PHP2Shell (CVE-2026-109618 & CVE-2026-109619): How to Check and Patch Your PHP Server

On 21 October 2026 the PHP project shipped emergency releases for two critical vulnerabilities in PHP itself, nicknamed PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both let an attacker who has no account, no password and no API key run code on a server that uses a vulnerable PHP version. Attacks started within days. Because the bugs are in PHP's core runtime rather than in a plugin, they put a huge share of the web at risk, including WordPress, Drupal, Joomla, Laravel and custom PHP sites.

This guide explains what PHP2Shell is in plain language, how to check whether your server is affected, and exactly how to patch it on Ubuntu/Debian, Docker, cPanel and shared hosting.

PHP2Shell at a glance

What actually goes wrong

You don't need to understand memory bugs to protect yourself, but a rough picture helps when you read the news:

• CVE-2026-109618: a specially shaped request makes PHP run out of memory part-way through setting up internal data. When PHP cleans up the request, it treats that half-built data as valid. An attacker who controls that data can turn the crash into code execution.
• CVE-2026-109619: some per-request state isn't reset properly after its memory is freed. A later request on the same PHP worker can reuse it. One confirmed route goes through PHP's session upload progress feature, which is turned on by default.

The important detail is where this happens: inside PHP's request handling, before your WordPress or Laravel code even starts. That's why a perfectly maintained application can still be exposed, and why web application firewalls and plugin updates alone aren't enough.

Which setups are at risk?

The PHP advisory lists PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, plus products and appliances that bundle PHP. Researchers rate Apache with mod_php as the highest risk, because a single unauthenticated request can trigger the bug.

Step 1: Check your PHP version

On a server you control, check the command-line version first:

php -v
# PHP 8.3.36 (cli) (built: Oct 21 2026 ...)  <- patched
# PHP 8.3.30 (cli) ...                          <- vulnerable

The website may use a different PHP than the command line (common with PHP-FPM pools, cPanel MultiPHP and Plesk). To see what the web server really runs, create a temporary file in your web root:

<?php
// version-check.php  (delete this file right after checking!)
echo PHP_VERSION . ' / ' . PHP_SAPI;

Open https://your-site.com/version-check.php, note the result, then delete the file.

Is my version safe?

Step 2: Update PHP

Ubuntu and Debian

# see which PHP packages are installed
apt list --installed 2>/dev/null | grep -E '^php[0-9.]+-'

# install all available updates (includes PHP security updates)
sudo apt update
sudo apt full-upgrade

# confirm the fix is in your package (replace 8.3 with your version)
apt changelog php8.3-common 2>/dev/null | grep -E 'CVE-2026-10961[89]'

# restart PHP so the new version is actually used
sudo systemctl restart php8.3-fpm     # PHP-FPM
sudo systemctl restart apache2        # Apache with mod_php

If you use the popular ppa:ondrej/php repository, the same apt commands pull the new 8.x releases.

Docker

Official PHP images were rebuilt with the fixed versions. Pin a fixed tag in your Dockerfile and rebuild:

FROM php:8.4.27-fpm
# or: FROM php:8.3.36-apache

docker compose build --pull
docker compose up -d
docker compose exec app php -v

cPanel / WHM

• Run system updates (WHM > Update Server Software, or dnf update 'ea-php*' as root) so the ea-php packages are patched.
• Check MultiPHP Manager and move any site still on PHP 8.1 or older to a supported version.

Shared hosting

You can't patch PHP yourself, so check the PHP version in your hosting panel and contact your host if it's below the safe versions above. Ask them directly: "Have you patched CVE-2026-109618 and CVE-2026-109619 on my server?" Use the opportunity to switch to the newest PHP version your site supports.

Step 3: Temporary mitigations (only if you can't update today)

The PHP project describes settings that block the known attack paths for CVE-2026-109619. They are a stopgap, not a fix. Some researchers warn that configuration changes alone shouldn't be relied on.

; php.ini or your PHP-FPM pool config
session.upload_progress.enabled = 0

; PHP 8.5 only:
fatal_error_backtraces = 0

Also keep request sizes tight (low post_max_size and upload_max_filesize, plus request size limits in Nginx/Apache). Then reload PHP-FPM or Apache. Turning off upload progress only affects upload progress bars that rely on PHP sessions, which few sites use.

A third, related bug: CVE-2026-115560

On 23 October PHP published an informational advisory about another session upload progress issue, CVE-2026-115560. It only affects applications that change session.serialize_handler at runtime with ini_set() before session_start(), which is unusual. As of 11 November 2026 no fixed release has shipped. PHP's advice is to set session.upload_progress.enabled=0 until the next bugfix release.

Step 4: Check whether you were already attacked

Attacks began right after disclosure, so a server patched late may already have been probed or compromised. Before changing anything, back up your logs, then look for:

# scanners that announce themselves (proves scanning, not compromise)
sudo zgrep -h 'php2shell-scan' /var/log/nginx/access.log* /var/log/apache2/access.log* 2>/dev/null | head

# requests abusing the session upload progress field
sudo zgrep -h 'PHP_SESSION_UPLOAD_PROGRESS' /var/log/nginx/access.log* 2>/dev/null | head

# PHP workers hitting the memory limit or crashing
sudo grep -hiE 'Allowed memory size|SIGSEGV|exited on signal' /var/log/php*-fpm.log /var/log/apache2/error.log 2>/dev/null | tail

# PHP files changed since mid-October in your web root
sudo find /var/www -name '*.php' -newermt '2026-10-15' -ls

Also check for unexpected cron jobs (crontab -l for each user), new admin accounts, and outbound connections from PHP processes. If you find signs of compromise, follow our guide: how to check if your PHP or WordPress site was hacked.

FAQ

I use WordPress. Is a plugin update enough?

No. PHP2Shell is in PHP, not WordPress. Updating WordPress and plugins is still good practice, but only a PHP update fixes this.

My site is behind Cloudflare. Am I safe?

Cloudflare deployed WAF rules for known PHP2Shell patterns, which lowers risk, but attackers vary their requests. Treat a WAF as an extra layer and still update PHP.

How did this happen in such a mature project?

Both bugs are subtle memory-safety issues deep in request handling. According to public reports, they were found in 2026 by security researchers using AI-assisted code analysis, a sign that more bugs like this will be found in older code bases. Keeping runtimes updated quickly matters more than ever.

Sources: PHP project security release and advisories (21 and 23 Oct 2026), watchTowr, Arctic Wolf and Qualys research. Details may change as the investigation continues; we'll update this post.