On October 21, 2026, banks, hospitals, and government agencies pulled websites offline in a scramble. The cause: two critical flaws inside PHP itself, the language that runs roughly 70% of sites with a known server-side language.
If that sounds like your stack, you're not alone. Plenty of businesses run PHP somewhere, whether it's a Laravel app, a WordPress storefront, or an old internal portal nobody has touched since 2019. The PHP2Shell vulnerability doesn't care how clean your application code is. It sits in the engine that runs that code.
Patches exist. The catch is speed. Attackers started probing four days before the fixes shipped, and Censys still counted more than 34 million PHP services on affected versions as of October 23.
We've pulled together what's confirmed, what isn't, and what to do this week. You'll get the patched version numbers, a seven-step fix, and a straight answer on what to do if you're stuck on PHP 8.1 or older. No scare tactics. Facts and dates only.
Quick Answer: PHP2Shell is a pair of critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that let attackers run code on a server without logging in. Fix it by updating PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, then restart PHP and your web server so the patched code loads.
What is PHP2Shell? PHP2Shell is the nickname for two memory-safety flaws in the PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619. Both score 9.2 out of 10 on the CVSS 4.0 scale. They live in PHP itself, not in WordPress, Laravel, or any plugin. In the worst case, on Apache with mod_php, one unauthenticated request can trigger an attack before any of your application code runs.
Key Takeaways:
- Patch PHP itself. Install 8.5.12, 8.4.27, 8.3.36, or 8.2.35, then restart PHP and your web server. Older releases inside those branches stay exposed, even if everything else is current.
- Your CMS update won't help. The flaws live in the PHP runtime, so WordPress, Drupal, and plugin updates don't close them. Whoever manages your server has to act.
- Attempts are real. Mass compromise is unconfirmed. Attacks were logged from October 17, so treat any quiet stretch as a head start, not a reprieve.
- Unsupported PHP is the biggest gap. PHP 8.1 and earlier get no official fix. You need a vendor backport now and an upgrade soon.
- Config tweaks buy time only. Disabling session.upload_progress or adding firewall rules cuts exposure. Neither replaces the patch.
Local Expertise: Software work in Delaware and across the US now means more than new builds. Plenty of companies run aging PHP applications that need patching, upgrading, or a rebuild. Syndell Technologies, headquartered in Middletown, Delaware, supports businesses across the USA, UK, UAE, Canada, Australia, and India with Laravel development, cloud migration, and custom application development, backed by 1,100+ delivered projects in 20+ countries.
What Happened With PHP2Shell, and When
First, a correction worth making. PHP's own servers weren't hacked this time. (That happened in 2021, when attackers pushed a backdoor into PHP's old Git server. Different story.) Here, researchers found two bugs in the language itself.
Both are memory-safety flaws, both rate 9.2 on CVSS 4.0, and both can lead to remote code execution without a login. Kaspersky's technical write-up covers the mechanics. Here's the timeline that matters:
| Date | What happened |
|---|---|
| 2024 | First signs of the out-of-memory flaw surface during PHP's first external security audit in years, run by Quarkslab and funded through the Sovereign Tech Agency |
| August 11, 2026 | Security firm Calif and OpenAI independently report the root cause, and Calif demonstrates remote code execution |
| October 17, 2026 | Amazon Threat Intelligence logs the first exploitation attempt |
| October 20, 2026 | Vulnerability IDs and a demo leak ahead of the planned October 22 disclosure |
| October 21, 2026 | PHP ships emergency patches, and sites go offline worldwide |
Researchers trace the affected code back to PHP 5.4, released in 2012. So this isn't a new bug. It's an old one that finally got found.
The PHP Foundation later described the long delay as a structural failure, pointing to slow decisions and thin resources, and asked companies and governments to fund PHP security work. Credit to them for saying it plainly. It's also a fair prompt for your own team. What security work keeps slipping down your list?
Is Your Site Exposed?
Short answer: if it runs PHP and serves web requests, check it. That covers PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The PHP security team rates mod_php highest, because one demonstrated attack needs no login and fires before your application code even starts.
Your framework doesn't change the answer. WordPress, Drupal, Joomla, Laravel, a hand-built app. Same engine underneath.
| PHP branch | Vulnerable | Fixed in |
|---|---|---|
| 8.5 | 8.5.11 and earlier | 8.5.12 |
| 8.4 | 8.4.26 and earlier | 8.4.27 |
| 8.3 | 8.3.35 and earlier | 8.3.36 |
| 8.2 | 8.2.34 and earlier | 8.2.35 |
| 8.1 and older | All releases | No official release. Use an operating system vendor backport or upgrade |
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain the fixes, all released October 21, 2026. Anything older within those branches, such as 8.5.11 or 8.3.35, is still exposed. PHP 8.1 and earlier get no official release, so you'll need a backport from your operating system vendor or an upgrade to a supported branch.
