PHP2Shell - what it is, how to detect, how to patch
PHP2Shell is the name cybersecurity researchers use for CVE-2026-109618 and CVE-2026-109619, two critical remote code execution (RCE) vulnerabilities in PHP core.
Details leaked on October 20, 2026, and PHP shipped fixes on October 21. Because the bugs sit in PHP itself, every app on a vulnerable PHP version is exposed, and attackers started exploiting them before the patch.
This guide covers which versions PHP2Shell affects, how to detect it, how to patch it, what to do until you can patch it, and how to monitor for exposed servers.
PHP2Shell key facts
CVEs: CVE-2026-109618, CVE-2026-109619
Also known as: php2shell, PHP core RCE
Type: Unauthenticated remote code execution in PHP core (unauthenticated)
Severity: 9.2 Critical (CVSS v4.0, PHP security team); NVD: 9.8 Critical (CVSS v3.1)
Affected versions: PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, 8.5 before 8.5.12, and end-of-life branches. Any SAPI serving web requests (mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed).
Fixed versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35
Fix for PHP 8.1 and older: No official release. PHP published minimal source backports for 7.4, 8.0, and 8.1; some distributions and LTS vendors ship backported packages.
Patch release: October 21, 2026
Exploitation: Reported by Cloudflare and Patchstack; ELLIO saw the first PHP2Shell scanning 5.5 hours before the fix. Not in CISA KEV as of October 22.
Public proof-of-concept: Multiple public PoCs on GitHub
Pentest-Tools.com detection: Live (Network Vulnerability Scanner) + free PHP2Shell Scanner
Pentest-Tools.com exploit module: In progress (Sniper Auto-Exploiter)
What is PHP2Shell?
PHP2Shell is the name for two critical remote code execution vulnerabilities in PHP core, tracked as CVE-2026-109618 and CVE-2026-109619. The name comes from researchers, not from PHP, and points to the expected outcome: an attacker sends a request to a website and gets a shell on the server behind it.
Both flaws leaked on Hacker News on October 20, 2026, two days before their planned coordinated disclosure. PHP moved its release up a day, to October 21, 2026.
PHP's advisories describe two separate bugs: CVE-2026-109618 is remote code execution via out-of-memory corruption, and CVE-2026-109619 is remote code execution via stale global state (a use-after-free). Researchers from Calif, Wiz, and OpenAI reported them.
Which PHP versions are affected by PHP2Shell?
CVE-2026-109618 and CVE-2026-109619 affect every PHP release before 8.5.12, 8.4.27, 8.3.36, and 8.2.35, plus end-of-life branches.
PHP2Shell fixed versions by branch
PHP 8.5 (active support): update to 8.5.12
PHP 8.4 (active support): update to 8.4.27
PHP 8.3 (security fixes only): update to 8.3.36
PHP 8.2 (security fixes only, until December 31, 2026): update to 8.2.35
PHP 8.1, 8.0, 7.x, 5.x (end of life): No official release (source backports for 7.4, 8.0, 8.1)
Source: PHP supported versions, PHP security advisory "Critical remote code execution vulnerabilities, update now" (php.net/archive/2026.php#2026-10-21-5), and GitHub advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.
How do I fix PHP2Shell?
To fix PHP2Shell, update PHP to the fixed release for your branch (8.5.12, 8.4.27, 8.3.36, or 8.2.35), then restart PHP and/or the server that loads the PHP module so the new version is actually running.
Check your current version with php -v (and php-fpm -v for the web-facing runtime).
Update to the fixed version for your branch from the table above.
Restart PHP-FPM or your web server (Apache, NGINX with PHP-FPM).
Run php -v again to confirm the new version is the one serving requests.
Using your Linux distribution's PHP packages? Apply your distro's security update instead. The fix may be backported without the version number changing, so check the distro's advisory rather than the version string.
On PHP 8.1 or older? PHP won't ship an official release. Use a backported package from your distribution or LTS vendor, and upgrade to a supported branch , or keep those systems off the internet until you can.
What should I do if I can't patch PHP yet?
