What Is the PHP2Shell Vulnerability and Is Your PHP Website Safe?

The PHP2Shell vulnerability is a pair of critical flaws inside PHP itself that let an attacker run code on a web server without logging in. PHP made them public on October 21, 2026. Your site is safe from it once PHP runs 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor package with the same fix.

This applies to sites on WordPress, WooCommerce, Magento, Drupal, Laravel or custom PHP code. The fix sits with whoever controls your hosting, so nothing in your website dashboard can apply it. One section below holds the developer settings, so you can forward it as is.

On this page

• What is the PHP2Shell vulnerability?
• Is PHP2Shell being exploited?
• Is my PHP website safe?
• How the PHP vulnerability works, in plain words
• Which PHP security update fixes your branch?
• How to check your PHP version and patch status
• How to patch PHP against PHP2Shell
• What to do if you can't update PHP today
• What if your site runs PHP 8.1 or older?
• What to do about the PHP2Shell vulnerability this week

What is the PHP2Shell vulnerability?

PHP2Shell covers two bugs in the PHP engine, tracked as CVE-2026-109618 and CVE-2026-109619. PHP's security advisory for the first bug rates it critical, with a CVSS v4.0 score of 9.2 out of 10. PHP gives the second bug the same 9.2 score, Tenable notes.

The first bug lives in the way PHP handles running out of memory. Bug two leaves data from one visitor's request behind after PHP frees the memory under it, so the next request on the same PHP worker can pick it up.

Each bug can end in PHP remote code execution, which means the attacker's commands run on your server with the same access as your website. On an online store, that server holds the customer database and the payment settings. The attacker needs no password to change pages, plant malware or copy data.

One update closes both holes. PHP shipped fixed releases for all four supported branches on the day it went public, and its announcement asks every PHP user to update right away.

Is PHP2Shell being exploited?

Yes, and attackers were testing the PHP2Shell vulnerability before the public knew it existed. Amazon Threat Intelligence saw an attempt on its MadPot honeypot network on October 17, 2026, four days before the fix. So your log review starts on October 17, not October 21. Tenable's PHP2Shell FAQ adds that Amazon doesn't know how that attacker got the details.

The release itself came a day early. Ubuntu's PHP2Shell post says disclosure moved from October 22 to October 21 after a public leak. Cloudflare CTO Dane Knecht reported "early attacks emerging" that same day. By October 23, Tenable's FAQ quoted Amazon describing broad exploitation in the wild.

Code that claims to exploit the bugs is circulating, but Tenable hasn't verified that any of it works. Security firm watchTowr says it has reproduced both bugs and sees attempts against each. CISA put out an alert on October 21 urging immediate patching. Researcher Silas Cutler puts the count of internet-facing hosts that may be vulnerable at more than 1.3 million.

For the timeline, see how hackers got a four-day head start on PHP2Shell. For the traffic side, read about Cloudflare blocking millions of PHP exploit attempts.

Is my PHP website safe?

Not until someone updates PHP itself. The PHP2Shell vulnerability affects every PHP installation that serves web pages, whatever runs on top of it. PHP's October 21 release announcement names PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

The risk is highest on Apache with mod_php. PHP says a demonstrated exploit there works without any login, before any of your site's code runs. Clean application code won't save you, because the hole is in PHP.

This is where owners get tripped up. Updating WordPress, your theme or your plugins doesn't touch PHP, because your hosting company or your developer installs PHP on the server. A dashboard that says everything is up to date tells you nothing about this bug.

Take a small shop on shared hosting that installed every WooCommerce update this month. If its host still runs PHP 8.3.30 under mod_php, that shop sits in the highest-risk group while its WordPress updates screen shows nothing pending.

How the PHP vulnerability works, in plain words

Every page load starts with PHP building a small workspace for the request: form fields, uploaded files and cookies. PHP also caps how much memory one request may use. When a request hits the cap, PHP drops it on the spot and jumps to clean-up.

The trouble is timing. If memory runs out while that workspace is half built, parts of it hold leftover junk instead of real values. The clean-up step can't tell the difference. An attacker can time a request to run out of memory at that exact moment, then shape the junk, and through it, what the server runs.

The second bug abuses session upload progress, a feature PHP turns on by default to track uploads. Datadog Security Labs says it runs even when the site never starts a session. After a fatal error, it can leave state behind for a later upload to read.

PHP's advisory confirms full remote code execution over HTTP against Apache mod_php with default settings. It calls PHP-FPM susceptible on source analysis, though nobody has shown a complete FPM exploit. FrankenPHP is likely open to attacks that work against any application. LiteSpeed's LSAPI is likely exploitable through attacks built for one specific app.

Which PHP security update fixes your branch?

The PHP security update you need depends on your branch, which is the first two numbers of your PHP version. A site on 8.3.30 needs 8.3.36 or later. It doesn't have to jump to PHP 8.4 the same day.

The support dates come from PHP's supported versions page. Each upgrade link above leads to a fixed-price service for that exact starting version.

