Skip to content
InnoWorld
Critical: php2shell (CVE-2026-109618, CVE-2026-109619) lets attackers run code on unpatched PHP servers. Read the advisory ›

Security advisory · 21 October 2026

php2shell. Is your PHP website patched?

Two critical PHP flaws let attackers run code on your server without logging in. Attacks are already under way. We check, patch and verify your site, without downtime.

Get my site checked What is php2shell? ›

Which PHP versions are patched?

22 Oct 2026

  • PHP 8.5, 8.4 and 8.3

    Fixed in 8.5.12, 8.4.27 and 8.3.36

    Update now

  • PHP 8.2

    Fixed in 8.2.35. Security support ends 31 December 2026

    Update & plan

  • PHP 8.1 and older

    No official fix. Unsupported since 31 December 2025

    Upgrade needed

Linux distributions often ship the fix under an older version number (Ubuntu 26.04’s patched package is 8.5.4-0ubuntu1.5), so the version alone can mislead. Our instant audit confirms it with zero downtime. Sources: PHP advisory, php.net

Published 21 October 2026 by the PHP project · Summary updated

php2shell, explained.

CVE-2026-109618 and CVE-2026-109619 are two critical flaws in PHP itself, each rated CVSS 9.2. Here is what you need to know.

What it is.

  • CVE-2026-109618: remote code execution via memory corruption when PHP runs out of memory mid-request.
  • CVE-2026-109619: remote code execution via stale state that one request leaves behind for the next request on the same worker.
  • Neither requires a login. An attacker only needs to reach your website.

Who is affected.

  • Every PHP version before 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
  • All common setups: PHP-FPM, Apache mod_php (highest risk), php-cgi, FrankenPHP and LiteSpeed.
  • That includes WordPress, WooCommerce, Magento, Drupal, Laravel, Symfony, CodeIgniter and custom PHP sites.

Is it being exploited?

Yes. Exploitation attempts were observed on 17 October 2026, before public disclosure, and security researchers report that php2shell is now being broadly exploited. Automated scanners will find unpatched servers.

What to do now.

  1. Update PHP to a fixed release, or install your Linux distribution’s security update. This is the only complete fix.
  2. If you can’t update today, apply the PHP project’s interim settings (such as session.upload_progress.enabled=0) and restart PHP.
  3. Check for signs of compromise, since attacks started before the patch.

Outdated PHP.
Hidden risk.

You don’t need a computer science degree to understand it. Here’s what happens under the hood of your website.

The engine room.

Passwords and secure forms are the doors at reception. PHP is the foundation and plumbing. On an outdated version, its cracks are publicly documented and never repaired, so anyone who knows where to look can find them.

Plugins aren’t enough.

Wordfence, Cloudflare and SSL help, but they work on top of PHP. They cannot fix flaws inside the PHP engine itself. Only a supported, up-to-date version closes those gaps.

Often invisible.

Many compromises don’t deface or crash your site. Attackers quietly add backdoors, copy customer data or tamper with checkout pages, while everything looks perfectly normal to visitors.

Platforms we audit and upgrade

WordPress · WooCommerce · Drupal · Joomla · Magento · Laravel · Symfony · CodeIgniter · Custom PHP

How exposed are you?

Three questions. A rough estimate in seconds. Nothing is sent to us, and it doesn’t scan your site.

Answer all three questions to see your estimated risk.

From audit to upgrade.
Without downtime.

We bring your PHP stack up to a supported, patched version without taking your site down or breaking your business logic.

  1. 01

    Instant audit.

    We inspect your live environment remotely with non-invasive scanning, and identify the exact PHP version, build and server setup in use.

    • Zero interruption to customers
    • Checks for signs of past intrusions

  2. 02

    Upgrade & hardening.

    We upgrade PHP to a supported version and test your site against it. If legacy code can’t move yet, we harden the server and plan the upgrade with you.

    • Safe for legacy plugins and custom code
    • Tested before going live

  3. 03

    Verification & report.

    You receive a written report of what we found and fixed, ready to share with stakeholders, insurers or payment providers.

    • Clear record of changes made
    • 30-day post-fix monitoring included

Let’s check your site.

Tell us about your website. An infrastructure specialist will reply within 4 hours. No commitment required.

What happens next.

  1. Step 1

    We review your details.

    Your site URL and stack tell us where to start.

  2. Step 2

    We reply within 4 hours.

    By email, with clear next steps.

  3. Step 3

    You decide.

    No obligation, and your details stay confidential.

Prefer WhatsApp?

Message us directly. Please don’t send passwords or server logins in chat.

Chat on WhatsApp

Your details are kept confidential and used only to respond to your enquiry. Sent over an encrypted connection. See our Privacy Policy.

Questions? Answers.

What is php2shell?

php2shell is the name given to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed by the PHP project on 21 October 2026. Both are rated CVSS 9.2 and can let an attacker run code on your web server without logging in.

Is my website affected by CVE-2026-109618 or CVE-2026-109619?

Very likely, if it runs PHP and has not been updated since 21 October 2026. All PHP versions before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 are affected, whether served through PHP-FPM, Apache mod_php, php-cgi, FrankenPHP or LiteSpeed. PHP 8.1 and older will not get official fixes. Linux distributions often backport the fix without changing the version number, so the version alone does not settle it; an audit does.

Can we mitigate php2shell without upgrading PHP?

Only partially. The PHP project lists interim settings, such as setting memory_limit=-1 in the server configuration and disabling session.upload_progress, but states that updating is the only complete fix. We apply those mitigations as a stopgap while we plan and test the upgrade.

Will our website go down while you fix the issue?

No. We prepare and test the upgraded PHP version alongside your live site, then switch over. Your customers can keep browsing and ordering without disruption.

Our web designer says everything is updated. Is that enough?

Usually not. Website designers and typical developers manage WordPress themes, plugins, and front-end code. PHP itself sits lower in the server software stack, which is usually outside a web designer’s routine access, so its version often gets overlooked.

Can we wait until our routine quarterly maintenance?

Not for php2shell. Exploitation attempts were seen before the flaws were even disclosed, and attacks are now widespread. Automated bots scan the internet for unpatched servers, so waiting weeks leaves the door open.

What if our site needs an older PHP version that can’t be updated without breaking?

We reduce the risk while you plan the move: hardening the server configuration, isolating the legacy application and limiting what it can reach. Then we work with you on a staged upgrade instead of forcing a full rewrite.

Still have questions? Ask us directly ›