The PHP2Shell vulnerability is one of the biggest security stories in the IT world this autumn. Disclosed on October 21, 2026, PHP2Shell is a pair of critical, unauthenticated remote code execution (RCE) bugs in PHP itself – not in a framework or plugin. Both are rated CVSS 9.2, and CISA has added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog.

If you run WordPress, Laravel, Drupal or any PHP application, this guide shows you exactly what is affected and how to patch.

What Is PHP2Shell?

PHP2Shell is the name given to two separate memory-safety flaws:

• CVE-2026-109618 – RCE via OOM corruption: running out of memory while PHP parses a multipart/form-data request body corrupts memory that is later used during request cleanup.
• CVE-2026-109619 – RCE via stale global state: request-owned state survives after its memory is freed, so a later request on the same worker can use that stale state. Confirmed paths include session upload progress and, on PHP 8.5, fatal_error_backtraces.

Because the attack happens while PHP parses the request, an attacker does not need valid credentials or a vulnerable application route.

Which PHP Versions Are Affected?

Essentially every PHP installation that serves web requests is affected – PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Researchers say the bug pattern goes back as far as PHP 5.4. Setups using mod_php are considered the highest risk.

Fixed PHP Versions

Branch	Fixed version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35
PHP 7.4 / 8.0 / 8.1	Source backports from the PHP security team

Note: some Linux distributions ship backported fixes while keeping the old version number, so check your distro’s security advisory rather than relying only on php -v.

How to Check Your Servers

Check the PHP version used by the web server (not just the CLI):

# CLI version
php -v

# PHP-FPM version
php-fpm8.3 -v   # adjust to your version

# Debian/Ubuntu: see the installed package changelog for the CVE
apt changelog php8.3-fpm | grep -i -E "109618|109619"

# RHEL/Alma/Rocky
rpm -q --changelog php-fpm | grep -i -E "109618|109619"

You can also create a temporary file that prints the runtime version, load it once, and then delete it immediately:

<?php echo PHP_VERSION; // delete this file after checking!

How to Patch

# Debian / Ubuntu
sudo apt update && sudo apt install --only-upgrade 'php8.*'
sudo systemctl restart php8.3-fpm apache2   # restart workers!

# RHEL / Alma / Rocky
sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm httpd

# Docker – rebuild on a patched base image
docker pull php:8.3-fpm && docker compose build --pull && docker compose up -d

Always restart PHP workers after updating; old FPM workers keep running the vulnerable code until restarted.

Temporary Mitigations (If You Can’t Patch Today)

• Turn off session upload progress in the PHP-FPM configuration (session.upload_progress.enabled = Off). Note that ini_set() and .user.ini do not work for this – change the server-level config.
• Block multipart/form-data requests at the web server or WAF on endpoints that don’t need uploads.
• Cloudflare has published WAF rules for known exploit vectors, available on all plans including Free.
• The UK NCSC advises taking systems offline if they cannot be fixed promptly.

Is PHP2Shell Being Exploited?

On release day, CERT-EU reported proof-of-concept code circulating, and Amazon Threat Intelligence said its honeypots recorded an exploitation attempt on October 17 – four days before public disclosure. Its addition to CISA KEV means federal agencies must patch, and everyone else should treat it as urgent too. Searchlight Cyber has released an open-source php2shell-scanner to help you find vulnerable hosts.

Bonus: New Memory Hard Limit

Fixed builds add a memory_hard_limit_percent ini setting. Workers that exceed the limit exit with code 137, which helps contain out-of-memory abuse.

Conclusion

The PHP2Shell vulnerability affects almost every PHP web server, needs no authentication, and is under active attention from attackers. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your distro’s patched build), restart your workers, and apply the mitigations above for any system you cannot patch today.