How to check your PHP version and patch status

A fixed release, any later one on the same branch, or a vendor package listing the fix all count. Four places show the version:

• Your hosting control panel is the fastest check for an owner. Plesk, cPanel and similar dashboards show the PHP version for each site.
• In WordPress, open Tools, then Site Health, then the Info tab, and expand the Server section.
• A one-line file that calls phpinfo(), uploaded by a developer and opened in a browser. Delete it right after, because it shows your server settings to anyone who finds it.
• Running php -v on the server prints a version. But command-line PHP can differ from the PHP serving your site, so confirm with one of the checks above.

Servers that install PHP from Linux packages have a catch. Vendors can backport the fix without changing the version number. Ubuntu 24.04 ships it as package 8.3.6-0ubuntu0.24.04.13, which still reports PHP 8.3.6, well below 8.3.36.

On Ubuntu, run apt list '?installed ?name(^php[0-9.]+$)' and compare the output with Ubuntu's list of fixed PHP packages. On other distributions, check your vendor's advisory for the two CVE numbers and the fixed package version.

How to patch PHP against PHP2Shell

To patch PHP, move to the fixed release for your branch, restart every PHP process and confirm the new version. Then review the logs, because attackers were active before the patch existed. For panel-by-panel and command-line steps, see the guide on how to update your PHP version.

1. Back up the site files and database, and keep the copy off the server for a rollback.
2. Update PHP. On shared hosting, pick the patched version in the control panel. Or ask your host to confirm the fix in writing.
3. Restart Apache, PHP-FPM and long-running workers such as queue workers, so no process keeps the old PHP in memory. If the site has to go offline, return a 503 status code during the patch downtime.
4. Confirm the version through Site Health, phpinfo or the package list.
5. If you set memory_limit to -1 as a stopgap, put back the finite limit your site used before. Patched PHP doesn't need the workaround.
6. Check the logs from October 17 onward for the signs below.
7. If anything looks wrong, treat the server as hacked. Keep a copy of the logs and rotate every secret the server holds, from hosting and database logins to SSH, API and payment gateway keys. Then have the server checked before you trust it again.

For the developer reading the logs, Datadog's PHP2Shell detection notes describe the signals. The main one is an "Allowed memory size ... exhausted" error at "Unknown on line 0". That location means PHP failed before any script started.

A full attack may leave only two to four of those errors and then go quiet. Apache segmentation faults and session cookies with oddly long values point the same way. A shell launched by a web worker is the most direct evidence of a break-in.

What to do if you can't update PHP today

Use PHP's interim steps for hours or days while you arrange the update. They narrow the PHP2Shell vulnerability without closing it. PHP's announcement says they "reduce exposure to specific attack paths but do not make an installation safe."

• Set memory_limit to -1 where apps can't override it, such as php_admin_value in the PHP-FPM pool or Apache config. Check that no pool, directory or app setting puts a finite limit back. PHP notes that a lower-level allocation failure can still reach the bug.
• Lower post_max_size to 8M on sites without file uploads, or 32M on sites with them. Keep upload_max_filesize below it.
• Turn off session upload progress with session.upload_progress.enabled=0 in php.ini or the FPM pool. PHP warns against relying on ini_set() or .user.ini files for this one.
• At the web server or proxy, cap decoded request size, input field count, multipart part count, header count and nesting depth. The caps must cover requests without a usable Content-Length header too.
• Add a container or cgroup memory limit, ideally one that kills only the affected worker. Don't swap in RLIMIT_AS or RLIMIT_DATA, because they can cause the same allocation failure the attack needs.
• Restart every PHP worker, since new settings only reach fresh ones.

A web application firewall buys more time. Cloudflare deployed rules for the known exploit paths to every customer, free plan included, but they only cover traffic that passes through Cloudflare. AWS keeps updating its AWS WAF PHP managed rule group, and its security bulletin calls patching "the only complete fix."

What if your site runs PHP 8.1 or older?

PHP 8.1 and older get no official fixed release. The PHP security team published minimal source backports for 7.4, 8.0 and 8.1. They target people who build PHP from source or have no LTS vendor. Few business owners build PHP themselves, so the practical route is a vendor package.

Ask your host or LTS vendor whether their package for your version includes the fix for the PHP2Shell vulnerability. Ubuntu, for one, has fixed packages for PHP 8.1 on 22.04. Through Ubuntu Pro, it also covers PHP 7.4 on 20.04, 7.2 on 18.04 and 7.0 on 16.04.

A patched old branch is a bridge. The PHP project says 8.1 and older no longer get its updates, and it made these backports only because the bugs are so severe. PHP 8.4 gets security fixes until December 31, 2028, so it's a sound target for a move this year.

Test the upgrade on a staging copy first. Then any old plugin or custom code that breaks gets fixed on your schedule, before the next incident forces the move.

What to do about the PHP2Shell vulnerability this week

Start with one message to whoever runs your hosting. Ask three things in writing: which PHP version serves your site, whether it has the fixed release or patched package, and when they last restarted PHP. Treat a vague answer to the second question as a no.

If the answer shows PHP 8.2 or older, book the branch upgrade now. PHP 8.2 joins the unsupported branches on December 31, 2026. Put the staging test and the log review in the same plan.

Inquiries get an answer within one business day, with an NDA on request. To hand the whole job over, send your hosting details to the Techno Mantra PHP upgrade team.