PHP2Shell Explained: CVE-2026-109618 and CVE-2026-109619, Affected Versions, Fixes and FAQs

Quick Answer: What Is PHP2Shell?

PHP2Shell is the name given to two critical memory-safety vulnerabilities in core PHP, tracked as CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. PHP fixed both in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. The only complete fix is to upgrade PHP and restart your PHP workers.

• Severity: PHP rates both CVEs 9.2 on CVSS v4.0; NVD lists 9.8 on CVSS 3.1 for each.
• Affected: every PHP release before 8.2.35, 8.3.36, 8.4.27 and 8.5.12, according to PHP’s GitHub advisories.
• Highest risk: Apache with mod_php, where PHP has a demonstrated exploit that triggers before application code runs.
• Do first: check which PHP version your web server actually uses (not just php -v), upgrade to a fixed release, then restart Apache, PHP-FPM and any long-running PHP workers.
• Not a fix: a WAF, expose_php = 0, or partial configuration changes. They reduce exposure but do not remove the flaw.

Facts in this article come from the PHP2Shell research page, Endor Labs and Brandefense, checked on 23 October 2026. Details are still developing, so re-check the sources listed at the end.

What Is PHP2Shell?

PHP2Shell is a family of memory-safety vulnerabilities in the PHP core itself, covering two related classes of bug that are tracked as two CVEs. Because the flaw sits in the PHP runtime and not in a plugin or theme, a site can be affected even when its own application code is secure. The PHP2Shell research page makes this point using a simple “Hello World” app on an affected PHP version.

According to the research page, the work was credited to Wiz Research (Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz), OpenAI Codex Security (Amy Burnett) and Calif (Ryan A.), and the researchers worked with the PHP security team and the Gemini team at Google on discovery, coordination and patch verification. The research page demonstrated pre-authentication remote code execution on WordPress, Drupal and Joomla using the latest container images at the time of testing, and states that exploitation does not require those applications.

In plain terms: PHP2Shell lets an attacker send crafted web requests that push PHP into a corrupted memory state, which can then be turned into code execution as the PHP web worker user.

CVE-2026-109618 and CVE-2026-109619 Explained

PHP2Shell covers two CVEs: CVE-2026-109618 is remote code execution through out-of-memory (OOM) corruption, and CVE-2026-109619 is remote code execution through stale global state. PHP’s changelog lists a single core fix for both, titled “Avoid state corruption via bailout.”

The two scores come from different CVSS versions, so they do not conflict. Source for the table: Brandefense, Endor Labs and the PHP2Shell research page.

Which PHP Versions Are Affected, and Which Are Fixed?

Every PHP release before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 is listed as affected in PHP’s GitHub advisories. The fixed releases came out on 21 October 2026.

PHP 8.1 and older: PHP published no new release for these branches. According to Brandefense, PHP published minimal source backports for 7.4, 8.0 and 8.1 only, and distributions or long-term-support vendors may ship their own backports. If you run an older branch, ask your OS vendor or host whether a confirmed backport is available, and plan an upgrade to a supported branch.

How far back does the bug go? The PHP2Shell research page says affected releases date back to PHP 5.4. Brandefense notes that PHP itself does not confirm how far back older branches are affected, so treat the exact lower bound as unconfirmed. The practical rule is the same either way: if you are not on a fixed release or a vendor-confirmed backport, assume you are exposed.

Distribution packages: Linux distributions often backport security fixes without changing the PHP version number. Endor Labs advises installing either a patched PHP release or a distribution package with a confirmed backported fix, so check your vendor’s advisory instead of relying on the version string alone.

Who Is at Risk from PHP2Shell?

Any PHP installation that serves web requests can be affected, and Apache with mod_php carries the highest risk. Brandefense lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed as affected ways of serving PHP.

The sources are not fully aligned on PHP-FPM, so read this row carefully: one source reports confirmed RCE through application code paths, while another reports that no complete FPM exploit was demonstrated for CVE-2026-109618. Treat FPM as exposed until patched.

As of the sources checked, Check Point reports about 884,000 internet-facing hosts showing PHP 8.1 or older in their banners. These are banner counts and not confirmed vulnerable systems.

PHP2Shell Timeline

PHP released the fixes and the public disclosure followed on 21 October 2026. The dates below are the ones stated in the sources checked; no earlier private-disclosure date was found.

