PHP2Shell (CVE-2026-109618 & CVE-2026-109619): Are You Exposed, and What to Do Today

Two critical flaws in PHP itself let an attacker run code on your web server without logging in. Attacks started hours before the patch was out. If your organisation runs WordPress, Magento, Drupal, Joomla, cPanel, Plesk or any custom PHP application, treat yourself as in scope until you have checked.

What is PHP2Shell?

PHP2Shell is the name given to two vulnerabilities in the PHP runtime, disclosed on 21 October 2026 and rated CVSS 9.2 (critical):

• CVE-2026-109618: if PHP runs out of memory while it's still building a request's internal data, cleanup can treat the half-built data as valid.
• CVE-2026-109619: request data can survive after its memory is freed. The next request on the same worker process can then pick up that stale data.

Chained together, they allow unauthenticated remote code execution. An attacker sends crafted requests and ends up running commands with your web server's privileges.

This isn't a plugin bug. The flaw is in PHP itself, so every application built on it inherits the exposure, however well that application is written. Updating WordPress or your CMS doesn't fix it. Updating PHP does.

Why this one is different

Most critical web vulnerabilities live in one product. This one lives under all of them. PHP runs roughly 70% of websites whose server-side language is known.

The timeline made it worse. Technical details leaked on 20 October, ahead of the planned coordinated disclosure. Cloudflare reported attacks roughly six hours before the fixed versions were available. Government agencies in the Netherlands, Finland and Germany, along with hospitals and media companies in Belgium, took public websites offline as a precaution while they patched.

Am I affected?

Check the PHP version that's actually serving traffic

The command-line PHP can differ from the PHP your web server uses. Check both:

# Installed PHP and FPM versions
php -v
php-fpm -v 2>/dev/null || php-fpm8.3 -v 2>/dev/null

# Debian / Ubuntu packages
dpkg -l | grep -E '^ii\s+(php|libapache2-mod-php)'

# RHEL / Rocky / Alma packages
rpm -qa | grep -i php

# Is Apache loading mod_php?
apachectl -M 2>/dev/null | grep -i php

What to do today

1. Patch

Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your distribution's patched package. Then restart PHP-FPM and Apache. A patched binary on disk does nothing until the running processes are replaced.

2. Check whether you were already hit

Attacks began before patches existed. Treat any PHP server that faced the internet from 20 October onwards as potentially compromised until you've checked it. At minimum:

• Look for PHP files created or modified since 20 October in web roots and upload directories. Webshells often hide there.
• Review new or changed cron jobs, systemd units and SSH authorized_keys entries.
• Check for unexpected outbound connections from the web server, and for new admin users in your CMS.
• Review web server logs from 20 October onwards for unusual request patterns and error spikes.

If you find signs of compromise, patching won't remove an attacker who's already in. Isolate the server and rebuild it from a known-good source.

3. If you can't patch immediately

• Restrict access. Put internal or low-value PHP applications behind a VPN or IP allow-list, or take them offline for a short time. This is what many government bodies did.
• Put a web application firewall in front. Cloudflare has deployed emergency rules. If you run FortiWeb or another WAF, confirm with your vendor that signatures for these CVEs are published and enabled. A WAF buys time. It doesn't fix the bug.
• Limit the damage. Run PHP as a low-privilege user, and use disable_functions to switch off command-execution functions your applications don't need (exec, shell_exec, system, passthru). This limits what an attacker can do. It doesn't stop the exploit.

4. Find the PHP you forgot about

In most organisations, the riskiest server is the one nobody remembers: an old marketing microsite, a staging copy, a vendor portal, or an appliance's admin page. Inventory everything that faces the internet, not just your main website.

Frequently asked questions

Is WordPress affected by PHP2Shell?

Yes. WordPress runs on PHP, so any WordPress site on an unpatched PHP version is exposed, whatever WordPress version or plugins it uses. Updating WordPress doesn't fix this. Updating PHP does.

Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Linux distributions ship backported fixes under their own version numbers, so check your distribution's security advisory.

We're on PHP 7.4 or 8.1. What now?

These branches no longer get official releases. You can upgrade to a supported branch, use your distribution's or LTS vendor's backported package, or compile PHP with the minimal source backport. Plan the upgrade either way. End-of-life PHP will keep piling up unfixed flaws.

Is a web application firewall enough?

No. A WAF can block known attack patterns and buy you time, but attackers adapt. Patching is the only real fix.

We use shared hosting. Do we need to do anything?

Yes. Ask your hosting provider to confirm in writing that the PHP version serving your site is patched. Then check your site for signs of compromise since 20 October.

Sources: ITdaily · Wiz: CVE-2026-109618 · Wiz: CVE-2026-109619 · Newsweek