PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Is Your Website Affected, and Exactly What to Do Next

On 17 October 2026, four days before the public knew the bugs existed, an Amazon honeypot logged someone trying a PHP2Shell exploit. PHP2Shell is two critical flaws in PHP itself, the language behind WordPress and most of the web.

They let an attacker run code on your server without logging in. Fixes shipped on 21 October, but the bug is in the engine, not the car: updating WordPress, your theme or your plugins does nothing for PHP2Shell.

The fix comes from whoever runs PHP on your server. For most small businesses that's the hosting company, so the next step is usually one message to your host.

If you'd rather hand it over, our managed IT support team can check and patch your servers.

What is PHP2Shell?

PHP2Shell is the name for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, that let an attacker run code on a web server without logging in. They sit in PHP itself, so WordPress, Drupal and other PHP sites are exposed. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026.

Both are memory-safety bugs, each rated 9.2 out of 10 (CVSS 4.0). In the first, PHP runs out of memory while a request is half set up, and the cleanup code trusts the half-built data. In the second, data from one request outlives its memory and the next request on the same PHP worker uses it.

A crafted web request turns either into remote code execution. Calif, Wiz and OpenAI reported them; the name comes from a proof-of-concept tool called "PHP2Shell" that surfaced when the embargo broke.

Am I affected by PHP2Shell? A two-minute self-check

You're affected if your website runs on PHP and the PHP version is older than the fixed release for its branch. PHP's advisory says the risk covers "all PHP installations serving web requests", naming PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

• Using WordPress, Joomla, Drupal, Magento or WooCommerce on ordinary hosting? You run PHP. Check your version below.
• Using Wix, Squarespace, Shopify or Webflow? Nothing for you to patch: the platform manages PHP.
• Not sure who hosts your site? Our guide to getting control of your website and domain helps you find out.

mod_php carries the highest risk. That's PHP running inside Apache itself, where PHP says an unauthenticated request can trigger the attack "before any application code runs", and full code execution was shown on mod_php with default settings. On PHP-FPM, code execution was confirmed through certain application code paths: lower risk, not no risk.

How old does it go? Google Cloud and Cloudflare say PHP 5.4 and later, and Tenable cites Calif tracing the earliest affected code to PHP 5.4.0. PHP's advisory lists no range. Assume your version is affected until it's patched.

Timeline: from a 2024 audit to a leak and an emergency release

All times are UTC.

The PHP Foundation called its own delay on the first bug "a structural failure".

Is PHP2Shell being exploited? Sources disagree

• Amazon saw an attempt on 17 October and more proofs of concept from about 02:00 on 21 October, and now reports broad exploitation attempts, though it says it's unclear whether the early ones would have worked.
• watchTowr says its honeypots saw exploitation of both CVEs from 21 October. Cloudflare saw attack traffic and payloads changing to dodge its rules, but its own post gives no numbers.
• CISA had "not observed successful exploitation" on 21 October, and neither CVE was in its Known Exploited Vulnerabilities catalogue at its 23 October update (still the latest when checked on 26 October).
• The PHP Foundation found no working public exploits at release. Sansec wrote on 22 October that mass exploitation looks less likely: public exploits don't work on a default install, and most need a second bug in the website.
• Sophos said on 23 October there was "no evidence of a successful compromise due to these vulnerabilities", after blocking an attempt to install a Mirai botnet variant. On 25 October, The Hacker News reported that Palo Alto Networks' Unit 42 had withdrawn an earlier claim that PHP2Shell was used against a European government agency.

The fair summary: people are actively trying, and successful mass attacks were not confirmed as of 26 October. That's a reason to patch calmly this week, not to wait.

Fixed PHP versions for each branch

The status below is correct as of 26 October 2026.

One catch: Linux distributions often backport fixes without changing the version number, so the package changelog is the real proof (see the sysadmin section).

A third of WordPress sites run PHP that gets no official fix

WordPress.org's public statistics (pulled on 26 October 2026) show which PHP branch reporting WordPress sites run:

That's 34% of WordPress sites on PHP 8.1 or older, where the PHP project shipped no official release. Some hosts will have backported the fix; many will not.

