# PHP2Shell: the critical PHP vulnerability patched on 21 October, and what to do about it

> PHP2Shell, two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), was patched on 21 October 2026. Who is at risk, how to check your PHP version, and what to do today.

By Salaheddine Elfatimi, Full Stack Developer in Marrakech. Published 22 October 2026. Updated 22 October 2026.
Canonical: https://salaheddine-elfatimi.com/blog/php2shell-php-vulnerability

## Key takeaways

- On 21 October 2026 PHP fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), that can allow unauthenticated remote code execution.
- The fix is updating to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35; PHP says there are no complete mitigations.
- Every PHP installation serving web requests is at risk, mod_php the most; WordPress, which runs on PHP, powers 39.6% of all websites by W3Techs' count.
- PHP 8.1 and older get no official release: minimal backports exist for 7.4 to 8.1, nothing for 5.4 to 7.3, so those sites need a newer PHP.

On 21 October 2026, PHP fixed a critical PHP vulnerability nicknamed PHP2Shell: two flaws (CVE-2026-109618 and CVE-2026-109619) that can let an attacker run code on a web server without logging in. If your website runs on PHP, and every WordPress site does, the fix is to update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 today, or to ask your host to do it.

PHP's own words leave little room: "All PHP users are strongly encouraged to update immediately." Below: what this PHP vulnerability is in plain words, who is at risk, how to check which PHP version your site runs, and what to do if you can't update right away. Everything comes from PHP's advisory and the security write-ups, read on 22 October 2026.

![PHP2Shell: one request reaches a vulnerable PHP worker and can run code on the server. The fix is a PHP update.](https://salaheddine-elfatimi.com/uploads/2026/10/php2shell-cover-47e13795.webp)

## What happened with this PHP vulnerability?

Picture a WordPress site on shared hosting: a clinic's or a riad's, built three years ago, nobody has logged into the hosting panel in two. The site works, so nobody touches it. That's the kind of site this PHP vulnerability is about: the problem isn't in WordPress or in a plugin, it's in PHP itself, the language the server runs underneath.

On 21 October, [php.net](https://www.php.net/) published a security advisory titled "Critical remote code execution vulnerabilities, update now", with four new versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. "Remote code execution" means that someone on the internet can make your server run their code. "Unauthenticated" means they don't need an account or a password to try.

![PHP's security advisory on php.net, 21 October 2026: "Critical remote code execution vulnerabilities, update now".](https://salaheddine-elfatimi.com/uploads/2026/10/php2shell-advisory-77c938b6.webp)

PHP describes two separate flaws, both in how PHP cleans up after a request:

- **CVE-2026-109618, "RCE via OOM corruption".** When PHP runs out of memory at the wrong moment, it can stop while its internal request data is only half set up, and the cleanup that follows treats that broken data as valid.
- **CVE-2026-109619, "RCE via stale global state".** Some data that belongs to one request can survive after its memory has been freed, and the next request handled by the same worker can use it.

The name PHP2Shell comes from the exploit chain shown by researchers, and the story of this PHP vulnerability moved fast. By [Tenable's account](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote), the CVE numbers leaked on Hacker News and social media on 20 October, so the PHP Foundation moved the release forward by a day, from 22 to 21 October.

## Who is at risk from PHP2Shell?

PHP's answer is broad: "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed." PHP considers the risk highest for mod_php, where a demonstrated exploit lets an unauthenticated request trigger the attack "before any application code runs". In other words, your own code being clean doesn't protect you.

How many sites does the PHP vulnerability touch? According to [W3Techs](https://w3techs.com/technologies/details/pl-php), PHP runs 69.3% of the websites whose server-side language it knows, and [WordPress alone](https://w3techs.com/technologies/details/cm-wordpress) powers 39.6% of all websites. By Tenable's account of Calif's writeup, the earliest affected code dates back to PHP 5.4.0, so old installations are concerned too.

| Your PHP version | Fixed in | What PHP offers |
| --- | --- | --- |
| 8.5.x | 8.5.12 | Official update |
| 8.4.x | 8.4.27 | Official update |
| 8.3.x | 8.3.36 | Official update |
| 8.2.x | 8.2.35 | Official update |
| 7.4, 8.0, 8.1 | No release | Minimal source backports, or your Linux vendor |
| 5.4 to 7.3 | No fix | End of life: upgrade |

## How do I check which PHP version my site runs?

You don't need to be a developer for this. Depending on how your site is hosted:

- **WordPress:** in the admin, go to Tools → Site Health → Info and open the Server section: the PHP version is listed there.
- **Shared hosting:** most hosting panels (cPanel and others) show the PHP version and let you choose it, often under a name like "Select PHP version" or "PHP settings".
- **Your own server:** run `php -v` in the terminal, and check the PHP-FPM or Apache version that actually serves the site, which can differ from the command line.
- **Not sure at all:** ask whoever built or hosts the site. One message is enough: "Is our PHP updated to the 21 October 2026 security release?"

