PHP2Shell Patch Guide: How to Fix CVE-2026-109618 and CVE-2026-109619

The fix for PHP2Shell is to update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart every PHP worker. The two flaws let an attacker run code on a web server without logging in, and attack attempts started before the patch was public. This guide covers which versions are fixed, how to patch on common platforms, what to do if you run end-of-life PHP, and which stopgaps help while you update.

PHP shipped the fixes in an emergency security release on 21 October 2026 and says updating is the only safe option. If you only do one thing today, check your PHP version and patch it.

What is PHP2Shell?

PHP2Shell is the nickname for two critical remote code execution flaws in the PHP core, CVE-2026-109618 and CVE-2026-109619. PHP rates both 9.2 on CVSS v4.0, and both are use-after-free bugs, according to Black Kite's technical breakdown.

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) is triggered by an out-of-memory condition while PHP parses a request, which corrupts state for the next request on that worker.
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) abuses stale global state; session upload progress is one confirmed path, as Pentestit's tracker notes.

The bugs were found with AI assistance by researchers from Calif, OpenAI and Wiz, as reported by The Hacker News. Calif's original write-up is at calif.io/php2shell.

Who is exposed: any PHP install that serves web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, per the serversideup Docker PHP advisory. Apache mod_php carries the highest risk. The scale is large: Modat counted 4.38 million internet-facing PHP services, about 79% of them on branches PHP no longer supports.

Which PHP versions fix PHP2Shell?

PHP fixed both CVEs in four releases on 21 October 2026. Versions 8.1 and older get no official release, only source backports for 7.4, 8.0 and 8.1, as Brandefense's version table lays out.

Support dates from TuxCare's PHP2Shell guide. Fixed versions confirmed by Help Net Security and SOCRadar.

How to patch PHP2Shell, step by step

Patching takes four steps: find every PHP install, update it, restart its workers, and confirm the new version is live. Skipping the restart leaves the old, vulnerable code running in memory.

1. 1Inventory every PHP version you run. Include servers, containers, CI images and serverless functions. Run php -v on each host, and check what your repos declare with php2shell-repo-audit, which sorts versions by whether they need the fix.
2. 2Update PHP using your platform's channel.

• Linux distributions: install your vendor's patched packages. On AlmaLinux, for example, run sudo dnf clean metadata && sudo dnf upgrade 'php*', as shown in AlmaLinux's PHP2Shell advisory. Distro packages often keep an older version number with a backported fix, so check the advisory rather than the version string.
• Docker: pull the rebuilt image and recreate the container, for example docker compose pull && docker compose up -d. The serversideup/php images shipped patched builds hours after release. Rebuild any image you made yourself, since its base layer stays old until you do.
• AWS Lambda with Bref: move to Bref layers 3.0.10, which carry 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
• Shared or managed hosting: confirm with your host that they have patched, and switch your site to a supported branch in the control panel if needed.
• From source: build from the official tarballs on php.net.

1. 3Restart every PHP process. Restart PHP-FPM (sudo systemctl restart php-fpm) or, for mod_php, Apache (sudo systemctl restart httpd or apache2). Reload LiteSpeed or FrankenPHP the same way.
2. 4Verify the fix is live. Check php -v on the CLI and phpinfo() or your app's health page for the web SAPI, since the two can differ. To test from outside, Assetnote's php2shell-scanner probes for both CVEs; note its readme warns that patched and unpatched servers can return the same empty HTTP 500 in some memory settings.

Also check software that bundles PHP, such as appliances and self-managed platforms. SOCRadar's vendor list tracks affected products, including Palo Alto PAN-OS and Panorama, which had no fixed release as of 23 October.

What if you run end-of-life PHP (8.1, 8.0, 7.x, 5.x)?

The best fix for end-of-life PHP is to upgrade to 8.2 or newer, because php.net will not release patched builds for older branches. Mallory counted about 884,000 internet-facing hosts advertising one of those versions.

If you cannot upgrade right away, you have three options:

• Your distribution's backport. Enterprise Linux vendors patched retired streams too; AlmaLinux shipped fixes for every PHP stream on versions 8, 9 and 10, including php:7.4.
• Commercial extended support. TuxCare's ELS for Runtimes offers fixed builds for branches php.net no longer patches.
• Build from a backport. PHP published source backports for 7.4, 8.0 and 8.1. Community patch sets for 5.4 to 8.1, such as php2shell-patches on GitHub, are unofficial, so review and test them before use.