The figures show the branch, not the patch level, so even the 66% are safe only once their host installs the October update.

How to check your PHP version

1. WordPress: go to Tools > Site Health > Info and open the Server section.
2. cPanel: open MultiPHP Manager. It lists each domain's PHP version and whether PHP-FPM is on. If PHP-FPM is off, ask your host whether the site runs as mod_php.
3. Command line: php -v shows the command-line PHP, which can differ from the version serving your website: a hint, not an answer.
4. phpinfo(): a file containing <?php phpinfo(); shows the exact version and the Server API line (Apache 2.0 Handler means mod_php). It also shows your server's configuration to anyone who finds it, so use a random file name and delete it straight after.

Below the fixed release, or on 8.1 or older? Send the message in the next section.

What to ask your host (copy and paste this)

Most shared hosts patch PHP for you, but timing varies, so ask in writing:

Subject: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on my account

Hello, my site is [your domain] on [your plan]. Could you confirm:

1. Which PHP version serves my site, and whether that build includes the fixes for CVE-2026-109618 and CVE-2026-109619?
2. The date you installed the fix and restarted PHP on my server?
3. Whether my site runs as mod_php, PHP-FPM, LiteSpeed or another handler?
4. If I'm on PHP 8.1 or older: whether your build has a backported fix, and when you can move me to PHP 8.3 or newer?
5. Whether you've seen any exploitation attempts against my account since 17 October 2026?

Thank you.

A vague reply to question 1 is itself useful information.

On PHP 8.1 or older? Your three options

PHP 8.1 and older get no updates from the PHP project. CISA's advice is blunt: take PHP-based systems on them offline until they can be patched or updated.

• Use a vendor backport. Some Linux distributions and long-term support vendors ship fixed builds of old branches. Ask for the package and its changelog entry.
• Upgrade to PHP 8.3 or newer. Test on a staging copy first; old plugins and themes are the usual breakers. PHP 8.2 reaches end of life on 31 December 2026, so skipping it saves a second move in about ten weeks.
• Move host if yours can't do either, using our website migration checklist to keep your URLs intact.

If an upgrade means a rebuild, we build and maintain business websites on supported stacks.

For sysadmins: patch, restart, then verify

Patch and restart. Restart every web-serving PHP process after updating (php8.x-fpm, apache2 or httpd, frankenphp, LiteSpeed). Google notes running workers keep the old libphp.so or php-fpm binary loaded until restarted.

Verify the fix, not the version string. On Debian or Ubuntu, apt-get changelog php8.3-fpm | grep CVE-2026-109618 (swap in your branch's package name; plain php-fpm there is only a pointer package). On Red Hat family systems, rpm -q --changelog php-fpm | grep CVE-2026-109618.

Find hidden PHP. CISA asks organisations to inventory PHP embedded in other software, such as appliance admin panels. Rebuild containers, don't just restart them. CERT-EU warns rpms.remirepo.net users not to expect same-day packages.

Use stopgaps only while you patch. PHP is explicit that these "do not make an installation safe":

Contain the blast radius. Google recommends blocking outbound internet from PHP servers, stopping PHP launching /bin/sh, curl or wget, and running workers unprivileged with a read-only web root.

Signs of compromise to look for

Start any investigation from 17 October 2026, not the disclosure date (Amazon), and capture memory before restarting a suspicious host, because a restart wipes the evidence (Google).

• Requests: multipart POSTs containing PHP_SESSION_UPLOAD_PROGRESS that your application doesn't normally receive, hundreds of parts in one request, or deeply nested field names such as files[R00001][a][a][a] (Amazon, Datadog).
• Responses: Set-Cookie: PHPSESSID= values longer than 256 characters, which can carry leaked server memory (Google Cloud).
• Error logs: bursts of "Allowed memory size ... exhausted" ending in "Unknown on line 0", or Apache "exit signal Segmentation fault (11)". Datadog notes a full attack may produce only two to four errors, then go quiet.
• Processes: php-fpm, apache2 or httpd spawning sh, bash, curl, wget or python. This is the strongest signal, and a successful exploit may still return a normal 200 response.
• Files and accounts: new web shells or other files written to the web root, unexpected cron jobs, newly created accounts and outbound connections from PHP processes you can't explain (watchTowr).