While you're there, note that [WordPress recommends](https://wordpress.org/about/requirements/) PHP 8.3 or newer. It still runs on PHP 7.4, but WordPress itself warns that those older versions "have reached their official End Of Life and may expose your site to security vulnerabilities".

## What should I do today?

![What to do today about PHP2Shell: find your PHP version, then update, ask your host, or upgrade an old branch.](https://salaheddine-elfatimi.com/uploads/2026/10/php2shell-what-to-do-6e0ec3e3.webp)

1. **Update PHP.** To 8.5.12, 8.4.27, 8.3.36 or 8.2.35, whichever matches your branch: it's the only complete fix for the PHP vulnerability. PHP says Linux distributions and LTS vendors "received the patches in advance", so updated packages may already be waiting.
2. **On shared hosting, ask your host.** You usually can't update PHP yourself there; your host can. Ask for the version number, not just a "yes".
3. **On PHP 8.1 or older, plan the upgrade.** PHP no longer releases updates for those branches. For 7.4, 8.0 and 8.1 the PHP security team published minimal source backports, and some Linux vendors provide fixes; for 5.4 to 7.3 there is nothing, so the only way out is a newer PHP.
4. **Behind Cloudflare?** Cloudflare's CTO, quoted by Help Net Security, says PHP sites behind it "already have an initial set of WAF rules deployed for the known exploit vectors", for all customers including the free plan. That helps; it isn't a fix.

If you really can't update right away, PHP lists temporary settings (a different memory_limit, a low post_max_size, turning off session.upload_progress, and more). Read its own warning before relying on them: they "reduce exposure to specific attack paths but do not make an installation safe." PHP's release notes put it even more plainly: "There are no complete mitigations, updating is the only safe choice."

For a site that can't be fixed quickly, [Help Net Security reports](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/) that the UK's National Cyber Security Centre urges organizations to consider taking offline any system that can't be fixed right away.

## Is the PHP vulnerability already being exploited?

The reports don't all agree, and it's worth knowing both sides. By Tenable's account, Amazon Threat Intelligence observed an exploitation attempt on 17 October, four days before the public disclosure, and says PHP2Shell is now being broadly exploited in the wild.

On the other side, [Cisco's advisory](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-php-october26-Jj384Daq) says its security team "is not aware of any malicious use of the vulnerabilities". Either way, the patch is out and the details are public, so waiting only gives attackers time.

Two more pieces of fine print. The score: the CVE numbers that leaked first came with a CVSS score of 10.0, which the PHP Foundation says was incorrect; PHP rates both flaws CVSSv4.0 9.2, still critical. And how they were found: the PHP Foundation credited Calif, OpenAI and Wiz, and by Tenable's account Calif and Wiz both said they used AI models in their research.

> Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.
> — Wiz researchers, quoted by Help Net Security, 21 October 2026

## What about my own sites?

This site runs on Next.js, so PHP2Shell doesn't touch it. That isn't true of everything I work on: two of the CCL platforms have a Laravel API, and Laravel runs on PHP, so they're concerned like any other PHP server. Many business sites run on PHP too, often through WordPress. If yours is one of them, the checks above are a quick start.

If a slow or old WordPress site is part of the picture, [why your website is slow and what to fix first](https://salaheddine-elfatimi.com/blog/why-is-my-website-slow) covers the other usual suspects.

## Need your site updated, or rebuilt on something you don't have to babysit?

Updating PHP is a job for whoever manages your hosting. If nobody does any more, or your site is stuck on an old PHP version, that's the moment to look at [a website that's built and kept up to date for you](https://salaheddine-elfatimi.com/services/websites). [Tell me what your site runs on](https://salaheddine-elfatimi.com/#contact) and I'll tell you honestly whether it needs an update, a fix or a rebuild.

## Frequently asked questions

### What is PHP2Shell?

PHP2Shell is the name given to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. Both can let an attacker run code on a web server without logging in. PHP rates them CVSSv4.0 9.2.

### Which PHP versions fix the vulnerability?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official release; the PHP security team published minimal source backports for 7.4, 8.0 and 8.1, and some Linux vendors ship their own fixes.

### Is my WordPress site affected by the PHP vulnerability?

If it runs on a PHP version older than the fixed ones, yes: the flaw is in PHP itself, not in WordPress or its plugins. Check your PHP version in Tools → Site Health → Info → Server, and update PHP or ask your host to.

### Can I protect my site without updating PHP?

Only partly. PHP lists temporary settings that reduce exposure to specific attack paths but says they do not make an installation safe, and that updating is the only safe choice. A firewall such as Cloudflare's WAF rules helps but isn't a fix.