PHP2Shell Explained: How to Check and Fix CVE-2026-109618 and CVE-2026-109619

On 21 October 2026, the PHP team shipped an emergency update for two serious bugs in PHP itself. Security researchers called the pair PHP2Shell, because a successful attack lets someone run their own commands on the server. A shell is the command line of a server, so "PHP to shell" is exactly the danger.

The good news is that the fix is already out and it is simple: update PHP and restart it. This guide explains what happened in plain words, how to check if your server is affected, and how to update on Ubuntu, Debian, RHEL, Docker, Windows and shared hosting.

Last updated: 28 October 2026. We will update this post if the PHP team publishes new fixes.

💡 Quick answer: PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619, two critical bugs (CVSS 9.2) in PHP's core that can let an attacker run code on a web server without logging in. Every PHP version that serves websites is affected until it is updated. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Update to one of these (or your Linux distribution's patched package), then restart PHP-FPM or Apache so the fix actually loads.

💡 Who is this guide for? Students, freelancers and developers who run a PHP website, a WordPress or Laravel site, or a VPS, and want a clear, calm checklist instead of a wall of security jargon.

In this guide:

1. What Is PHP2Shell?
2. The Two Bugs in Simple Words
3. Who Is Affected?
4. Timeline: What Happened and When
5. Fixed PHP Versions
6. How to Check Your PHP Version
7. How to Update PHP, Step by Step
8. If You Cannot Update Today
9. How to Check for Signs of an Attack
10. What About CVE-2026-115560?
11. What This Means for WordPress and Laravel Sites
12. Lessons for Every Developer

---

What Is PHP2Shell?

PHP2Shell is the name security researchers gave to two vulnerabilities in the PHP engine:

Two things make these bugs serious. First, they are in PHP itself, not in a plugin or a framework, so almost every PHP website runs the affected code. Second, an attacker does not need an account. A specially made web request can be enough.

If the terms CVE and CVSS are new to you, here is the short version: a CVE is a public ID for one security bug, and CVSS is a score from 0 to 10 that shows how dangerous it is. A score of 9.2 is in the "critical" band, the highest one.

---

The Two Bugs in Simple Words

You do not need to understand the low-level details to fix these bugs, but a simple picture helps.

CVE-2026-109618 (out-of-memory corruption). Every PHP request gets a memory limit. If a request runs out of memory halfway through building something, PHP stops that step. The bug is that PHP had already counted a piece of data it never finished creating. When PHP later cleans up after the request, it trusts that half-built piece, and leftover bytes in it can steer PHP into doing something the attacker chose.

CVE-2026-109619 (stale request state). A PHP worker handles many requests, one after another. Some internal state from one request was supposed to be reset before the next one. After certain fatal errors, it was not reset properly, so the next request could read memory that had already been freed. Programmers call this a "use-after-free" bug.

Both bugs have the same root idea: a fatal error stops PHP in the middle of a job, and later code treats the half-finished state as valid. The PHP team fixed both in the 21 October releases.

💡 Pro Tip: You will not find any attack code in this post, and you do not need it. Defending against PHP2Shell is about two boring steps: update PHP and restart it.

---

Who Is Affected?

According to the PHP team's advisory, any PHP installation that serves web requests is affected until it is updated. That includes all the common ways of running PHP:

• Apache with mod_php, which the PHP team called the highest-risk setup, because an attack can work before your application's own code even runs
• PHP-FPM with Nginx or Apache
• php-cgi
• LiteSpeed and FrankenPHP

The type of website does not matter. A tiny contact-form script, a WordPress blog and a large Laravel app all run on the same PHP engine. Palo Alto Networks reported more than 22.6 million internet-facing systems that could be affected, which shows how widely PHP is used.

What is less exposed:

• PHP on the command line only (cron jobs, Composer, Artisan commands) is not serving web requests. You should still update it, because it is often the same installation.
• XAMPP, WAMP or Laragon on your own laptop, used only for local practice, is normally not reachable from the internet. Update it when new builds are out, but it is not an emergency in the way a live server is.

---

Timeline: What Happened and When

Figure 1: The PHP2Shell timeline, from the first attack attempts to the CISA listing.

The PHP team moved quickly once the details leaked, and Linux distributions received the patches in advance. In most cases, a patched package was waiting by the time admins woke up.

---

Fixed PHP Versions

The official details are in the PHP security advisory of 21 October 2026. On 26 October, PHP also published refreshed Windows builds (8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1). These fix a separate bug in the Brotli compression library that PHP's Windows builds include, so Windows users should download the -1 builds.

💡 Pro Tip: If you are still on PHP 8.1 or older, this is a good moment to plan a move to PHP 8.4 or 8.5. Old branches stop getting fixes, and the next critical bug will hit them too.

---

How to Check Your PHP Version

The tricky part is that one server can have more than one PHP. The PHP you see in the terminal (the CLI) is not always the PHP that serves your website.

1. In the terminal:

bash
Copy
1php -v

2. The PHP your website actually uses. Create a temporary file called version.php in your web root:

php
Copy
1<?php
2echo PHP_VERSION;

Open it in the browser, note the version, and delete the file straight away. Never leave phpinfo() or version pages on a live site.

3. On Ubuntu and Debian, check the package version too:

bash
Copy
1dpkg -l | grep php

On RHEL, AlmaLinux and Rocky Linux, use:

bash
Copy
1rpm -qa | grep -i php

This matters because Ubuntu, Debian and Red Hat often backport security fixes into their own packages without changing PHP's version number. For example, Ubuntu 24.04 ships PHP 8.3.6, so php -v will keep saying 8.3.6 even after you install the fixed package. In that case, check your distribution's security notice to see which package version contains the fix.

