What Is the PHP2Shell Vulnerability and Is Your PHP Website Safe?

PHP2Shell is the name for two critical security holes in PHP itself, made public on 21 October 2026, that can let an attacker take over a website's server without logging in. A PHP website is only safe once PHP is updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to a hosting or Linux vendor package carrying the same fix.

This post covers the first hole, CVE-2026-109618, a PHP vulnerability that turns an ordinary out-of-memory error into a way onto the server. The second, CVE-2026-109619, lets leftover data from one visitor's request be reused by the next request on the same PHP worker. The same update fixes both.

If your site runs on WordPress, WooCommerce, Magento, Drupal, Laravel or custom PHP, this applies to you. The fix sits with whoever controls your hosting, not inside your website dashboard. The settings a developer needs are kept to one section you can forward to them.

Why PHP2Shell matters for your business

PHP's security advisory for CVE-2026-109618 rates it critical, with a CVSS v4.0 score of 9.2 out of 10, and attackers were probing for it before the public knew it existed. The first recorded attempt came on 17 October 2026, four days before PHP published the fix on 21 October.

Amazon's threat intelligence team spotted that attempt on its honeypot network, and Cloudflare saw early attacks before the patch shipped, according to Tenable's PHP2Shell FAQ. Four days is a long head start. Anyone who patched on release day was already patching against something attackers had been testing.

When we checked on 23 October 2026, Tenable's FAQ quoted Amazon as saying PHP2Shell is now being broadly exploited in the wild. Code claiming to exploit it is circulating publicly, though Tenable has not verified that any of it works. Security firm watchTowr also reported attacks reaching its honeypots from 21 October.

This is a PHP remote code execution flaw, so the attacker's commands run on your server with the same access as your website. On an online store, that server holds the customer database, the order history and the payment settings. An attacker who gets in can change pages, plant malware or copy data, and none of it needs a password.

Is your PHP website affected?

Every PHP website that serves web pages is affected until PHP is updated, whatever runs on top of it. That covers WordPress, WooCommerce, Magento, Drupal, Laravel and custom PHP, and every common way of running PHP: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed.

The risk is highest on Apache with mod_php. PHP's 21 October release announcement says a demonstrated exploit there works with a request from someone who isn't logged in, before any of your website's code runs. Your own code can be clean and the site still exposed, because the hole is in PHP rather than in your application.

This is where owners get caught out. Updating WordPress, your theme or your plugins does not update PHP itself. PHP is installed on the server by your hosting company or your developer. A dashboard that says everything is up to date tells you nothing about PHP2Shell.

Picture a small shop on shared hosting that installed every WooCommerce update this month. If its host still runs PHP 8.3.30 under mod_php, that shop sits in the highest-risk group while the WordPress updates screen says nothing is pending.

What causes CVE-2026-109618, in plain words

CVE-2026-109618 is a flaw in how PHP cleans up after a memory error. When PHP runs out of memory part-way through setting up a visitor's request, its clean-up step trusts data that was only half built. An attacker can use that half-built data to run their own code.

Every page load starts with PHP setting up a small workspace for that request: the form fields, the uploaded files and the cookies. PHP also caps how much memory one request may use. A request that hits the cap is abandoned on the spot, and PHP jumps straight to clean-up.

The trouble is timing. If memory runs out while the workspace is still being set up, parts of it hold leftover junk instead of real values. The clean-up step can't tell the difference and treats the junk as real. An attacker who sends a request built to run out of memory at that exact moment gets to shape what the junk contains.

Apache mod_php runs the clean-up even when setup has failed, which is why the advisory lists it as confirmed exploitable. PHP-FPM is rated likely exploitable through attacks tailored to a specific application. FrankenPHP is rated likely exploitable whatever application it runs, and LiteSpeed is on the likely list as well.

How to check your PHP version and patch status

Your site is patched if it runs PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a later release on the same branch, or a vendor package whose changelog lists CVE-2026-109618. Any older release on the 8.2 to 8.5 branches is exposed, and PHP 8.1 or older has no official fixed release at all.

• Hosting control panel. cPanel, Plesk and similar host dashboards show the PHP version set for each site, and this is the quickest check for an owner.
• WordPress Site Health. In the WordPress dashboard, open Tools, then Site Health, then the Info tab, and expand the Server section to see the PHP version.
• A phpinfo page. A developer can upload a one-line file that calls phpinfo() and open it in a browser. Delete it straight after, because it shows your server settings to anyone who finds it.
• The command line. Running php -v on the server shows a version, but the command-line PHP can differ from the PHP serving your website. Confirm with Site Health or phpinfo before you trust it.

Servers that install PHP from Linux distribution packages have one catch: a patched package can keep an older version number. Ubuntu 24.04 shipped its fix for this hole as package 8.3.6-0ubuntu0.24.04.13, which still reports PHP 8.3.6, well below 8.3.36. Check the package changelog for the CVE number, not just the version.

On Debian or Ubuntu, a developer can run zgrep CVE-2026-109618 /usr/share/doc/php8.3*/changelog.Debian.gz, swapping in the PHP branch the server uses. On Red Hat style systems, read the changelog of the installed php package the same way. A match there means the patch is in place.

Precautions until you can update (developer settings)

If PHP can't be updated today, PHP's own interim steps reduce exposure but leave the hole in place. PHP's announcement says plainly that only an update is a complete solution and that these measures "reduce exposure to specific attack paths but do not make an installation safe." Use them for hours or days while the update is arranged.

The attack needs PHP to run out of memory at a moment the attacker controls. These steps take that controllable failure away and stop oversized requests before they reach PHP.

