PHP News: Two Critical PHP2Shell Flaws Are Fixed. Here Is What to Do for Your Setup

23 October 2026. PHP’s maintainers released emergency security updates on 21 October, a day ahead of the original plan, after the two CVE identifiers leaked online. The bugs sit in the PHP engine itself, so updating WordPress, Laravel or any plugin does not fix them. Who needs to act depends on who controls PHP on your server. This guide sorts that out.

PHP news this week: how the PHP2Shell timeline unfolded

The flaws were disclosed in a rush: first exploitation attempt on 17 October, a leak on 20 October, patches on 21 October. Both carry a 9.2 rating on the CVSS v4.0 scale, according to the PHP project’s own advisory.

The two flaws are different bugs. CVE-2026-109618 comes from how PHP handles running out of memory, which can interrupt a request while its internal data is only half set up. CVE-2026-109619 involves internal state that outlives the memory it points to, so the next request handled by the same worker can pick up stale data, per PHP’s advisory. Security firm Wiz compared the severity to Heartbleed, the 2014 encryption-library flaw, as noted on Wikipedia’s PHP2Shell entry. Some researchers argue it is harder to exploit than that comparison suggests (see below).

Which PHP versions are fixed?

Four branches received fixed releases on 21 October 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Any earlier release in those branches is affected, according to PHP’s GitHub advisories.

PHP says all installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php highest because its demonstrated exploit can trigger before any application code runs. Command-line scripts that never serve web requests are a different case, but PHP’s wording points at web-facing setups.

Find your situation: a decision framework

Your next move depends on who can actually install PHP on your server. Answer three questions: can you log in to the server with admin rights, which PHP version serves your site, and is that branch still supported? Then find your row.

If you are on shared or managed hosting

You usually cannot patch PHP yourself, and no plugin can do it for you. Hosts have been moving at different speeds. A tracker kept by Meow Apps, as of 22 October, listed these statuses (each links to the provider’s own status page):

These change by the hour, so treat the table as a snapshot and confirm with your own provider. The useful question for support is specific: “Is the PHP build serving my site patched for CVE-2026-109618 and CVE-2026-109619?” Digidop, citing WordPress.org statistics from 22 October, says 35.8% of WordPress sites run PHP 8.1 or older. That group has the hardest path, because no standard release exists for them.

If you run your own server

Update PHP, then restart every PHP worker. The most common slip, going by how server setups work, is checking only php -v. That reports the command-line binary, which can be a different install from the one your web server loads. Check the web-facing build too (for example php-fpm -v, or your Apache module’s package). PHP also notes that the volunteer-run Remi repository would not have updates on 21 October, and urges RPM users to switch to distribution packages or build from source.

If you are on PHP 8.1 or older

You have three routes: a vendor backport, PHP’s source patches for 7.4, 8.0 and 8.1, or an upgrade to a supported branch. Upgrading is the cleanest, but pick the destination with care. PHP 8.2 gets this fix and then loses security support on 31 December 2026, so moving to 8.3 or newer avoids a second emergency within weeks.

If you cannot update today

No setting makes a server safe. PHP’s advisory says its stopgaps reduce exposure to specific attack paths only. If you must wait, these are the measures PHP lists:

• For CVE-2026-109618: set memory_limit=-1 in a way applications cannot override (such as php_admin_value in the FPM pool), and set a low post_max_size (8M if you don’t need uploads, 32M if you do). PHP also suggests container or cgroup limits as an availability boundary and warns against RLIMIT_AS and RLIMIT_DATA, which can trigger the very failure you want to avoid.
• For CVE-2026-109619: set session.upload_progress.enabled=0 in php.ini or server-level configuration and restart every worker. On PHP 8.5, also set fatal_error_backtraces=0.

Two catches matter on shared hosting. PHP says not to rely on ini_set() or FPM’s .user.ini for the session setting, because they apply too late. And an unlimited memory_limit means a runaway script can eat the server’s memory, which is our reading of why PHP pairs it with cgroup limits. A web application firewall can add a layer, but Cloudflare’s rules were described as a stopgap, not a cure.

Is PHP2Shell being exploited?

