What Is PHP2Shell? A Practical Guide to Checking and Fixing PHP Websites
Published on
If your company website, WordPress installation or online store runs on PHP, PHP2Shell calls for an urgent runtime update. A working website and a strong administrator password do not establish that the server is protected.
This guide covers identifying the runtime, applying patches, restarting processes and checking the result. Information was checked on 22 October 2026; consult the PHP project and your operating system vendor for later updates.
What is PHP2Shell?
PHP2Shell is the name used for two critical PHP core vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both have a CVSS v4.0 score of 9.2. In susceptible environments, an unauthenticated attacker may execute code through HTTP requests with the privileges of the web worker. This does not automatically grant root access, but can expose application files and accessible data. PHP security announcement
Both flaws concern abnormal state during PHP's request lifecycle:
- CVE-2026-109618: corruption during out-of-memory handling. A failed allocation can interrupt initialization, leaving invalid request data that cleanup code later uses. Official technical advisory
- CVE-2026-109619: stale global state. Internal state can outlive the memory belonging to a request. A subsequent request in the same worker may access that stale state. Official technical advisory
Updating a theme, plugin or application alone does not patch the PHP runtime.
Which websites need checking?
PHP's announcement covers all installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Exploit conditions and validation differ between server interfaces; PHP-FPM should not be treated as safe. The PHP team identifies mod_php as the highest risk, with a demonstrated attack before application code runs. PHP announcement
Check the underlying environment for WordPress, Laravel, Drupal and other PHP applications. Even if your main site uses another language, inventory legacy sites, administrative tools and test deployments that still use PHP.
An absence of visible symptoms does not establish that the vulnerability is absent. Conversely, an affected version alone does not prove a compromise; that requires investigation.
Which versions contain the fix?
PHP released these upstream fixes on 21 October 2026. Install the listed release for your branch, or a later release containing the fixes. PHP release announcement
| PHP branch | First fixed upstream release |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Distribution packages require a different check. Vendors may backport patches while retaining an older upstream version number. Match your OS release and full package version against the vendor advisory. For example, Ubuntu 24.04 lists 8.3.6-0ubuntu0.24.04.13 as fixed. Ubuntu's package and remediation guidance
PHP 8.1 and older no longer receive regular PHP project updates. Some distribution and long-term support vendors provide backports. The PHP team also published minimal source backports for 7.4, 8.0 and 8.1; these do not restore support for those branches. Prefer migration to a supported branch, and obtain explicit vendor confirmation if you must temporarily remain on an older one. PHP announcement
How to check and fix your installation
1. Identify the runtime actually serving the website
Start with these CLI checks:
php -v
php --ini
They describe the command-line installation. The website may use another version through FPM, an Apache module or a container.
Check the site's FPM pool, hosting panel, container image and vendor package records. For managed hosting, request confirmation that both CVEs are patched and the relevant workers have restarted. Avoid leaving a full phpinfo() page publicly accessible.
2. Back up and install the security update
Confirm that files, database and configuration backups can be restored. Record the current environment and plan a short maintenance window. A security update within a supported branch is usually the most direct route; a major-version migration also needs extension and application compatibility checks.
The following is an example for Ubuntu/Debian-style PHP 8.3 with FPM. Adjust package names to your actual installation; use the vendor's procedure on other distributions:
sudo apt update
apt-cache policy php8.3-fpm php8.3-cli php8.3-common
sudo apt install --only-upgrade php8.3-fpm php8.3-cli php8.3-common
Verify that the candidate packages include fixes for both CVEs. Update any other installed PHP branches and related packages still in use. A successful package command does not by itself confirm remediation.
For Docker deployments, update to a patched base image, rebuild the application image and replace the running containers. Restarting an old image or updating only the host's PHP does not update the container runtime.
3. Restart the processes running PHP
Old workers may continue running after the files on disk have changed. Restart the appropriate service; for this FPM example:
sudo systemctl restart php8.3-fpm
sudo systemctl status php8.3-fpm --no-pager
Restart Apache for mod_php, or the corresponding service for another runtime. Cover every node, including standby instances. Ubuntu also explicitly notes that applications generally need restarting to use the updated components. Ubuntu remediation instructions
4. Verify the runtime and business functions
Keep evidence for these checks:
| Check | Acceptance criterion |
|---|---|
| Package or image | Vendor confirms fixes for both CVEs |
| Web runtime | Actual request-serving processes use the patched runtime |
| Deployment coverage | All sites, containers and nodes are updated and restarted |
| Business functions | Home page, login, inquiries, uploads and orders work as applicable |
| Logs and monitoring | No continuing new crashes, memory errors or 5xx spikes |
Do not run public exploit tools against a production website as a routine acceptance test. Prioritize package provenance, runtime state and business regression checks.
What if you cannot update immediately?
The PHP project says only an update is a complete solution. While arranging it, reduce exposure through network or reverse-proxy access restrictions, source allowlists or, where necessary, a static maintenance page. PHP mitigation guidance
For confirmed session-related paths, the advisory recommends disabling upload progress in configuration that takes effect before request parsing, then restarting every worker:
session.upload_progress.enabled = 0
This blocks only certain paths. It does not fix the separate memory corruption issue or every variant. Application-level ini_set() is too late for this purpose. Stale-state advisory
Temporary measures for the out-of-memory issue involve memory and frontend request limits. They require capacity-aware operational review. Do not blindly copy memory_limit=-1: removing PHP's memory boundary changes availability risks, and underlying allocation failures can still reach the flaw. WAF and request controls are additional defenses, not substitutes for the patch. Out-of-memory advisory
What if exploitation is suspected?
The following are incident-response recommendations. A single symptom does not establish PHP2Shell exploitation:
- Preserve access, PHP error and host audit logs. Investigate unexpected child processes, outbound connections and file changes.
- Isolate suspicious hosts from production traffic. Preserve evidence before investigating unfamiliar scripts, scheduled tasks and accounts.
- If compromise is confirmed, rebuild from a trusted image or verified clean backup. Rotate potentially exposed database, deployment and third-party credentials from a clean environment.
- Continue monitoring after patching. Removing one suspicious file is not sufficient incident closure.
What should a website owner ask their provider for?
Request four deliverables: the actual web PHP version, evidence of patches for both CVEs, worker restart records and functional verification results. “The firewall is enabled” or “plugins are updated” does not establish that this runtime issue is resolved.
For help reviewing your website environment, planning an upgrade and checking the deployment, contact Seigen Web Studio with your hosting platform, application and current PHP version.