What is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?
PHP is the programming language that runs behind a very large share of websites, including WordPress, Joomla, Drupal and Magento sites. PHP2Shell is the name researchers use for two vulnerabilities in PHP itself, not in a plugin or a theme. Both stem from the same problem: PHP can leave its memory in a corrupted state when a request ends abnormally.
- CVE-2026-109618 (advisory GHSA-w8hw-w9fx-j79w): remote code execution through out-of-memory handling. PHP says complete remote code execution was validated over HTTP against Apache mod_php with default settings.
- CVE-2026-109619 (advisory GHSA-6wmf-4rv5-p3rp): remote code execution through stale state that survives from one request to the next. Confirmed impact includes memory disclosure and code execution with the web worker’s privileges.
In plain English: on an unpatched server, someone on the internet could send crafted requests to your website and, in the worst case, run their own commands on the server that hosts it. An unpatched site looks and works normally, so the reliable signal is the PHP version number your server runs.
Is my WordPress site affected by PHP2Shell?
If your site runs on WordPress, it runs on PHP, so the server underneath is in scope until it is updated. According to the PHP security advisory, all PHP installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers the risk highest for mod_php. The UK National Cyber Security Centre encourages organisations to identify every system running PHP, starting with internet-facing ones, and update to the latest fixed version.
This applies to any industry: a dental practice, a law firm, a restaurant, a shop or a consultant. What matters is the software on your server, not what you sell. If you are not sure what your site runs on, your developer or host can tell you in one sentence.
The good news: many managed hosts update PHP on their own, and php.net says Linux distributions and LTS vendors received the patches in advance. Google Cloud, for example, says supported App Engine standard runtimes are patched automatically. Your site may already be fixed. The only way to know is to ask for the exact version. Our guide on how to check your PHP version in WordPress or cPanel shows where to look.
Which PHP version is safe?
These are the fixed versions published in the php.net advisory and both GitHub advisories on October 21, 2026, and listed in the PHP 8 ChangeLog.
| PHP branch | Affected | Safe version |
|---|---|---|
| PHP 8.5 | Below 8.5.12 | 8.5.12 or later |
| PHP 8.4 | Below 8.4.27 | 8.4.27 or later |
| PHP 8.3 | Below 8.3.36 | 8.3.36 or later |
| PHP 8.2 | Below 8.2.35 | 8.2.35 or later |
| PHP 8.1, 8.0, 7.x and older | No official update from the PHP project | Move to a supported version, or get a backported fix from your Linux distribution or LTS vendor |
PHP 8.1 and older no longer receive updates from the PHP project; php.net lists PHP 8.1 as end of life since December 31, 2025. Some distributions and LTS vendors provide backported fixes, and the PHP team published minimal source backports for 7.4, 8.0 and 8.1 for people who build PHP from source. For most small businesses, the practical answer is to move to a supported version: see PHP 8.1 end of life and PHP2Shell: how to upgrade safely.
How do I fix PHP2Shell?
- Ask your host or developer which exact PHP version your site runs.
- Make sure it is on the fixed list above (8.5.12, 8.4.27, 8.3.36 or 8.2.35, or later).
- If you are on PHP 8.1 or older, plan the move to a supported version, or confirm a vendor backport.
- Get the answer in writing, with the date the update was applied.
Both PHP advisories say that updating is the only complete mitigation. They list temporary configuration measures for administrators who cannot update right away, and state plainly that those do not fully protect a server. Cloudflare says it observed attack traffic targeting its customers after details leaked before the official release, deployed firewall protections automatically on all plans with its WAF, including Free, and still tells customers to patch PHP. BleepingComputer reports its CTO stressed those protections are temporary. Huntress said on October 21 that it had not yet seen exploitation across its partner base, while others were reporting attacks emerging.
What to send your host or developer
Copy this short checklist into an email. A good host can answer it in minutes.
