PHP2Shell Vulnerability: Rapid Remediation and Security Fixes
A critical flaw in PHP’s core engine lets an unauthenticated attacker run code on your server. Every release before the patched versions is affected. We find your exposure in 24–48 hours, contain it, and fix it for good.
What happened
What Is the PHP2Shell Vulnerability?
PHP2Shell is the nickname for two critical flaws in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619, patched by the PHP team on October 21, 2026. Both are rated CVSS 9.2 and can let an unauthenticated attacker execute code on a web server. Because the bug lives below the application layer, even well-built WordPress, Drupal, Joomla and custom apps are exposed when they run on an affected PHP version. Read the official PHP security advisory.
CVE-2026-109618: PHP Memory Corruption
Out-of-memory handling can interrupt PHP while internal request data is only partly initialized. Request cleanup may then treat that invalid data as valid, opening a path to remote code execution. Technical advisory.
CVE-2026-109619: PHP Use-After-Free Vulnerability
A PHP worker can keep references to request memory after it has been freed. A later request handled by the same worker may use that stale state, which can also lead to remote code execution. Technical advisory.
Why it’s urgent
Is Your PHP Application Vulnerable to PHP2Shell?
Researchers showed that frontier AI cuts the effort to build and adapt these exploits from specialist weeks to hours. That changes the economics of attack, so exploitation is expected to scale rather than stay rare.
PHP Versions and Environments to Check
Every PHP release before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 is affected. PHP 8.1 and older have no official patched release, and PHP 8.2 reaches end of life on December 31, 2026. Check production, staging, containers, and the forgotten microsites and agency-managed sites that are easiest to miss.
PHP-FPM, Apache, WordPress, Drupal and Joomla
The PHP security team advises every installation serving web requests to update, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Apache with mod_php is the highest-risk setup. Updating WordPress, Drupal, Joomla or their plugins does not replace a vulnerable PHP runtime.
Signs Your PHP Environment Needs Investigation
Look for repeated out-of-memory fatals or worker crashes, unusual multipart upload requests, unexpected files or processes under the web worker account, and credentials used from unfamiliar locations. None of these proves a compromise, and clean logs do not prove safety, so patch first and investigate in parallel.
The fix
How to Fix the PHP2Shell Vulnerability
Only a patched PHP runtime fully fixes PHP2Shell. Everything else buys time. The fixed versions are listed in the official PHP advisory.
Update PHP to a Patched Version
Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 through your OS vendor, a php.net build or your application vendor, then restart PHP-FPM and web server workers so the new binary loads. Some distributions backport fixes without changing the version number, so confirm with your vendor. On shared hosting, ask your provider to confirm the patched packages.
Apply Temporary Risk-Reduction Measures
Until you can patch, keep WAF rules enabled at your edge and turn off session.upload_progress.enabled if you don’t use it. That setting blocks confirmed paths for CVE-2026-109619 only. Neither step covers CVE-2026-109618 or replaces patching, so follow the PHP advisory for its interim settings.
Rotate Potentially Exposed Credentials and Secrets
Code execution runs with the web worker’s privileges, so anything that account can read should be treated as exposed on an internet-facing server that ran an unpatched version: environment variables, config files, database passwords, API keys, session secrets and certificates. Rotate them after patching and review logs for unexpected activity.
How we help
PHP2Shell Rapid Remediation Services
Start with a free exposure check, then take only the steps your estate needs. Each package is a defined scope and a fixed price.
PHP2Shell Exposure Assessment
Inventory every PHP site and server, flag what’s vulnerable, deliver a ranked risk report.
Emergency Containment and Hardening
WAF and CDN rules, config hardening, detection alerts, and secret rotation.
PHP Patching and Verification
Upgrade supported branches to a fixed version and regression-test your apps.
Legacy PHP Upgrade and Modernization
AI-assisted migration of EOL PHP apps to 8.3 or 8.4, with test coverage.
Ongoing PHP Security and Patch Management
PHP and dependency patch management, so the next issue is handled in days.
Packages
PHP2Shell Remediation Packages and Pricing
The exposure check is free and gives you the inventory to scope everything else.
| Package | What it delivers | Pricing |
|---|---|---|
| Exposure check | Inventory, version check, ranked risk report | Free |
| Contain | Edge rules, config hardening, detection, secret rotation | Fixed, per site tier |
| Patch & verify | Upgrade supported branches, regression test, rollback | Fixed, per application |
| Legacy upgrade sprint | EOL PHP → 8.3 / 8.4, AI-assisted, test coverage | Fixed, by complexity |
| Managed PHP care | Ongoing patch & dependency management | Monthly retainer |
Is Your PHP Environment Exposed to PHP2Shell?
Assess exposure, contain threats, apply security fixes, and verify remediation for CVE-2026-109618 and CVE-2026-109619 with Adroitent.
FAQ
Frequently Asked Questions About PHP2Shell
What Is PHP2Shell?
PHP2Shell is the name for two critical flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, patched on October 21, 2026. Both are rated CVSS 9.2 and can let an unauthenticated attacker run code on a web server, which is why updating the PHP runtime itself is the priority.
Which PHP Versions Are Affected by PHP2Shell?
Every release before PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on its branch is affected. PHP 8.1 and older get no official patched release; PHP published only source backports for 7.4, 8.0 and 8.1 for people who build PHP themselves. Vendor and distribution packages may backport the fix under a different version number, so confirm with your provider.
How Do I Check Whether My Website Is Vulnerable?
Find the PHP version that actually serves each site (it can differ from the command-line version, so check through your host’s control panel, the web server or the container image) and compare it with the fixed versions. Cover every environment, including staging, containers and forgotten microsites. Our free exposure check inventories your PHP sites and servers and returns a ranked risk report within 72 hours.
How Can I Fix CVE-2026-109618 and CVE-2026-109619?
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart PHP-FPM and web server workers so the patched binary is loaded. Until then, keep edge WAF rules enabled and turn off session upload progress if you don’t use it, which only helps with CVE-2026-109619. Afterwards, rotate the secrets your web worker could read.
Is Updating PHP Enough if My Server Was Already Compromised?
No. Patching closes the vulnerability but does not remove access an attacker already gained. If an unpatched server was reachable from the internet, review logs and files for unexpected changes, rotate credentials and secrets, and consider an incident-response review. If we find an active breach, we contain it and bring in an incident-response partner.
Can Legacy PHP Applications Be Patched?
Not through an official release. Fixed versions exist only for PHP 8.2 and later, so applications on PHP 7.x or older generally need a version upgrade, and old code can break when you make it. Our legacy upgrade sprint migrates end-of-life PHP applications to 8.3 or 8.4 with AI-assisted refactoring and test coverage, while containment measures cover the gap.