Note that 8.2 stops getting security fixes on 31 December 2026, so if you land on 8.2, plan the next upgrade now.

Temporary mitigations if you can't patch yet

No setting fully protects against PHP2Shell; PHP says there is no complete configuration mitigation. The steps below only reduce exposure for the hours or days until you update, and work best combined.

1. Block multipart/form-data requests. Every known trigger uses this upload format, so rejecting it at the web server cuts off the attack, at the cost of breaking file uploads. Sansec's PHP2Shell research gives this nginx rule for each server block that passes to PHP:

if ($http_content_type ~* "multipart/form-data") {
    return 403;
}

2. Change PHP settings, then restart workers. Calif's partial mitigations are to turn off session upload progress and remove the memory cap. Set them administratively in php.ini, or in each PHP-FPM pool file, not in .user.ini:

session.upload_progress.enabled = 0
memory_limit = -1

With no memory limit, one request can use all server memory, so watch usage and restore the limit after patching. A PHP core developer has warned that disabling upload progress alone is not enough.

3. Tighten request limits. The advisory lists lowering post_max_size, max_input_nesting_level, and the limits on input variables, multipart parts and uploads, as summarized by Pasquale Pillitteri. Avoid OS-level RLIMIT_AS and RLIMIT_DATA memory caps (often set with ulimit), which can make the flaw easier to trigger; a cgroup memory.max limit is a partial alternative.

4. Isolate what you can't update. The UK NCSC and CISA both urged isolating systems that cannot be patched at once, per Black Kite. Putting a site behind a WAF or reverse proxy and allowing traffic only from it also helps.

Is PHP2Shell being exploited?

Yes. Attackers are trying to exploit PHP2Shell, and they started before the fix was public. Amazon's MadPot honeypots logged an attempt on 17 October, four days before disclosure, and several proof-of-concept exploits appeared on release day, as The Hacker News reports. Cloudflare's CEO told Reuters he had seen anecdotal signs of compromises linked to the bug.

As of 23 October, neither CVE was in CISA's Known Exploited Vulnerabilities catalog, according to SOCRadar. Check the catalog for updates.

What to look for: a successful attack can leave few clean log entries, so watch for these signs on PHP hosts:

• Bursts of large multipart/form-data POST requests, especially with deeply nested array keys
• PHP fatal out-of-memory errors or worker crashes followed by odd behaviour on the same worker
• New PHP processes spawning shells, unexpected outbound connections, or new files in web roots

If you find signs of compromise, patching is not enough. Rotate credentials stored on the server and investigate for web shells or other persistence.

PHP2Shell FAQ

Which PHP version fixes PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on 21 October 2026. See the version table above.

Does disabling session.upload_progress fix PHP2Shell?

No. It blocks one known path for CVE-2026-109619 but does not fix either flaw. Only updating PHP fully protects you.

Is WordPress affected by PHP2Shell?

The flaw is in PHP itself, so any WordPress, WooCommerce, Drupal or Laravel site is exposed if its server runs an unpatched PHP version. Updating WordPress plugins does not help; the PHP runtime must be updated.

Do I need to restart after updating PHP?

Yes. Restart PHP-FPM, Apache or your PHP server so the old code is no longer in memory, then confirm the new version with php -v and phpinfo().

My PHP version is end of life. What now?

Upgrade to 8.2 or newer, or use your distribution's backport or an extended support vendor. See the end-of-life section above.

What is the CVSS score of PHP2Shell?

Both CVEs are rated 9.2 (critical) on CVSS v4.0. Early leaked reports claiming 10.0 were not official.

Sources and further reading

• PHP News Archive 2026 (official advisory and releases)
• Calif: PHP2Shell original write-up
• The Hacker News: PHP2Shell exploited 4 days before disclosure
• Help Net Security: PHP2Shell patched, update now
• SOCRadar: PHP2Shell affected versions and fixes
• Brandefense: PHP2Shell fixed versions
• TuxCare: PHP2Shell for end-of-life PHP
• AlmaLinux: patched PHP packages
• Sansec: PHP2Shell temporary mitigations
• Black Kite: PHP2Shell technical analysis
• Pentestit: what we know about php2shell
• Reuters via US News: AI-discovered bugs may trigger more disruption