PHP2Shell (CVE-2026-109618, CVE-2026-109619): What Website Owners Must Do Now

On 21 October 2026 the PHP project released emergency security updates for two critical flaws in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619 and widely known as PHP2Shell. Both are rated 9.2 on CVSS v4.0, both can be triggered by an unauthenticated visitor, and attacks have since been reported in the wild. If your website runs on PHP, which includes most WordPress, Drupal, Joomla, Magento and Laravel sites, this guide explains what the flaws are, how to tell whether you are affected, and what to do today.

What is PHP2Shell?

PHP2Shell is the name for two related memory-safety bugs in the PHP core, the engine that runs your code on the server. They were reported by researchers at Calif, Wiz and OpenAI and fixed in a coordinated release by the PHP security team.

• CVE-2026-109618 (out-of-memory corruption). If a request hits PHP’s memory limit at the wrong moment, PHP can leave partly initialized data behind that its clean-up code later treats as valid.
• CVE-2026-109619 (stale state after a fatal error). A fatal error can leave internal state pointing at memory from a previous request, which a later request handled by the same PHP worker can then reuse.

Researchers showed that a specially crafted request can turn these bugs into remote code execution: running the attacker’s own code on your server. The PHP Foundation confirmed this on Apache with mod_php using default settings, and on PHP-FPM through code paths in applications. Cloudflare also lists denial of service and data exposure as possible outcomes.

Why your own code doesn’t protect you

The flaw is in PHP, not in your theme, plugins or application. The vulnerable code runs while PHP handles the request, so a site can be exposed even when its own code is perfectly safe. That is why updating WordPress or your plugins is not enough on its own: the PHP runtime on the server has to be updated.

Which PHP versions are affected?

Linux distributions and long-term-support vendors received the patches in advance, so your operating system’s PHP package may carry the fix under its own version number. Check your vendor’s security notice if you use packaged PHP from Debian, Ubuntu, Red Hat or similar.

Is PHP2Shell being exploited?

At release, the PHP team said it had not seen working exploits. That changed quickly:

• Amazon reported its first exploitation attempt on 17 October, four days before disclosure, and later described broad attempts in the wild.
• On 24 October a researcher reported honeypots running PHP 8.4.26 being successfully exploited.
• On 26 October CISA added both CVEs to its Known Exploited Vulnerabilities catalog.

Treat any unpatched, internet-facing PHP server as at risk now.

How to check your PHP version

1. Use our checker. php2shell.reguweb.com reads the version your server reports in its response headers and tells you whether it looks affected, patched or inconclusive.
2. In WordPress, go to Tools → Site Health → Info → Server to see the PHP version.
3. In your hosting control panel, look for “PHP version” or “PHP settings”.
4. On a server you manage, run php -v and check the version used by your web server or PHP-FPM, which can differ from the command-line one.

Many servers hide their PHP version, so a clean or inconclusive result from any outside check is a signal, not proof. Confirm the installed version with your host.

What to do now

1. Update PHP. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, or your vendor’s patched package. This is the only complete fix. If you are on PHP 8.1 or older, plan a move to a supported branch.
2. Restart PHP. Updating packages doesn’t patch processes that are already running. Restart PHP-FPM, Apache or your other PHP workers after the update.
3. Ask your host if you can’t update yourself. On shared or managed hosting the provider controls PHP. Ask them to confirm the security update is installed.
4. Apply temporary mitigations only while you patch. PHP published configuration workarounds, such as disabling session.upload_progress.enabled, that reduce exposure but are not a full fix. Apply them with your host or developer, and keep upload progress disabled after patching until the next regular release, which also covers the related CVE-2026-115560.
5. Turn on WAF protection. Cloudflare deployed managed rules for these flaws on free and paid plans. A web application firewall buys time but doesn’t replace the update.
6. Look for signs of compromise. If your server was unpatched and exposed, review new or changed files, unknown admin users and unusual outbound traffic, or ask a specialist to check.

What about WordPress and other CMSs?

Researchers demonstrated attacks against WordPress, Drupal, Joomla, Magento, MediaWiki, Laravel and Symfony, but the CMS is only a representative target: exploitation doesn’t depend on a particular application. Keep WordPress and your plugins updated as usual, and make sure the PHP version underneath has been patched too.

Frequently asked questions

Does PHP2Shell affect my site if it only runs a simple page?

Yes, potentially. The flaw sits in the PHP runtime, so any page served by an affected PHP version can be a way in.

Will checking my site with php2shell.reguweb.com harm it?

No. The checker sends a single HEAD request (falling back to GET) and reads the response headers. It never sends anything that could trigger the vulnerability.

My host says PHP is up to date but the version header shows an old number. Who is right?

Your host may have installed a vendor package that includes the fix under an older-looking version number, or the header may be cached or hidden. Ask the host to confirm that the PHP2Shell patches are applied.

Is a firewall enough?

No. WAF rules reduce risk while you patch, but only updating PHP removes the vulnerability.

Sources

• The PHP Foundation: today’s PHP security release
• PHP security advisory on GitHub
• Tenable: PHP2Shell frequently asked questions
• NCSC-NL: operational information on PHP2Shell
• Cloudflare: protections against PHP2Shell