If you can't patch yet, reduce your PHP2Shell exposure with these steps.
Turn off session upload progress: set session.upload_progress.enabled = Off in the php.ini your web server uses, then restart every worker. Blocks CVE-2026-109619 only.
Lift the memory limit (CVE-2026-109618): set memory_limit=-1 and keep post_max_size low.
Limit exposure: take internet-facing PHP applications off public networks until they're patched and verified, as CERT-EU recommends.
Watch what PHP starts: alert on php-fpm, php-cgi, or apache2 launching shells or download tools, for example with the free process-watcher.
Note: these steps reduce exposure, but none covers both CVEs. Patching is the only real fix.
How do I find servers exposed to PHP2Shell?
The first step is knowing where PHP runs, and you can start that right now.
Run the Network Vulnerability Scanner, included in every Pentest-Tools.com paid plan, on your web-facing targets to find the ones running PHP and exposed to PHP2Shell.
Are attackers exploiting PHP2Shell in the wild?
Yes. Amazon saw the first exploit attempt against its honeypots on October 17, four days before disclosure, and attempts spread after the patch.
Several public proofs-of-concept are on GitHub.
CISA hasn't added the CVEs to its Known Exploited Vulnerabilities catalog as of October 22, 2026.
PHP2Shell vulnerability timeline
October 17, 2026: Amazon sees the first exploit attempt against its honeypots.
October 20, 2026: A post on Hacker News leaks details of both flaws two days before their planned disclosure.
October 20, 2026: The PHP security team publishes an advance notice: two critical vulnerabilities, both CVSS v4.0 9.2, with a security release set for October 21 at 14:00 UTC.
October 21, 2026: PHP releases 8.5.12, 8.4.27, 8.3.36, and 8.2.35, fixing both CVEs, plus minimal source backports for 7.4, 8.0, and 8.1.
October 21, 2026: Pentest-Tools.com adds PHP2Shell detection to the Network Vulnerability Scanner. Pentest-Tools.com launches a free PHP2Shell Scanner.
October 22, 2026: Pentest-Tools.com updates detection to an active PHP2Shell check in the Network Vulnerability Scanner for an even more reliable finding.
[TBD]: Pentest-Tools.com adds a PHP2Shell exploit module to Sniper.
PHP2Shell technical details
CVE-2026-109618 is an out-of-memory bug that leaves request memory corrupted. CVE-2026-109619 is a use-after-free in state PHP keeps between requests, reachable through INI diagnostics and the session upload progress handler, which is on by default.
An attacker who exploits either bug runs code on the server as the PHP worker user.
Does Pentest-Tools.com detect PHP2Shell?
Yes, we do! We launched detection in less than 24h after the Hacker News leak.
Detection for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is live in the Pentest-Tools.com Network Vulnerability Scanner, included in every paid plan.
PHP2Shell FAQs
Is WordPress affected by PHP2Shell?
WordPress sites are exposed to PHP2Shell if the server runs a vulnerable PHP version, because the flaws are in PHP itself, not in WordPress. Updating WordPress or its plugins doesn't fix PHP2Shell; updating PHP does. Researchers at Calif confirmed pre-authentication remote code execution against WordPress 7.1.2 on a vulnerable PHP version.
If you run WordPress, check your PHP version in your hosting panel or ask your host, and use our WordPress Scanner for the application layer on top.
How many servers are exposed to PHP2Shell?
On October 21, 2026, security company Mallory counted roughly 2.6 million internet-facing services that showed a PHP version. About 1.9 million (73.5%) ran PHP 8.1 or older.
Is PHP2Shell the same as CVE-2024-4577?
No. CVE-2024-4577 was a 2024 argument injection flaw in PHP running in CGI mode on Windows. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a separate pair of vulnerabilities disclosed in October 2026 and affects PHP core across platforms.
Check one website for PHP2Shell for free
Use our free PHP2Shell Scanner to check a single website you’re authorized to test for CVE-2026-109618 and CVE-2026-109619. Enter the URL, run a light scan, and get a result with remediation steps.