PHP2Shell (CVE-2026-109618, CVE-2026-109619): how to patch PHP

PHP2Shell is two critical flaws in the PHP engine itself: CVE-2026-109618 and CVE-2026-109619. According to Datadog Security Labs (2026), both are rated 9.2 under CVSS v4.0, close to the top of a scale that ends at 10. One crafted request, with no login, can run an attacker's code on the server before the site's own code even starts. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026, fix them.

According to W3Techs (2026), PHP runs 69.3% of websites whose server-side language is known. WordPress and WooCommerce run on PHP, and so do Magento, PrestaShop and Shopware, Drupal and Joomla, and applications built on Laravel, Symfony, Laminas (formerly Zend Framework) and CodeIgniter. Updating the site or its plugins does nothing here. PHP itself has to be upgraded on every server, in every container image and in every deployment pipeline.

What PHP2Shell is and how dangerous these flaws are

Both flaws sit in the way PHP accepts forms with file uploads, the multipart/form-data requests. PHP does this on its own before it hands the request to the site.

CVE-2026-109618 triggers when PHP runs out of memory mid-request. Some request data stays half-initialised, and the cleanup step treats it as valid. CVE-2026-109619 is a PHP worker keeping a reference to freed memory, which the next request on the same worker can use.

The cloud providers describe the impact themselves. Google Cloud writes that at this severity an attacker can crash and hijack the system, and can easily steal, alter and wipe its data. Vercel adds exposure of data from other users' requests and denial of service. Code that PHP runs has the site's own permissions: it sees the configuration files with database passwords, the customer and order database, and the keys to payment gateways and email.

Three things make these flaws unusually dangerous:

• Logging in does not help. Datadog confirmed that PHP processes the malicious request before the application sees it. Any PHP script will do, even one that only prints a page.
• Attacks started before the fix. According to Datadog, AWS saw PHP2Shell exploitation attempts on 17 October, 4 days before disclosure.
• Exploits are public. VulnCheck ran its own exploit against PHP 8.4.10 to 8.4.26 in a production configuration, and Vercel reports working public exploits.

What can happen to your company: examples

An attacker who runs code on a shop or website server can do whatever the site itself can do. With an unpatched PHP, that includes:

The last example is already happening: Sophos saw attempts to install a variant of the Mirai botnet through PHP2Shell.

A customer data breach also has legal consequences in the EU. Under the GDPR (2016), a company has 72 hours after becoming aware of a breach to report it to the supervisory authority. Under the GDPR (2016), failures in security and breach notification can be fined up to €10 million or up to 2% of total worldwide annual turnover, whichever is higher. Source: GDPR, Regulation 2016/679, Article 33 and Article 83(4).

PHP2Shell in numbers: statistics 2026

Figures checked on 23 October 2026.

• According to W3Techs (2026), PHP runs 69.3% of websites whose server-side language is known.
• According to W3Techs (2026), WordPress, which is written in PHP, runs 39.6% of all websites.
• According to W3Techs (2026), 26.9% of PHP websites run version 7 and 7.7% run version 5, and neither branch will get a fixed release.
• According to Google Cloud (2026), every PHP version from 5.4 to 8.5.11 is affected.
• According to Datadog Security Labs (2026), AWS saw PHP2Shell exploitation attempts on 17 October 2026, 4 days before the fixes were published.
• According to Google Cloud (2026), Google Security Operations added 23 new curated detections for this attack.

Sources: W3Techs, PHP, W3Techs, WordPress, PHP security advisory, Google Cloud, Datadog Security Labs.

Who is affected: shops, WordPress, Laravel and hosting

According to PHP's advisory, every installation that serves web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates the risk highest for mod_php. There, a demonstrated exploit lets one unauthenticated request start the attack before any application code runs.

Vercel states that frameworks and content management systems built on PHP are affected when they run on a vulnerable PHP runtime. In practice:

The most exposed servers are the ones nobody remembers: an old version of the site, a test shop, a panel set up years ago. These often run PHP 7 or 5, and PHP will not release a fix for them.

Which PHP versions are affected and which are fixed

The PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1. They only help teams that build PHP from source. Some Linux distributions and long-term support vendors ship their own packages, so check your vendor's advisory. PHP also warns users of the rpms.remirepo.net repository, which had no update on the day of the release.

How to patch PHP2Shell: step by step

1. List every place PHP runs: servers, containers, hosting, CI machines, old sites and panels.
2. Check the PHP version in each of them, in the environment that serves traffic.
3. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on the branch.
4. Rebuild container images on a fixed base image and redeploy them.
5. Restart every PHP-FPM and Apache process so none stays on the old version.
6. Check the version again after the deployment.
7. Move servers on PHP 8.1 and older to a supported branch and check the site still works after the change.

Commands to check the version and restart:

php -v                                   # server or virtual machine
php-fpm -v                               # the process serving traffic
docker run --rm <image> php -v           # every container image
sudo apt update && sudo apt upgrade      # Debian, Ubuntu: fixed packages
sudo systemctl restart php8.3-fpm        # restart FPM (name depends on version)
docker build --pull --no-cache -t <image> .   # rebuild the image on a fresh base

On shared hosting, the version is in the control panel or in phpinfo(). Ask the host whether it has applied the fix. On Google Cloud, supported App Engine standard runtimes update themselves, while App Engine flexible, Cloud Run without automatic base image updates and GKE need a rebuild and a redeploy. The version on a developer's laptop says nothing about production.

What to do if you cannot patch PHP today

PHP lists settings that reduce exposure on specific attack paths. None of them makes a server safe, and Datadog found that the popular session.upload_progress.enabled=0 workaround does not fully protect you.

• Set memory_limit=-1 in a way applications cannot override, for example with php_admin_value in the FPM pool.
• Set a low post_max_size: 8M without file uploads, 32M with them. Keep upload_max_filesize below it.
• Set session.upload_progress.enabled=0 in php.ini or the FPM pool and restart every worker.
• On PHP 8.5, set fatal_error_backtraces=0 and restart the workers.
• Turn on your provider's WAF rules. Google Cloud Armor, AWS WAF and Vercel already have rules for PHP2Shell.

These settings buy time until the upgrade, which still has to happen.

Is PHP2Shell being exploited?

Attempts are under way. Vercel reports exploitation attempts across the industry. In its 22 October update, Sophos saw scanning and a small number of failed attempts in which criminals tried to drop a Mirai botnet variant on the server. VulnCheck counted hundreds of repositories with claimed exploits on GitHub, and only a few of them worked.

Sophos notes that building a working exploit is hard, and adds that criminals may refine them over time. The advice stays the same: every server on a vulnerable PHP version needs the update.

How Syntalith helps patch PHP2Shell

We can do it for you, from the server list to the final check. First we find PHP on servers, in containers, in CI and at hosting providers, including sites and panels the team forgot. Then we move PHP to a fixed release, rebuild images, redeploy services and restart workers. Sites on PHP 7 and 5 go to a supported branch, and we check that the shop, the forms and the admin panel still work after the change. Where the upgrade has to wait, we set WAF rules and the settings from PHP's advisory.

Finally we check the version in the environment that serves traffic and give you a written report: what was vulnerable, what we updated, what remains and why. We work on your infrastructure, with access only for the duration of the job.

We run the same steps on our own systems. On 23 October we moved our website, booking system and MCP server to Node.js 24.22.1, which fixes Node2Shell.

Start with a free 30-minute call with an engineer. Tell us where PHP runs, and we will tell you where to start and how long it will take. Book a call.

The same week brought two other urgent problems: the compromised eMudhra certificates and the Node2Shell flaw in Node.js.