What Is PHP2Shell?
PHP2Shell is the name given to two memory flaws in PHP itself, not in any one app built with it. An attacker who can send requests to a PHP site can push PHP into a bad state between requests and then run their own code on the server. They don't need an account or any help from a user.
- CVE-2026-109618 (rated 9.8): when PHP runs out of memory part-way through a request, some request memory can be left uninitialised, and the clean-up that follows reads it.
- CVE-2026-109619 (rated 8.1): some of PHP's internal state can keep pointing at a request's memory after that memory has been freed, and later requests act on it.
Details leaked before the fix was ready. PHP announced the flaws on 20 October 2026 and released fixed versions the next day. CISA added both to its list of flaws being exploited on 26 October.
Am I Affected?
You are if your server runs PHP 8.2, 8.3, 8.4 or 8.5 older than these:
| Release | Fixed in |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Check the version on the server:
php -vOn a web server, check the version your site actually uses too (PHP-FPM can differ from the command line). A WordPress site shows it under Tools › Site Health › Info › Server.
- Ubuntu, Debian, Red Hat and other distribution packages often keep the old version number and add the fix as a new build (for example
8.3.6-0ubuntu0.24.04.x). Check your distribution's security notice for the fixed build, not the number above. - PHP 8.1 and older no longer get fixes from PHP. Treat them as affected and move to a supported version. See Bobble Solutions' end-of-life notes for PHP 8.1.
- Shared hosting: your host patches PHP. Check the PHP version in your control panel, or ask them.
How to Fix It
- Update PHP to a fixed version or build.
- Ubuntu or Debian:
sudo apt update && sudo apt upgrade - Red Hat, Rocky or Alma:
sudo dnf upgrade 'php*' - cPanel: update EasyApache's PHP packages, then check MultiPHP Manager.
- Ubuntu or Debian:
- Restart PHP so the running copy is the new one:
sudo systemctl restart php8.3-fpm(use your version), or restart Apache if it runs PHP as a module. - Check again with
php -vand on the site itself.
If you get PHP from Ondřej Surý's PPA or packages.sury.org, make sure the fixed build has reached your machine's architecture: arm64 builds came out later than x86 ones.
After Patching
Attackers were using these flaws before many servers were patched. If your site was exposed between 20 October and the day you updated, look for signs someone got in: PHP files you don't recognise in the web folders, new admin users in your CMS, new cron jobs, and unexpected outbound traffic. If you find any, treat the server as compromised.