PHP security patch (php2shell)
php2shell is the name for two critical PHP flaws published on 21 October 2026 (CVSS v4.0 9.2, no authentication required). They affect any site that serves requests with PHP, whether it runs WordPress, Drupal, Joomla, Magento, PrestaShop or Laravel. They are fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Do you have this vulnerability? We update PHP for you, apply the temporary mitigation wherever the update cannot happen yet, and check for traces of an intrusion.
$ php -vPHP 8.3.30 (cli)# 8.3.30 < 8.3.36: affected$ php-fpm8.3 -vPHP 8.3.30 (fpm-fcgi)# CLI and FPM can run different versions$ php -i | grep upload_progress.enabledsession.upload_progress.enabled => On => On# Temporary mitigation: 0 in php.ini, restart FPM8.5.12 · 8.4.27 · 8.3.36 · 8.2.35php2shell: two critical flaws in the interpreter itself
On 21 October 2026 the PHP project released new versions to fix CVE-2026-109618 and CVE-2026-109619. It moved the release forward to 14:00 UTC because, the day before, a Hacker News post had leaked the identifiers ahead of the embargo.
CVE-2026-109618 is memory corruption: if PHP runs out of memory halfway through initialising request data, the cleanup treats invalid data as valid. A crafted multipart request that exhausts memory is enough, even when its size looks within limits. CVE-2026-109619 leaves freed internal state alive between requests, and a later request on the same worker reuses it. Huntress describes it as an unauthenticated heap use-after-free with memory disclosure and remote code execution with the web worker’s privileges.
The flaw lives in PHP, so updating the CMS or its plugins does not fix it. According to php.net it affects every installation that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest with mod_php, where Rapid7 says it can be exploited before any application code runs. Wiz demonstrated unauthenticated remote code execution against WordPress, Drupal and Joomla, plus a memory leak path that could expose passwords, tokens, API keys and certificates.
As of 21 October, Rapid7 expected exploitation and several teams were reproducing it; Huntress had not seen it among its customers. The UK’s NCSC and CERT-EU issued alerts the same day. PHP runs about 69.7% of websites whose server-side language is known, according to W3Techs.
Sources: php.net · Rapid7 · Huntress · NCSC · Infosecurity Magazine
Fixed PHP versions
If your server handles web requests with PHP and its version is older than the one listed for its branch, you are affected. Linux distributions with extended support shipped their packages earlier: there, your vendor’s advisory counts, not the version number.
| Branch | Fixed in | Note |
|---|---|---|
| 8.5 | 8.5.12 | |
| 8.4 | 8.4.27 | |
| 8.3 | 8.3.36 | |
| 8.2 | 8.2.35 | End of life on 31 Dec 2026 |
| 8.1, 8.0, 7.4 | No official release | PHP published minimal source backports for those who compile |
| 7.3 and older | No fix | Move to a supported branch |
Check this
- Your site runs WordPress, Drupal, Joomla, Magento, PrestaShop, Laravel or any other PHP application reachable from the internet.
-
php -vorphp-fpm -vreport a number lower than your branch in the table. - You run Apache with
mod_php: that is the riskiest setup. - You use your Linux distribution’s PHP: the number may stay the same even when the package is patched, so check the vendor’s advisory.
- You are on shared hosting: the provider updates PHP, but you can see the version in the panel or with
phpinfo()and ask for a date.
If you cannot update today
These are the temporary mitigations published by the PHP project. They reduce exposure while you prepare the update; they do not replace it.
- 01 Set
session.upload_progress.enabled=0inphp.inior in the PHP-FPM pool and restart every worker.ini_set()or.user.iniwill not work. - 02 On PHP 8.5, also set
fatal_error_backtraces=0. - 03 Limit request size and the number of fields, parts and headers in the web server or proxy.
- 04
post_max_size=8Mif the site accepts no file uploads;32Mif it does. - 05 If you cannot update, look for indicators of compromise and backdoors. If you cannot mitigate either, the NCSC advises considering taking the system offline.
Seven steps, in this order
We follow the same procedure on every server: first find out which version runs where, then fix it, and finally check that nobody got in before the patch.
Version inventory
We list every server, container and hosting account running PHP, with the CLI and FPM versions, the mode (FPM, mod_php, CGI) and who maintains it. The forgotten site on an old server is the one that stays unpatched.
Immediate mitigation
Where the update cannot happen right away, we disable session.upload_progress in php.ini or the pool, limit request size and parts, and restart the workers.
Update
We move to the fixed version for your branch or to your distribution’s patched package. If you are still on 8.1 or older, we explain both ways out: compiling with the backports or migrating to a supported branch.
Verification
We check the version that actually serves requests, not only the command-line one, and confirm that the site, its forms and uploads still work.
Review for indicators of compromise
We go through access and error logs, recently modified files in the web root and new administrator accounts in the CMS.
Secret rotation, if needed
If there are signs of access, or the server was exposed to the memory leak, we change database passwords, API keys, tokens and certificates.
Monitoring new advisories
We record which version each server runs and which advisories to follow (PHP, your distribution, your CMS), so the next update starts from that inventory.
What usually gets left half done
Not sure which PHP version your site runs?
Free consultation →php2shell FAQ
What is php2shell?
Is my WordPress site affected if its plugins are up to date?
Is disabling session.upload_progress enough?
I am still on PHP 7.4 or 8.0. What should I do?
What if I am on shared hosting?
Tell us where your PHP runs
We start with the inventory: which version each server has, what needs doing today and what can wait for a maintenance window.
Tell us your challenge. We'll propose a solution.
No commitment. Within 24 hours, you'll receive a proposal with scope, timeline and budget. No fine print.