• Set memory_limit to -1 where apps can't override it. Use php_admin_value[memory_limit] = -1 in the PHP-FPM pool, or php_admin_value memory_limit -1 in the Apache configuration, and check that no pool, directory or application setting puts a finite limit back. PHP notes that a lower-level allocation failure can still reach the bug, so this narrows the path without closing it.
• Lower post_max_size. Use 8M for sites that don't accept file uploads and 32M for sites that do, and keep upload_max_filesize below post_max_size.
• Limit requests at the web server or proxy. Cap decoded request size, input field count, multipart part count, header count and nesting depth, including requests without a usable Content-Length header.
• Add a container or cgroup memory limit. With no PHP memory cap, this is what stops one request from taking the whole server down. Prefer a policy that kills only the affected worker. Don't swap in RLIMIT_AS or RLIMIT_DATA, which PHP warns can cause the same allocation failure the attack needs.
• Restart every PHP worker. New settings only reach fresh workers, so restart PHP-FPM, Apache and any long-running PHP process.

A web application firewall helps as a stopgap. Cloudflare deployed rules for the known exploit paths to every customer, free plan included, and AWS offers WAF rules as a temporary measure for its customers. Firewall rules match known attack patterns, so they buy time for the update and do not replace it.

How to fix PHP2Shell, step by step

The fix is a PHP security update, followed by a restart and a look back through your logs. Back up, move to the fixed release for your branch or a patched vendor package, restart every PHP process and confirm the new version. Then check the logs from 17 October for signs that someone got in before you patched.

1. Back up the site files and database, and store the copy off the server so a failed update can be rolled back.
2. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 for your branch, or install your vendor's patched package. On shared hosting, pick the patched version in the control panel or ask your host to confirm in writing that it is applied.
3. Restart Apache, PHP-FPM and long-running workers such as queue workers, so no process keeps running the old PHP.
4. Confirm the new version through Site Health or phpinfo, or through the package changelog on distribution builds.
5. Review memory_limit and post_max_size. A memory_limit of -1 set as a stopgap can go back to the finite limit your site used before, because the patched PHP no longer needs the workaround. Keep post_max_size no larger than the site needs.
6. Check the logs from 17 October onwards for unusual uploads followed by memory errors or HTTP 500 responses, unusually large PHPSESSID cookies and PHP workers restarting with no clear reason.
7. If anything looks wrong, treat the server as hacked: keep a copy of the logs, change every password and key the server touches, and have the server checked before you trust it again.

For the developer reading the logs, Datadog's PHP2Shell detection notes point to two more signals. One is an "Allowed memory size ... exhausted" error reported at "Unknown on line 0", which means PHP failed before any script started. The other is a run of segmentation faults in the Apache error log. Any shell process launched by a web worker deserves a close look, more so when it lines up with those errors.

Passwords and keys means all of them: hosting and control panel logins, database users, WordPress or store admin accounts, SSH keys, API keys and payment gateway keys. A clean PHP update doesn't remove anything an attacker already left behind on the server.

What if your site runs PHP 8.1 or older?

PHP 8.1 and older get no official fixed release for PHP2Shell. For 7.4, 8.0 and 8.1, PHP published minimal source backports, and Linux distributions and LTS vendors ship their own patched packages, but those are a bridge. PHP 8.2 also reaches end of life on 31 December 2026, so the lasting answer is a supported branch.

The source backports are meant for people who build PHP from source or have no LTS vendor. Few business owners build PHP themselves. The practical route is to ask your hosting provider or LTS vendor whether their package for your version includes the CVE-2026-109618 fix. Ubuntu, for one, has shipped fixed packages for PHP 8.1 on 22.04 and, through its extended security maintenance, PHP 7.4 on 20.04.

A site moved to 8.2.35 this week has about ten weeks of official security fixes left. After 31 December 2026, PHP 8.2 gets no further security fixes, and the next hole on that branch will have no official patch. Plan the move to 8.3 or newer now and test it on a staging copy first. Any old plugin or custom code that breaks can then be fixed calmly, rather than in a hurry during the next incident.

How Techno Mantraa fixes PHP2Shell within 12 hours

Within 12 hours of getting hosting or server access, the Techno Mantraa team resolves this PHP vulnerability on your website. The work follows the steps in this post, in this order:

1. Check your PHP version and how PHP is installed, whether that is mod_php, PHP-FPM, a distribution package or a control panel build.
2. Apply the fixed PHP release, or the patched package from your vendor.
3. Add the interim hardening where it is still needed, for example on an old PHP branch that is waiting for an upgrade.
4. Restart every PHP worker.
5. Test the site, including forms, logins and checkout.
6. Review the logs for signs of attack since 17 October.
7. Send you a short report of what changed.

Nobody can honestly promise that a website will never be hacked, and this work makes no such promise. It closes PHP2Shell on your server and tells you what the logs show about attempts made before the fix went in. If you are not sure which PHP version is on your server, that is not an issue, because finding out is the first step.

To get it done, contact the Techno Mantraa team and tell us where your website is hosted.

Need help moving off old PHP?

If your site runs PHP 8.1 or older, it cannot get the PHP2Shell fix. We upgrade it to a patched PHP 8.4 in 7 days: PHP 5.6, PHP 7.0, 7.1, 7.2, 7.3, 7.4, 8.0 and 8.1 to PHP 8.4. On PHP 8.2 or 8.3, patch now and plan the PHP 8.2 or PHP 8.3 to 8.4 upgrade.

Rather leave old PHP code behind? See our PHP to Laravel, PHP to Node.js and PHP to Python migrations, or move an online store with PHP to Shopify.