PHP2Shell patch versions — 8.5.12, 8.4.27, 8.3.36, 8.2.35; attacks began four days before disclosure
PHP2Shell refers to two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) patched on October 21, 2026 that let an attacker run code on a web server with a single unauthenticated request. Every PHP installation serving web requests is affected; the fix is upgrading to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older are end-of-life and get no regular fix
The three lines
- Flaws — CVE-2026-109618 and -109619, unauthenticated remote code execution, CVSS 9.2
- Fix — 8.5.12, 8.4.27, 8.3.36, 8.2.35; 8.1 and older get no regular patch
- Status — exploit attempt seen Oct 17; about 5.1 million PHP hosts exposed
Key questions
- php2shell fixed versions
- **PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.** | Your branch | Upgrade to | |---|---| | 8.5.x | 8.5.12 | | 8.4.x | 8.4.27 | | 8.3.x | 8.3.36 | | 8.2.x | 8.2.35 | | 8.1, 8.0, 7.4 | Source backports or distro/LTS vendor patches; move to 8.2+ | | 7.3 and older | Migrate to a fixed release |
- how to check php version
- **Use php -v on the command line or phpinfo() on the web.** | Environment | Method | |---|---| | Server shell | php -v | | PHP-FPM | php-fpm -v | | Web page | phpinfo() output (delete afterward) | | Distro packages | Check package version in the distro advisory | | Fleet scan | Searchlight Cyber's open-source php2shell-scanner |
- cve-2026-109618 workaround
- **Workarounds are incomplete; upgrading is the only full fix.** | CVE | PHP team's interim mitigations | |---|---| | 109618 | Lock memory_limit, lower post_max_size (8M, or 32M with uploads), set container memory limits | | 109619 | session.upload_progress.enabled=0; on 8.5 fatal_error_backtraces=0 | | Both | Cloudflare WAF rules (all plans, including free) — temporary |
If your site runs on PHP, check your version now. The PHP project shipped emergency fixes on October 21, 2026 for two critical flaws collectively dubbed "PHP2Shell." With a single request and no login, an attacker can run code on the web server — before any application code executes. The US Cybersecurity and Infrastructure Security Agency (CISA) urged immediate patching; the UK's National Cyber Security Centre told organizations to take offline any system they cannot fix right away.
This guide answers one question: what should you do with your servers?
1. What the bugs are
| CVE-2026-109618 | CVE-2026-109619 | |
|---|---|---|
| Type | Corruption during out-of-memory handling → remote code execution | Stale global state reused after memory is freed → remote code execution |
| Mechanism | A request interrupted mid-initialization leaves data that cleanup treats as valid | State from one request is used by the next before it is reset |
| Authentication | None | None |
| Privileges | Web worker account | Web worker account (plus memory disclosure) |
| Found by | Researchers at Calif, OpenAI and Wiz | Same |
Every PHP installation that serves web requests is affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers mod_php the highest risk. The bugs sat in code for decades.
2. What to upgrade to
| Branch | Official status (php.net) | Action |
|---|---|---|
| 8.5.x | Active support (to end-2027) | 8.5.12 |
| 8.4.x | Active support (to end-2026) | 8.4.27 |
| 8.3.x | Security fixes only (to end-2027) | 8.3.36 |
| 8.2.x | Security fixes only (ends Dec 31, 2026) | 8.2.35, and plan a move to 8.3+ this year |
| 8.1, 8.0, 7.4 | End of life | PHP team source backports, or distro/LTS vendor packages |
| 7.3 and older | End of life | Migrate to a fixed release |
Check with php -v on the server, or php-fpm -v for FPM. If you use distribution packages, check the version in your distro's security advisory; Linux distributions and LTS vendors received the patches before public release. The volunteer-run rpms.remirepo.net repository said it would have no update on release day. To scan many hosts, Searchlight Cyber released the open-source php2shell-scanner on October 22.
The PHP team published interim mitigations — for 109618, lock memory_limit so it can't be overridden, lower post_max_size to 8M (32M if uploads are needed) and apply container limits; for 109619, set session.upload_progress.enabled=0. A PHP core developer said no mitigation fully blocks the attacks. Cloudflare deployed WAF rules for all customers, including free plans, and also called them temporary.
3. Is it already being exploited?
| Date | Event |
|---|---|
| Oct 17 | Amazon's MadPot honeypots log an exploit attempt — four days before disclosure, under embargo |
| Oct 20 (Tue) | PHP warns administrators to prepare for patches |
| Oct 21 | Patches released; CISA alert |
| Oct 22 | php2shell-scanner released; Palo Alto says all PAN-OS and Panorama versions affected, no fix yet |
| Oct 23 | PHP announces separate CVE-2026-115560 (unusual configurations only, severity not given) |
Amazon Threat Intelligence said the October 17 attempt came from an IP tied to a commercial anonymization service; how the attacker learned embargoed details is unknown. Cloudflare's CTO said the company saw early attacks on both bugs before patches shipped. VirusTotal estimates more than 5.1 million PHP hosts are exposed online. Fortinet is checking 12 products and Cisco 31, because PHP ships inside security appliances too.
The Node.js flaw covered on October 24 is in "Node2Shell (CVE-2026-111497)"; why end-of-life versions are dangerous is explained in today's "What is end of life (EOL)."
4. What remains open
- Appliances: Fixed PAN-OS releases and Fortinet and Cisco findings are still pending.
- Third flaw: Affected versions and fix timing for CVE-2026-115560 are not public.
- Pre-disclosure leak: How attackers got details early is unconfirmed.
- Damage: No count yet of compromised sites.
Sources
- BleepingComputer — PHP ships emergency patches for critical PHP2Shell flaws
- Help Net Security — PHP2Shell: Critical PHP vulnerabilities patched, update now! (2026-10-21)
- CISA — Critical Vulnerabilities in PHP Require Immediate Patching (2026-10-21)
- The Hacker News — PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches
- PHP — Supported Versions