PHP2Shell (CVE-2026-109618 & CVE-2026-109619): What It Is and How to Protect Your PHP Website

Most PHP security bugs live in our own code. In October 2026, the most serious one lived inside PHP itself.

On 21 October 2026, the PHP team shipped emergency releases for two critical remote code execution (RCE) flaws, CVE-2026-109618 and CVE-2026-109619. Together they are called PHP2Shell, and both are rated 9.2 out of 10 on CVSS v4.0. Attack attempts were spotted even before the patch came out, so if your website runs on PHP, this is not a "later" task.

This guide explains what PHP2Shell is in plain language, who is affected, how to fix it, and how to check that your site was not already hit.

What is PHP2Shell?

PHP2Shell is the nickname for two critical bugs in the PHP runtime, the engine that runs PHP websites. The bugs are not in any one app's code. That is what makes them serious: a perfectly written website is still exposed if it runs on a vulnerable PHP version.

The flaws date back to PHP 5.4, released in 2012, so they sat unnoticed for about 14 years. Researchers from Wiz, Calif.io, Quarkslab and OpenAI are credited with reporting them.

Some government and large company sites, including in Australia, were briefly taken offline while teams patched.

The two flaws, explained simply

CVE-2026-109618: the out-of-memory problem. When a request runs out of memory, PHP can stop halfway and leave its internal data half-filled. A chain of weaknesses lets an attacker turn that broken state into running their own code, with the same rights as the web server's PHP worker. Researchers showed it working without a login against WordPress, Drupal, and Joomla.

CVE-2026-109619: the leftover data problem. PHP keeps some global data between requests. This bug leaves references pointing at memory that was already freed (a "use-after-free"). An attacker can use it to leak memory from the server or run code.

In both cases, the attack path runs through file upload handling (multipart form requests), which nearly every PHP setup accepts by default. Once attackers have code running, they can usually read, change or dump the database behind the site.

Is PHP2Shell fixed?

Yes, but only if you update. The fix exists in the patched releases; it does not reach your server on its own.

Three things to keep in mind:

• Old versions stay vulnerable. PHP 8.1 and older no longer get official security updates, so there is no official patch for them.
• Setting tweaks is not a cure. PHP says there is no complete mitigation. Config changes can make an attack harder while you prepare, but updating is the only safe fix.
• A third flaw is coming. CVE-2026-115560 is a related RCE bug that will be fixed in PHP's next regular release, not an emergency one. Plan to update again.

Is your website affected?

PHP powers roughly 70% of websites whose server technology is known, so the exposure is huge. Your site is likely at risk if all of these are true:

• It runs on PHP. That includes WordPress, WooCommerce, Drupal, Joomla, Magento, Laravel, and most custom CMS or CRM builds.
• Its PHP version is older than the patched release for its branch (see the table below). Every PHP version back to 5.4 had at least one of the two flaws.
• It has at least one public PHP page. No login is needed. A simple contact page is enough for an attacker to reach PHP.

Also watch for warning signs: spam pages you did not create, unexpected redirects, browser security warnings, or a sudden spike in server errors.

Businesses running SaaS products, membership sites, ecommerce stores, and finance or lending portals on older PHP versions should treat this as a priority.

How to fix PHP2Shell: patch, verify, protect

The patch teaches PHP to clean up properly when something goes wrong. If a request runs out of memory, PHP now stops it safely instead of leaving half-finished data behind. It also clears leftover data at the end of each request, so the next request can never reuse it.

1. Check your version. Run php -v on the server or check your hosting control panel. Remember that the web server and the command line can use different PHP versions.
2. Update PHP. Use your OS package manager, your host's PHP selector, or the official Docker images. If your host manages PHP, confirm with them that the patched build is live.
3. Restart PHP. Restart PHP-FPM or your web server so the new version actually loads.
4. Verify. Check the version again from a web page, not only the terminal. For backported OS packages, confirm the changelog mentions CVE-2026-109618 and CVE-2026-109619, because the version number alone may not change.
5. Test your app. Run through key flows like login, checkout and forms, especially after a major version upgrade.

After patching: check you were not already hit

A patch closes the door, but it does not remove anyone who got in earlier. Since attacks started before disclosure, take a few minutes to check:

• New or changed PHP files in upload, cache or theme folders that you did not add.
• Unknown admin users in WordPress or your CMS.
• Odd processes started by the web server, such as download tools or shells.
• Unusual POST requests with file uploads in your access logs around 17 to 21 October.

If you find anything suspicious, rotate database passwords, API keys and admin credentials, and restore from a clean backup if needed.

Beyond PHP2Shell: how RCE usually sneaks into PHP apps

Remote code execution means an attacker sends a request and your server runs their code. From there they no longer need a password; they effectively own the server.

PHP2Shell is rare because the bug was in PHP itself. Most RCE bugs come from app code that trusts user input too much. The usual suspects:

• Running system commands built from form or URL input, so an attacker can slip in an extra command.
• Running dynamic code, where the app treats text as code and executes it.
• Loading files by name from a URL value, letting an attacker point it at a file they uploaded.
• Unsafe deserialization, where the app rebuilds objects from user data and a crafted payload triggers code.
• Open file uploads that accept a script disguised as an image, which the attacker then opens in a browser.

Patching PHP fixes PHP2Shell. Fixing these patterns in your own code closes the next door.

What PHP2Shell tells us about AI and security

A bug hiding in PHP's core for 14 years was found with help from teams that include an AI lab. That is the new normal: AI tools are getting better at finding deep bugs, for defenders and attackers alike. The gap between disclosure and real attacks is shrinking, and in this case attacks came first.

The practical lesson is simple. Keep your runtime and dependencies on supported versions, and have a plan to patch within days, not months.

Need help patching or upgrading PHP?

Techiebutler's PHP and Laravel engineers help businesses upgrade legacy PHP versions, patch critical vulnerabilities, and harden their apps without breaking what already works. Whether you run WordPress, Magento or a custom PHP platform, talk to our team for a quick security and upgrade review.