PHP2Shell: two critical PHP flaws let attackers run code on servers without log…

What happened

PHP is the programming language behind most websites, including WordPress, Drupal, online shops and many business applications. Two critical flaws were found in its core, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both can allow an attacker on the internet to run their own code on the server without logging in.

The PHP team released fixes on October 21, 2026 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Technical details became public before the fixes were ready, and proof-of-concept code started circulating soon after. According to The Hacker News, researcher Adel Karimi of Perplexity confirmed successful attacks against honeypot servers on October 24, 2026. The US agency CISA added both flaws to its catalog of actively exploited vulnerabilities on October 26, 2026.

Slovakia’s SK-CERT, the Czech NÚKIB and the EU’s CERT-EU have all issued warnings. According to NÚKIB, information that enables exploitation is publicly available. Palo Alto Networks reports active attacks against internet-exposed management web interfaces of PAN-OS firewalls, which use PHP behind the scenes.

Why it is dangerous

Both flaws are “use-after-free” bugs. Imagine a hotel where a guest checks out, the room is cleaned and given to someone else, but the old entry stays in the front desk book. Anyone who later relies on that entry walks into a stranger’s room. In PHP, a reference is left pointing to memory that an attacker may by then control.

With CVE-2026-109618, PHP forcibly aborts a request that runs out of its memory limit. If that happens at the wrong moment, for example while processing a form with a file upload, it leaves behind half-prepared data that PHP then treats as valid during cleanup. With CVE-2026-109619, internal PHP records left over from a previous request keep pointing into memory that has already been freed. The next request handled by the same process then uses them.

The attacker does not need to log in. Sending crafted requests over the internet is enough. For CVE-2026-109618 with Apache and mod_php, the PHP team says this happens before any application code runs, so it does not matter which website the server hosts. For CVE-2026-109619, the PHP team demonstrated attacks against both Apache mod_php and PHP-FPM. Whether an attack succeeds depends on the configuration, extensions and application. A successful attacker can run code with the rights of the web server account and reach anything the website can, such as configuration files or site content.

The CVSS score rates severity on a scale from 0 to 10. The NVD database lists 9.8 for CVE-2026-109618 and 8.1 for CVE-2026-109619, while the PHP team rates both at 9.2 under CVSS 4.0. The CISA KEV catalog only lists flaws that attackers are proven to exploit. EPSS estimates the likelihood of exploitation over the next 30 days, and for both flaws it sits close to the very top of the scale.

Who is affected

PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27 and PHP 8.5 before 8.5.12
unsupported branches PHP 8.1 and older, which no longer receive regular updates from the PHP project (according to Slovakia’s SK-CERT, all versions back to PHP 5.0 are vulnerable)
appliances and products that use PHP in their management interface

According to CERT-EU, every PHP installation that serves web requests is at risk: Apache with mod_php (the highest risk setup according to the PHP team), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. In practice, this means web hosting, company websites and online shops, intranet applications and services running in Docker containers.

PHP also hides inside appliances. On PAN-OS (PA-Series and VM-Series firewalls and Panorama) only the management web interface is affected, GlobalProtect is not. Cisco lists Expressway, Duo Access Gateway, Ultra-Reliable Wireless Backhaul and ISE Portal Builder among its affected products. Other vendors such as Citrix, QNAP, Synology and Veeam have published their own advisories. Keep in mind that updating WordPress, a plugin or a framework is not enough. PHP itself must be updated.

How to check if you are affected

On shared hosting, you will find the PHP version in the hosting control panel under website settings, or ask your provider whether they have deployed patched PHP. On your own server, use the following commands. They only read information and change nothing. Use dpkg on Debian and Ubuntu, rpm on Red Hat, AlmaLinux and similar systems.

php -v

dpkg -l | grep -i php

rpm -qa | grep -i php

apachectl -M | grep -i php

docker exec <container> php -v

The command line version can differ from the one your website uses. Linux distributions also often ship the fix without changing the PHP version number, so for distribution packages compare the package version with your distribution’s security notice. For appliances (PAN-OS, Cisco and others), check the firmware version in their admin interface and compare it with the vendor advisory.

How to fix it

Updating is the only reliable fix. Work in this order:

Start with servers and management interfaces reachable from the internet, then move on to internal systems.
Update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or a later version in the same branch. Linux distributions received the fixes in advance, so use their packages. The volunteer-run remirepo repository did not have the fixes on release day.
Restart every PHP process (PHP-FPM, Apache with mod_php). Rebuild containers from a patched base image. A plain restart is not enough.
Verify the version using the steps in the previous section.
On shared hosting, ask your provider to confirm the fix.
For appliances, install the vendor fixes and allow access to the management interface only from trusted internal addresses.
Upgrade old PHP branches to a supported version or use a backported fix from your distribution. The PHP team also published source patches for PHP 7.4, 8.0 and 8.1.

If you cannot update right away, temporary measures reduce the risk but do not fully protect you. Set the following values in php.ini or the FPM pool configuration and restart every worker (setting them via ini_set() or .user.ini does not work):

session.upload_progress.enabled = 0
fatal_error_backtraces = 0

Both lines block confirmed attack paths for CVE-2026-109619, and the second applies to PHP 8.5 only. For CVE-2026-109618, the PHP team’s main workaround is to enforce memory_limit=-1 via php_admin_value so applications cannot override it. Also lower post_max_size to 8M if the site does not accept file uploads, or to 32M if it does. If the site does not need file upload forms, block multipart/form-data requests at the proxy. If a system cannot be fixed quickly, take it off the internet.

On October 23, 2026 the PHP team disclosed another flaw, CVE-2026-115560, which only affects unusually configured applications. There will be no emergency release for it. Until the next regular release, session.upload_progress.enabled=0 protects against it.

What if you may already be compromised

If a server ran a vulnerable version and was reachable from the internet, assume it may have been compromised. Attacker code runs under the web server account. According to NÚKIB, unusual processes started by PHP services may indicate an exploitation attempt. Look especially for:

unusual processes started by PHP or web server services, such as a shell or unknown programs
repeated crashes of PHP or the web server and memory exhaustion errors in error logs
a large number of oversized form and file upload requests in access logs
new or modified PHP files in the web directory and unknown accounts in the website admin

ps -ef --forest | grep -E -A5 'php-fpm|apache2|httpd'

zgrep -iE 'segfault|SIGSEGV|segmentation fault|Allowed memory size' /var/log/apache2/error.log* /var/log/php*-fpm.log*

journalctl -k | grep -i segfault

find /var/www -type f -name '*.php' -mtime -14 -ls

On Red Hat and similar systems, use the paths /var/log/httpd/error_log* and /var/log/php-fpm/* in the zgrep command. Updating alone will not remove an attacker from the server. If you find signs of an attack, disconnect the server from the network, save the logs elsewhere and call in an incident response specialist. Change the database passwords and keys that were stored on the server.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.

PHP2Shell: two critical PHP flaws let attackers run code on servers without logging in