- Which exact PHP version is my website running right now (for example 8.3.36)?
- Is it at or above one of the fixed releases: 8.5.12, 8.4.27, 8.3.36 or 8.2.35?
- If we are on PHP 8.1 or older: do we have a backported fix from our vendor, and when can we move to a supported version?
- Was PHP restarted after the update, so the fixed version is the one actually serving pages?
- Do we have other places running PHP (a staging copy, an old subdomain, a control panel, a plugin or tool on the same server)? Are they updated too?
- Can you confirm the answers by email, with the date the update was applied?
What our free PHP2Shell exposure check looks at
We visit your website like any visitor would and note what it publicly shows: the PHP version it reports, if it reports one, and the platform it appears to run. Within 24 hours you get a short email with what we saw and what to ask your host.
- No login, no access to your server, no scanning for weaknesses, no exploit testing.
- Many sites hide their PHP version, which is good practice. If yours does, we say so: only your host can confirm the version.
- We do not change or fix servers, and we do not quote prices. If the answer is “ask your host”, that is the answer.
PHP2Shell questions small business owners ask
What is PHP2Shell?
PHP2Shell is the name used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The PHP security team rates both 9.2 (CVSS v4.0). Both can let an attacker who is not logged in run code on the web server, with the privileges of the web worker account. PHP released fixes on October 21, 2026.
Is my WordPress site affected by PHP2Shell?
WordPress runs on PHP, so the server behind a WordPress site is in scope until it runs a fixed PHP version. According to PHP, all installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The same goes for Joomla, Drupal, Magento and other PHP sites. Many hosts update PHP for their customers (Google Cloud, for example, says supported App Engine standard runtimes are patched automatically), so ask yours to confirm the version.
Which PHP version is safe from PHP2Shell?
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Earlier releases on those branches are affected. PHP 8.1 and older no longer receive updates from the PHP project; some Linux distributions and LTS vendors provide backported fixes, otherwise upgrade to a supported version.
How do I fix PHP2Shell?
Update PHP to a fixed release and restart it. If a host or developer manages your server, send them the checklist on this page and ask them to confirm the exact version in writing. Both PHP advisories say updating is the only complete mitigation.
Is there a workaround if we cannot update today?
The PHP advisories list configuration measures that reduce some attack paths, such as settings for memory_limit and session.upload_progress.enabled. They state these are not a complete mitigation. They are for server administrators; a website owner should ask the host to update instead.
Are attackers already using PHP2Shell?
Cloudflare says it observed attack traffic targeting its customers after details leaked before the official release. It deployed firewall rules for all plans with its WAF, including Free, and still tells customers to patch PHP. Huntress said on October 21 that it had not yet seen exploitation across its partner base, while others were reporting attacks emerging.
What does the free PHP2Shell exposure check look at?
Only what your website shows publicly to any visitor: the PHP version it reports, if it reports one, and the platform it appears to run. We do not log in, scan for weaknesses or test any exploit. Many sites hide their PHP version, which is good practice; in that case we tell you so, and you get the questions to ask your host.
Will Pixelmosa fix my server?
No. The check tells you what your site publicly shows and what to ask your host or developer. Updating PHP is their job, and many managed hosts do it for you.
Sources
Official PHP project
- php.net security advisory, Oct 21, 2026: Critical remote code execution vulnerabilities, update now
- PHP security advisory GHSA-w8hw-w9fx-j79w: RCE via OOM corruption (CVE-2026-109618)
- PHP security advisory GHSA-6wmf-4rv5-p3rp: RCE via stale global state (CVE-2026-109619)
- PHP 8 ChangeLog (8.5.12, 8.4.27, 8.3.36, 8.2.35)
- php.net: Supported versions
- php.net: Unsupported (end of life) branches
CVE records
Government cyber security agencies
Infrastructure providers and researchers
This page sums up public advisories for non-technical readers and is not legal or security advice. Facts as of .