If you operate a PHP website, install your vendor's current security update and make sure the web-serving workers are running it. PHP2Shell refers to critical PHP runtime vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Updating a CMS, framework or plugin does not update the PHP interpreter underneath it.
This guidance was checked against PHP's official announcements on October 26, 2026. It covers the original fixes plus follow-up notices issued on October 23 and October 26. Use the linked vendor advisories for changes after that date.
What PHP2Shell means for a site owner
The two vulnerabilities concern how PHP handles interrupted operations and state retained by a worker. Under exploitable conditions, an unauthenticated attacker can execute code in the web-server process. The practical consequences can include access to application data and server-side credentials.
PHP's advisory covers web-serving installations including Apache mod_php, PHP-FPM, PHP-CGI, FrankenPHP and LiteSpeed. The PHP team identifies mod_php as the highest-risk case, with a demonstrated path before application code runs. PHP-FPM should not be assumed safe merely because it uses a different integration method.
You do not need to run a public exploit to decide whether to patch. Inventory the installed packages and the runtimes actually serving requests, then follow your PHP or operating-system vendor's update guidance.
The first upstream releases containing the PHP2Shell fixes
| PHP branch | First upstream fixed release | Action |
|---|---|---|
| 8.2 | 8.2.35 | Install the current security package for your branch |
| 8.3 | 8.3.36 | Install the current security package for your branch |
| 8.4 | 8.4.27 | Install the current security package for your branch |
| 8.5 | 8.5.12 | Install the current security package for your branch |
These are the first upstream fixes for the two named CVEs, not a promise that an older package revision covers every later advisory. A distribution can backport fixes while retaining an older upstream version string. Verify the full package revision against the vendor's security notice instead of judging a vendor package solely by PHP_VERSION.
PHP 8.1 and older no longer receive normal upstream support. Some distribution and LTS vendors supply security backports. PHP also published minimal source backports for 7.4, 8.0 and 8.1; those are not a return to supported status. Use a vendor-confirmed patched build as an interim measure and plan a supported-branch migration.
Two follow-up notices to check
October 23: session upload progress
PHP published an additional note about an unusual interaction between session upload progress and switching session serialization handlers at runtime. Its interim recommendation is session.upload_progress.enabled=0 until the next regular bugfix release. Applications that never change the serialization handler at runtime can retain the feature. Review the exact conditions with your application maintainer; the forthcoming full advisory is identified as CVE-2026-115560.
October 26: refreshed Windows packages
PHP announced Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1, updating Brotli to address CVE-2026-111497. This is a separate dependency issue. The package rebuild keeps the PHP runtime version unchanged, so Windows operators should check the downloaded package revision as well as the runtime version.
Why php -v is only one piece of evidence
A control-panel server can have several PHP installations. Your shell might resolve PHP 8.4, one website might use PHP-FPM 8.2, and another might use a container with its own PHP binary. Start by checking the shell runtime:
php -v
php --ini
php -r 'printf("version=%s sapi=%s\n", PHP_VERSION, PHP_SAPI);'These commands describe the CLI process, not necessarily the website. Check each site's configured handler in its hosting panel or web-server configuration, identify the FPM pool or Apache module it uses, and match it to the patched package. For containers, rebuild from a patched base and replace the running deployment; pulling an image alone does not replace an existing container.
If an application exposes runtime diagnostics through an authenticated administrative interface, compare its PHP version and handler with the deployment record. Avoid leaving a public phpinfo page available: it can disclose configuration details unrelated to this check.
A practical update and verification sequence
- List affected sites and owners. Include public applications, admin interfaces, background workers and bundled vendor products using PHP. Prioritize internet-facing request handlers.
- Choose the correct package channel. Use the operating-system vendor, supported hosting-panel update path or official PHP distribution appropriate to the deployment. Record the advisory and full package revision covering both CVEs.
- Check application compatibility. A security update within the existing supported branch is different from a major or minor branch migration. Verify required extensions and test important application paths.
- Deploy the patched runtime. Restart or replace the affected workers according to your service and hosting documentation. Updating files on disk does not prove old processes have exited.
- Verify every serving instance. Confirm the package revision, running handler and worker replacement across nodes. Exercise login, forms and uploads, then inspect application and worker error logs.
- Record the result. Keep the site, node, handler, patched build, restart time and verification outcome together so another operator can audit the work.
What AI contributed—and what the history actually says
The discovery story involves people, maintainers and several research teams using AI assistance. The PHP Foundation traces early signs of the underlying out-of-memory problem to work following a 2024 audit. Later reports from Calif, OpenAI and Wiz established practical impact and additional attack paths. Wiz describes frontier models helping its researchers develop and validate exploit chains.
Calling this simply a new bug found by an AI leaves out that history. The operational lesson is that a difficult-to-exploit runtime flaw can become more practical to attack as research tools improve. The response remains concrete: deploy and verify the security update.
Can a WAF or a configuration change replace the update?
No complete substitute is identified in PHP's security release guidance. Provider protections and temporary mitigations can reduce particular attack paths, but they do not prove an unpatched runtime safe. If you cannot patch an exposed service promptly, coordinate a containment plan with its hosting or security provider rather than relying on a single filter rule.
If you suspect a compromise, updating PHP does not remove an attacker's files or reverse stolen credentials. Preserve relevant evidence and follow your incident-response process. An absence of obvious errors or shell files is not proof that exploitation did not occur.
Keep the update evidence trustworthy
When using official release archives, follow the publisher's hash and signature instructions. Our SHA-256 verification guide explains the file checks. Use the Diff Checker on redacted configuration snippets when reviewing changes; it cannot determine whether a PHP build contains a security backport.