Does PHP2Shell affect WordPress?
Yes, indirectly. WordPress runs on PHP, so a WordPress site on an unpatched PHP version is exposed. But updating WordPress core, themes, or plugins won't close the hole. The fix is a PHP update applied by whoever manages your server or hosting plan. Managed hosts may handle it for you, so ask them directly whether they've patched or only mitigated.
What We Know About Exploitation
Let's separate confirmed from claimed, because this part gets exaggerated in both directions.
Confirmed:
- Amazon Threat Intelligence logged an exploitation attempt on October 17, four days before the patches, according to BleepingComputer.
- Cloudflare says its firewall rules went live nine hours before disclosure, and it still saw early attacks.
- Honeypot networks, including WatchTower's, report exploitation attempts from release day onward.
Not established:
- Widespread successful compromise. Beazley Security said on October 23 that it knew of no confirmed mass exploitation.
- A listing in CISA's Known Exploited Vulnerabilities catalog. Neither CVE appeared there in reports dated October 23, so check the catalog for current status.
- Reliable public exploits. VulnCheck noted that many of them depend on the display_errors setting, which production servers rarely enable. But Akamai says it built a working exploit for CVE-2026-109618 and shared it privately with some customers.
Our read: treat this as a head start, not a reprieve. Scanners are already hunting. Patch as if the exploit works, because somebody's does.
Is PHP2Shell being exploited in the wild?
Attempts, yes. Amazon, Cloudflare, and several honeypot networks have recorded them since October 17. Confirmed mass compromise, no, at least in reporting through October 23. Neither CVE had been added to CISA's Known Exploited Vulnerabilities list at that point. Check the catalog for current status, and patch regardless, since attempts often come before successful attacks.
Not Sure Which PHP Version Your Apps Run?
We inventory every PHP server, container, and bundled tool you operate, then map a patch plan before attackers find the gaps you missed.
Schedule Your PHP Security Review
How to Fix PHP2Shell in 7 Steps
Here's the sequence we'd follow, whether you run one server or fifty. Start with whatever faces the internet.
- Inventory every PHP install. Count production servers, staging, containers, CI images, and any appliance or hosted tool that bundles its own PHP. Forgotten boxes are where trouble starts.
- Check the real version. Your command-line PHP can differ from the PHP your web server uses, so check both.
- Update to a fixed release. Move to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or install your operating system vendor's patched package. For containers, rebuild from an image tagged with a fixed version, such as 8.4.27.
- Verify backports by changelog, not version number. Linux vendors often patch without changing the version string. Look for the CVE IDs.
- Restart everything. Restart PHP-FPM, Apache, or your application server so every worker loads the patched code. Skipping this is a common miss.
- Review logs back to October 17. Look for odd multipart POST requests, new or changed .php files in web roots and upload folders, and outbound connections from web servers to unfamiliar hosts.
- If you find signs of compromise, act fast. Isolate the system, preserve your logs, and report it to the FBI at ic3.gov. Because attackers may have read server memory, rotate credentials, API keys, and tokens too.
# Check the CLI and web-facing versions (package names vary by system)
php -v
php-fpm -v
# Debian or Ubuntu: confirm the fix is in the package changelog
apt changelog php8.3-fpm | grep -i "CVE-2026-10961"
# RHEL-family systems
rpm -q --changelog php-fpm | grep -i "CVE-2026-10961"How do I check my PHP version?
Run php -v on the server to see the command-line version. Your web server may use a different build, so also run php-fpm -v if you use FPM, or check the loaded Apache module. Compare the result with the fixed releases: 8.5.12, 8.4.27, 8.3.36, or 8.2.35. On Linux, check the package changelog for the CVE numbers, since vendors backport fixes without changing the version.
Why Config Workarounds Aren't a Fix
You'll see quick fixes floating around. Some help. None finish the job.
| Option | What it does | Limits |
|---|---|---|
| Patch PHP | Closes both flaws | Needs a restart and some testing |
| Disable session.upload_progress | Blocks the confirmed upload-progress paths for CVE-2026-109619 | Doesn't address CVE-2026-109618, so it's temporary at best |
| Firewall or virtual patch rules | Blocks known exploit patterns | New variants can slip past, so it only buys time |
| Take the system offline | Removes the exposure entirely | Interrupts business, but CISA advises it when you can't patch |
PHP core developer Gina Peter Banyard warned before disclosure that no mitigation fully blocks these attacks, and that official patches are the only permanent defense.