CISA has added a SIGMA detection rule to its GitHub repository. If you find any of these, assume the server's secrets (database passwords, API keys) are exposed and rotate them after cleaning up.

Frequently asked questions

The bottom line

PHP2Shell is serious, but the fix is ordinary: get PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a vendor backport), restart it, and confirm it in writing. The real risk sits with the third of WordPress sites still on PHP 8.1 or older, and with anyone who assumes a plugin update covered it. For more of this month's incidents, see our roundup of October 2026 cyber attacks.

Start with Site Health and the host message above. Still unsure, or stuck on PHP 8.1 or older? Book a free consultation and we'll check your setup with you and tell you exactly what to fix.

Sources

• PHP Group, Security advisory: Critical remote code execution vulnerabilities, update now (21 October 2026): https://www.php.net/archive/2026.php#2026-10-21-5
• PHP Group, Upcoming Critical PHP Security Release (20 October 2026) and Informational advisory: Session upload progress (23 October 2026): https://www.php.net/archive/2026.php
• PHP Group, GitHub security advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618): https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
• PHP Group, GitHub security advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619): https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
• The PHP Foundation, Today's PHP Security Release, and How We're Strengthening PHP Security (21 October 2026): https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
• CISA, Critical Vulnerabilities in PHP Require Immediate Patching (21 October 2026, updated 23 October 2026): https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
• CISA, Known Exploited Vulnerabilities Catalog (catalogue version 2026.10.23, checked 26 October 2026): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CERT-EU, Security Advisory 2026-018: Critical Vulnerabilities in PHP (20 October 2026, updated 23 October 2026): https://cert.europa.eu/publications/security-advisories/2026-018/
• Amazon Web Services, Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot (21 October 2026): https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/
• Google Cloud, Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (22 October 2026, updated 23 October 2026): https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619
• Cloudflare, Cloudflare deploys protections against php2shell vulnerability (21 October 2026, updated 23 October 2026): https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
• watchTowr, PHP2Shell FAQ: CVE-2026-109618 and CVE-2026-109619 (20 October 2026, updated 23 October 2026): https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
• watchTowr, PHP2Shell RCE Exploited (21 October 2026): https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/
• Datadog Security Labs, PHP2Shell: Critical vulnerabilities in PHP, detection, analysis and remediation (21 October 2026, updated 23 October 2026): https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/
• Sansec, PHP2Shell: PHP RCE (21 October 2026, updated 22 October 2026): https://sansec.io/research/php2shell
• Sophos, Proof-of-concept exploit released for PHP vulnerabilities (CVE-2026-109618, CVE-2026-109619) (21 October 2026, updated 23 October 2026): https://www.sophos.com/en-us/blog/proof-of-concept-exploit-released-for-php-vulnerabilities-109618-109619
• The Hacker News, PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity (25 October 2026): https://thehackernews.com/2026/10/php2shell-exploitation-hits-government.html
• Tenable, php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions (21 October 2026, updated 23 October 2026): https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote
• BleepingComputer, PHP ships emergency patches for critical PHP2Shell flaws (21 October 2026): https://bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws
• BleepingComputer, WordPress Core "wp2shell" RCE flaws get public exploits, patch now (18 July 2026): https://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/
• TNW, PHP knew about one of the flaws in 2024 but could not agree a fix (21 October 2026): https://thenextweb.com/news/php-foundation-structural-failure-2024-flaw-leak
• WordPress.org, PHP version statistics (retrieved 26 October 2026): https://api.wordpress.org/stats/php/1.0/
• WordPress.org, Site Health screen documentation: https://wordpress.org/documentation/article/site-health-screen/
• cPanel, MultiPHP Manager for cPanel documentation: https://docs.cpanel.net/cpanel/software/multiphp-manager-for-cpanel/
• PHP Manual, php_sapi_name: https://www.php.net/manual/en/function.php-sapi-name.php