Attempts are confirmed; how many would succeed against real servers is disputed. The sources disagree in ways worth keeping apart:

• Reported attempts: Amazon logged an attempt on 17 October. watchTowr says it observed exploitation through its honeypots. Cloudflare reported early signs and added emergency firewall rules.
• Reported limits: CISA said it had not observed exploitation as of its alert. The PHP Foundation’s executive director, Elizabeth Barron, told CNBC there was no evidence of working exploits, only incomplete or non-working ones. Researcher Elias Taylor argues exploitation is far harder than the Log4Shell flaw of 2021, though he still advises patching.
• The NSA’s view: it expects attackers to weaponize the flaws.

Our reading, not a sourced fact: a failed public exploit script is no reason to wait, because the window between a leak and a working exploit is the period defenders can least afford. Every vendor quoted here still says to update.

Why governments pulled sites offline

Officials treated unpatched PHP as a reason to go dark rather than risk it. The NSA advised that if an update is not feasible, systems should come offline until they can be fully mitigated. Reports name the Netherlands, Finland, France, Germany, Belgium, Denmark and Australia among governments that took services down temporarily. German officials described it as purely precautionary, and no government has reported a breach, according to coverage compiled by eBuilder Security. The exact number of sites taken offline worldwide is unconfirmed.

After patching: a verification checklist

1. Confirm the version that serves web traffic. Compare it with the fixed release for your branch above.
2. Restart workers. An updated package on disk does not help while old processes keep running.
3. Check vendor trackers if you use distribution packages. Distributions often backport fixes without changing the upstream version number, so look for the two CVE IDs in your vendor’s security notes (general practice, not from the advisory).
4. Review logs back to 17 October. Amazon advised investigating from that date. Look for memory-exhaustion fatal errors, PHP workers launching shells, and unfamiliar files in web directories.
5. Rotate secrets if anything looks off. Database passwords and API keys stored on the server are the usual next target (our recommendation).
6. Schedule the move off 8.2 if that is your branch.

For wider hardening, see our WordPress security checklist and website security basics.

Other PHP news worth knowing

• PHP 8.2 reaches end of life on 31 December 2026, per php.net. Plan your upgrade now.
• PHP 8.6.0 is in release-candidate testing. RC3 appeared on 8 October with RC4 planned for 22 October; PHP says not to use it in production. A final release date is not confirmed.
• The Foundation has admitted delay. According to a summary on DEV Community of the PHP Foundation’s post-mortem, a related memory problem first surfaced in a 2024 audit and a fix stalled on trade-offs. Read the Foundation’s own post for its wording.

More coverage lives in our cybersecurity news and technology news sections.

FAQ

What is PHP2Shell?
It is the nickname for two critical remote-code-execution flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. An attacker can run code on an affected web server without logging in, according to the PHP project.

Does updating WordPress fix it?
No. WordPress runs on top of PHP, and the flaws are in PHP. Your host or server administrator must install the fixed PHP build.

How do I check my PHP version?
Run php -v for the command-line version and php-fpm -v (or check your Apache module) for the web-facing one. On Debian or Ubuntu, dpkg -l | grep php lists installed packages; on RHEL-family systems use rpm -qa | grep php, as Arctic Wolf’s guidance suggests. Shared-hosting users can ask support or use the host’s PHP selector.

Is PHP 8.1 safe to keep running?
Not without a vendor backport or PHP’s source patch. No official 8.1 release exists for these flaws.

Do I need to take my site offline?
The NSA says to do so if you cannot update immediately. For a small site, a host that has patched, or a temporary maintenance page, is the practical equivalent.

Can a firewall replace the update?
No. PHP’s advisory says there are no complete mitigations, and firewall rules are stopgaps.

Was AI used to find the flaws?
Wikipedia’s entry says researcher Ryan Austin used an OpenAI model while finding the bug, and Wiz, OpenAI and Calif jointly disclosed it. How much the models mattered is contested.

Should I stop using PHP?
The flaws are in the runtime, and they are fixed on supported branches. Migrating languages is a far bigger project than patching; most sites only need the update.

Next step: open your host’s status page, or log in and run php-fpm -v, and compare the number with the table above before you do anything else today.

Sources and further reading:PHP.net security advisory · GHSA-w8hw-w9fx-j79w · GHSA-6wmf-4rv5-p3rp · CISA alert · Wiz Research · watchTowr · Wikipedia: PHP2Shell

Janscope Desk. Rules differ by setup; verify with PHP.net and your hosting provider before acting.