress handling. Disabling session.upload_progress may reduce exposure to a specific path, but it does not address every PHP2Shell vulnerability or provide complete remediation. Follow the official PHP advisory and install a fixed release instead of relying on this setting alone.
Does PHP2Shell Affect WordPress, Drupal, and Joomla?
Yes, websites built with WordPress, Drupal, Joomla, and other PHP-based systems can be affected when they run a vulnerable PHP runtime. The weakness exists in PHP itself, so updating a content management system or installing a plugin security patch alone does not fix an affected PHP installation.
Website owners should update the PHP runtime and then review their CMS core, themes, plugins, dependencies, and server configuration. Managed hosting customers should ask their provider to confirm that the PHP2Shell fixes are applied to the runtime serving their site.
How to Protect Your Website from PHP2Shell
- Install the relevant PHP security update as soon as possible.
- Replace unsupported PHP versions with supported releases or verified vendor-maintained packages.
- Inventory all web servers, PHP-FPM pools, containers, staging sites, and public-facing applications.
- Run PHP workers with least-privilege operating-system permissions.
- Keep the operating system, web server, CMS, libraries, and application dependencies updated.
- Protect environment files, private keys, database credentials, and API tokens from web access.
- Use a web application firewall and network restrictions as additional layers of defense, not as substitutes for patching.
- Monitor logs and alerts for unusual PHP worker activity, unexpected child processes, unfamiliar files, or unexplained changes to website content.
What Should You Do If Your Server May Have Been Exploited?
Updating PHP prevents exploitation through the fixed vulnerabilities, but it does not prove that a previously exposed server is clean. If you find suspicious activity, preserve relevant logs, restrict access to the affected system, and investigate with your incident response or hosting team.
- Review web server, PHP-FPM, authentication, and system logs around the exposure period.
- Look for unexpected processes launched by web-serving accounts, unfamiliar PHP files, modified application files, and suspicious scheduled tasks.
- Check for unauthorized changes to SSH keys, system services, user accounts, and file permissions.
- Rotate potentially exposed database passwords, API keys, deployment credentials, and other secrets from a trusted environment.
- Restore compromised applications from known-good backups where necessary, and rebuild affected systems if integrity cannot be established.
- Verify the patch and monitor the server for further suspicious activity.
Frequently Asked Questions About PHP2Shell
1. What is PHP2Shell in simple terms?
PHP2Shell is the name used for research into two critical vulnerabilities in PHP that may let an unauthenticated attacker execute code on a vulnerable server. The vulnerabilities affect PHP's core runtime.
2. What are the PHP2Shell CVE numbers?
The two vulnerabilities are CVE-2026-109618, involving out-of-memory corruption, and CVE-2026-109619, involving stale global state. Both were rated CVSS v4.0 9.2 by the PHP security team.
3. Which PHP version fixes PHP2Shell?
The upstream fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Choose the correct release for your branch and verify vendor security updates for older or distribution-maintained installations.
4. Can PHP2Shell be exploited without logging in?
Yes. The demonstrated vulnerabilities can permit unauthenticated remote code execution under relevant conditions. That is why internet-facing PHP installations should be patched urgently.
5. Does PHP2Shell affect PHP-FPM?
PHP installations serving web requests can be affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed deployments. The exact exposure depends on the runtime and environment, so check all PHP execution paths.
6. Does updating WordPress fix PHP2Shell?
No. Updating WordPress alone does not fix vulnerabilities in the PHP runtime. Install the PHP security update as well as keeping WordPress, plugins, and themes current.
7. Is PHP2Shell a vulnerability in a PHP plugin?
No. PHP2Shell concerns vulnerabilities in PHP itself, rather than a flaw restricted to one WordPress plugin or CMS extension. PHP-based applications can be affected because they rely on the vulnerable runtime.
8. Is disabling dangerous PHP functions enough?
No. Disabling shell-related functions can be a supplementary safeguard, but it does not correct the underlying memory-safety flaws. Installing a fixed PHP release is the primary remediation.
Conclusion
PHP2Shell is a critical reminder that website security depends on the underlying runtime as well as application code. CVE-2026-109618 and CVE-2026-109619 can allow unauthenticated remote code execution under relevant conditions, making vulnerable public-facing PHP servers a high priority for remediation.
Check every PHP runtime used by your website, install the appropriate fixed release, restart affected services when required, and verify the result. If a server was exposed while vulnerable, review logs and investigate signs of compromise. Prompt patching and careful verification are the most effective steps to reduce PHP2Shell risk.
Official Security References
- PHP 2026 Security Release Archive: https://www.php.net/archive/2026.php
- PHP Security Advisory — CVE-2026-109619: https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- CERT-EU Security Advisory 2026-018: https://www.cert.europa.eu/publications/security-advisories/2026-018
- NHS England Digital Security Alert: https://digital.nhs.uk/cyber-alerts/2026/cc-4875