Figure 2: A simple way to decide whether your server needs action.

---

How to Update PHP, Step by Step

Always take a backup or a server snapshot before a big update. Then follow the section for your setup.

Ubuntu and Debian

If PHP comes from Ubuntu's or Debian's own repositories:

bash
Copy
1sudo apt update
2sudo apt upgrade

If you installed PHP from the popular Ondřej Surý repository (ppa:ondrej/php on Ubuntu, or packages.sury.org on Debian), the same two commands bring you to the upstream fixed versions, such as 8.3.36.

RHEL, AlmaLinux and Rocky Linux

bash
Copy
1sudo dnf update 'php*'

This also covers the Remi repository if you use it.

Restart PHP (do not skip this)

Updated files on disk do nothing until the running PHP processes are replaced. Restart whatever runs PHP on your server:

bash
Copy
1# PHP-FPM on Ubuntu/Debian (change 8.3 to your version)
2sudo systemctl restart php8.3-fpm
3
4# PHP-FPM on RHEL family
5sudo systemctl restart php-fpm
6
7# Apache with mod_php
8sudo systemctl restart apache2   # Ubuntu/Debian
9sudo systemctl restart httpd     # RHEL family

Then open your temporary version.php page again, confirm the new version, and delete the page.

Docker

If your app runs in a container based on the official php image, pull the new base image and rebuild:

bash
Copy
1docker build --pull -t my-php-app .

Then redeploy the new image. Restarting an old container does not update PHP inside it.

Windows

Download the new -1 build of your branch from the PHP for Windows downloads page, replace your PHP folder (keep a copy of your php.ini), and restart IIS or Apache.

Shared hosting and cPanel

On shared hosting, your hosting company updates the PHP builds for you. You can still do two things:

1. In cPanel, open MultiPHP Manager or Select PHP Version and make sure your site uses a supported branch, ideally 8.3 or newer.
2. Contact support and ask: "Do your PHP builds include the fixes for CVE-2026-109618 and CVE-2026-109619?" Good hosts will answer quickly.

---

If You Cannot Update Today

Sometimes an update has to wait a few hours for a maintenance window. The PHP team listed a few settings that reduce the risk, but it was clear that no setting makes an unpatched server safe. Treat these as a short bridge to the real fix:

Every PHP setting change also needs a restart of PHP-FPM or Apache to take effect.

---

How to Check for Signs of an Attack

Because attacks started before the fix was public, it is worth a quick check even after you update. Security teams shared these warning signs:

• Error logs with Allowed memory size of ... bytes exhausted together with Unknown on line 0, which means PHP ran out of memory before your code even started
• Apache logs with AH00052 and Segmentation fault, which means a PHP worker crashed
• Shell programs started by PHP, such as sh, bash, curl or wget running as children of php-fpm, apache2 or httpd
• New PHP files you did not create, especially inside upload folders
• New cron jobs, users or SSH keys you do not recognise

Some of these can appear for harmless reasons, so a single log line is not proof of an attack. But if you find several signs together, take the site offline, restore it from a clean backup, update PHP, and change every password, database credential and API key the server could read.

💡 Pro Tip: Regular, tested backups are the best security tool you have. If you do not have automatic backups yet, set them up this week.

---

What About CVE-2026-115560?

On 23 October, the PHP team published a smaller, separate advisory about CVE-2026-115560, which is also in the session upload-progress feature. It only affects a very unusual setup: an app that sets session.serialize_handler to php_binary or php_serialize and then switches it to php with ini_set() before calling session_start().

Most websites never do this. PHP suggests setting session.upload_progress.enabled = 0 until its next regular bugfix release, which will include the full fix and advisory. If your app does not use upload progress bars, this setting has no visible effect, so it is an easy change.

---

What This Means for WordPress and Laravel Sites

PHP2Shell is a bug in PHP, not in WordPress, Laravel or any plugin. That has two practical results:

• Updating WordPress plugins or running composer update does not fix it. Only updating the PHP runtime does.
• Managed hosts usually patch for you. On managed WordPress hosting and platform services, the host owns the PHP runtime. If you are not sure whether they have updated it, ask them.

If you run your own VPS for a WordPress or Laravel site, follow the Ubuntu or RHEL steps above, and do not forget the restart. For Laravel apps in Docker, rebuild the image with --pull.

---

Lessons for Every Developer

PHP2Shell is a good reminder of a few habits that protect any project, whatever language it uses:

1. Know what you run. Keep a simple list of your servers, their PHP versions and how PHP was installed. You cannot update what you forgot about.
2. Update the runtime, not just your packages. Tools like composer audit check your libraries, but PHP itself also needs updates.
3. Stay on supported versions. PHP 8.1 and older got no official fix this time.
4. Restart after updating. A patched file on disk does not protect a process that is still running old code.
5. Follow official sources. The php.net news page and your Linux distribution's security notices are faster and more accurate than social media.
6. Keep backups. They turn a scary incident into a restore.

The same week, Node.js also released fixes for a serious bug in its Brotli decompression code. Bugs like these happen in every popular language. The teams that stay safe are the ones with a quick, simple update routine.

---

Final Thoughts

PHP2Shell sounds frightening, but the fix is short: check which PHP your website really uses, update to 8.5.12, 8.4.27, 8.3.36, 8.2.35 or your distribution's patched package, and restart PHP. If you cannot update right away, use the temporary settings above and restrict access until you can, then check your logs for signs of an attack.

Keeping servers patched is a real skill that companies value in developers. If you want hands-on experience with real projects, deployments and code reviews, you can do a free internship at MetaSkillGroup. Our online developer internship is open all year in six tracks. It takes about 2 minutes to apply, and your first exam attempt is free.