Is disabling session.upload_progress enough?
No. Setting session.upload_progress.enabled to 0 and restarting workers blocks the confirmed session upload paths for CVE-2026-109619, but it doesn't cover CVE-2026-109618. Treat it as a temporary measure while you schedule the real update. The PHP security team and independent researchers agree that installing the patched release is the only complete fix.
Patching Forty Servers, Not One?
Our full-cycle development team handles the upgrades, testing, restarts, and verification across your clouds and hosts. Your team stays on product work.
Get Your Patch Assessment.
The Bigger Risk: PHP Versions Nobody Supports
Here's the part that worries us most. Patching is easy when a fix exists. But PHP 8.1 reached end of life at the end of 2025, and the official PHP project didn't release a fix for it. Censys counted more than 34 million PHP services on affected versions as of October 23, according to Security Affairs, and VirusTotal found that most servers revealing their PHP version were on end-of-life branches.
Some Linux vendors backport fixes to older packages, and that's a legitimate stopgap. But a backport is borrowed time. Each unsupported version you keep running means more exposure to the next critical bug, with no guarantee anyone will fix it.
Also watch your calendar. PHP 8.2 moves to security-only fixes and ends on December 31, 2026, per PHP's supported versions page. That's about nine weeks away. And WordPress 7.0 recommends PHP 8.3 or newer.
Our view? If you're on PHP 8.1 or older, patch through your vendor this week, then book the upgrade. Don't let a backport become your long-term plan.
| Approach | Best when | Trade-off |
|---|---|---|
| Patch in place | You're on a supported branch | Fast, but doesn't fix aging code |
| Upgrade to a supported branch | Your app is mostly current, with some old dependencies | Needs testing and dependency updates |
| Modernize or rebuild | The app is a decade old, poorly tested, or hard to change | Bigger project, longer-term payoff |
Running PHP 8.1 or Older?
Whether you need a vendor backport this week or a Laravel upgrade this quarter, we plan and deliver the move to a supported PHP version for you.
Schedule Your Consultation.
Five Questions to Ask Your Team This Week
You don't need to read memory dumps to lead through this. You need clear answers. Put these to your IT or engineering lead:
- Do we have a current list of every PHP runtime we operate, including staging and containers?
- Who owns patching, and how many hours does it take them to ship an emergency update?
- Is our hosting provider fully patched, or only running temporary mitigations?
- Do any vendor tools or appliances bundle their own copy of PHP?
- If a server were compromised, could we find and rotate the affected credentials fast?
Vague answers are an answer. If nobody can say what's running where, that's your first project.
Is PHP Still a Safe Bet?
Yes, with discipline. We've delivered 1,100+ projects across 20+ countries, and one lesson repeats: platform choice matters less than patch habits. Every major runtime has shipped critical bugs. The ones that hurt are the ones nobody updates.
So don't rip out PHP in a panic. Rebuilding a working application because of one patchable flaw rarely makes sense. But do use this moment to retire unsupported versions and clarify who owns runtime updates.
If you're weighing PHP against other options for a new build, our guide to the best backend technologies for web development is a useful starting point. These flaws don't touch Node.js, but the same patch discipline applies there too.
Planning a bigger move off legacy code? Syndell's guide on how to plan legacy software modernization shows where to start.
Conclusion
PHP2Shell is a patch-now problem with a clear fix. Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, restart your workers, and check logs back to October 17. If you're on PHP 8.1 or older, a vendor backport buys time, but an upgrade is the real answer.
Why does this matter beyond one weekend of patching? Because the PHP2Shell vulnerability exposed a pattern: unpatched servers, forgotten apps, and no clear owner for runtime updates. Fixing those habits protects you from the next critical bug, whatever language it lands in.
Here's the order we'd work in. Today: inventory your PHP installs and confirm versions. This week: patch, restart, verify, and review logs. This quarter: plan the move off any unsupported version.
You don't have to do it alone. Syndell Technologies helps businesses across the US modernize legacy PHP applications, migrate them to the cloud, and build faster, safer replacements through our custom software development team and software development company in the USA services.
Ready to get your PHP stack on solid ground? Schedule a meeting with Syndell Technologies, or get an estimate for your upgrade. No obligation, just a clear plan.
