PHP2Shell: what website owners need to do
Illustration: protecting a PHP web server with security updates.
PHP2Shell is the name given to two critical vulnerabilities in PHP, the server software behind many websites and content management systems. The practical concern for your business is serious: an attacker may be able to run code on an affected server without logging in.
This article reflects the official guidance available on November 1, 2026. If your website uses PHP, check with your hosting provider now rather than waiting for your next routine maintenance window.
What happened?
On October 21, the PHP project released security updates for CVE-2026-109618 and CVE-2026-109619. Its warning covers installations serving web requests through PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team identifies mod_php as the highest-risk environment, with a demonstrated attack that can happen before your application code starts. See the official PHP security announcement.
These are runtime vulnerabilities. Updating your website’s theme or plugins does not, by itself, update the PHP software running on your hosting account.
Two different memory safety problems
CVE-2026-109618 concerns out-of-memory handling. PHP can interrupt work while internal request data is only partly initialized. When the request is cleaned up, that incomplete data can be used as though it were valid, allowing remote code execution. The advisory confirms exploitation against mod_php; the exact exposure of other environments depends on their request handling and application behavior. Read the PHP project’s out-of-memory advisory.
CVE-2026-109619 concerns stale global state. A worker can retain references to memory belonging to a request after that memory has been released. A later request handled by the same worker can act on those references too early. This is a use-after-free problem. Exploitation depends on the operations, configuration and application involved, so changing one setting does not eliminate every path. Read the PHP project’s stale-state advisory.
Which PHP versions contain the fixes?
The October 21 security releases are:
- PHP 8.2.35 for the 8.2 branch.
- PHP 8.3.36 for the 8.3 branch.
- PHP 8.4.27 for the 8.4 branch.
- PHP 8.5.12 for the 8.5 branch.
Use these releases or a later patched release in a supported branch. Distribution packages may carry backported fixes without matching these version numbers, so ask your provider to confirm coverage for both CVEs. Older branches need explicit vendor confirmation or migration. The PHP announcement explains the update options.
A follow-up you should also check
On October 23, PHP published additional guidance about session upload progress and CVE-2026-115560. It describes an unusual configuration that changes the session serialization handler at runtime. PHP recommends disabling session.upload_progress.enabled until the next regular bugfix release, while explaining when the setting can remain enabled. Ask your provider to review the session upload progress notice against your application.
Your next steps
- Inventory every PHP runtime. Include your main website, subdomains, staging sites, containers and scheduled jobs. A command-line version check alone may miss the version serving your website.
- Get patch confirmation. Ask your host which package fixes both PHP2Shell CVEs, whether it has been deployed, and whether all PHP workers have been restarted.
- Check the website afterward. Test login, forms, uploads and checkout where applicable.
- Review suspicious activity. Unexpected files, crashes or account changes deserve investigation. Installing a patch does not undo an earlier compromise.
Configuration workarounds can reduce particular attack paths, but the PHP advisories say they do not replace the complete fixes. Make PHP runtime updates part of your ongoing website maintenance, alongside application updates and tested backups.