How to Check Whether Your Server Is Exposed

Check the PHP version your web server actually runs, because the command-line PHP can differ from the one serving your site. Brandefense gives this guidance:

1. Verify the version the web server uses, for example with php-fpm -v or by checking the Apache module, and do not rely only on php -v.
2. Compare it against the fixed releases: 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later on the same branch.
3. If you installed PHP from a Linux distribution, check the vendor’s security advisory for a confirmed backport instead of judging by the version number.
4. Check session.upload_progress.enabled in the configuration files your web server actually loads. The default value is 1.
5. Do not assume you are safe because no version shows in HTTP headers. expose_php may reveal the version, but a missing header does not indicate a patched server.

If you run several PHP versions on one machine (for example one per site), repeat the check for every runtime and every pool.

How to Fix PHP2Shell

Upgrade PHP to a fixed release on every runtime, then restart Apache, PHP-FPM and any long-running PHP workers. The PHP2Shell research page calls this “the only complete fix”, and PHP’s own guidance is that updating is the only safe choice.

1. Identify every PHP runtime in use (web servers, containers, CI images, staging and production).
2. Upgrade each to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later on its branch, or install a distribution package with a confirmed backported fix.
3. If you are on PHP 8.1 or older, move to a supported branch, or obtain a vendor-confirmed backport while you plan the upgrade.
4. Restart Apache, PHP-FPM and any long-running PHP workers so the patched code is actually loaded.
5. Confirm the running version again with the web server’s own PHP binary or module.

After patching, the research page recommends reviewing memory_limit alongside request-size limits, keeping post_max_size below the memory budget, and limiting max_input_nesting_level to what the application needs. It also notes that the fix introduces a hard memory limit that terminates the process and prevents shutdown handlers from running, so test any application that relies on shutdown handlers after upgrading. Setting expose_php = 0 is optional and does not remediate PHP2Shell.

Hosting note: if your site runs on managed hosting, ask the provider to confirm in writing which PHP build is running and whether the fix is applied. Do not assume it has been updated for you.

Temporary Mitigations If You Cannot Patch Yet

These steps only reduce exposure and do not fix PHP2Shell. PHP says updating is the only safe choice, and each setting below blocks only the specific path named.

Signs of Compromise and Detection Guidance

The strongest signals reported so far are PHP workers behaving like a shell launcher, plus unusual multipart requests followed by memory errors. Brandefense summarizes guidance from Huntress and Wiz:

• Process behavior (Huntress): PHP workers such as php-fpm, php-cgi, httpd or apache2 spawning shells (sh, bash, cmd.exe, powershell.exe), interpreters (python, perl) or tools (curl, wget, nc, certutil.exe).
• Request and log patterns (Wiz): unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, unusually large or malformed PHPSESSID cookies, and unexplained worker churn.
• Command strings (Huntress): /dev/tcp/, fsockopen, mkfifo, and reconnaissance commands such as whoami, id, uname -a and ipconfig run by the web server user.
• Network indicators: Amazon published six defanged IP addresses from its honeypots (17 and 21 October 2026). Amazon says they include shared anonymization infrastructure and should be investigated, not simply blocked.

If you suspect compromise: isolate the server, preserve web and PHP logs, and check for web shells, new files in the web root, cron jobs, scheduled tasks and new accounts. Brandefense maps this activity to MITRE ATT&CK T1190 (exploit public-facing application) and T1505.003 (web shell).

As of Brandefense’s last update, no confirmed indicators of compromise or Sigma/YARA rules had been published, so patching matters more than waiting for detection signatures.

Is PHP2Shell Being Exploited?

Attack traffic and honeypot attempts have been reported, but no confirmed breaches had been cited in the sources checked. Here is what each party says, as relayed by Brandefense and Endor Labs:

This situation is moving quickly, so check the CISA KEV catalog and your vendor advisories before you quote exploitation status elsewhere.

What PHP2Shell Means for Magento, WordPress and Ecommerce Sites

The vulnerability is in PHP, not in any CMS, so the PHP version running your store matters more than which plugins or extensions you have installed. The PHP2Shell research page demonstrated pre-authentication RCE on WordPress, Drupal and Joomla, and states that exploitation does not require those applications.

None of the sources checked for this article published a Magento-specific advisory. Because Magento, like any PHP application, runs on the PHP runtime, the practical reasoning is the same: if the PHP version behind your storefront is below a fixed release and has no vendor-confirmed backport, treat the server as exposed. This is our reading of the advisories, not a statement from PHP or Adobe. Before upgrading a production store, confirm that your Magento version supports the fixed PHP release on your branch, using the official system requirements for your version, and test on staging first.

A practical checklist for store owners and agencies:

1. List every environment (production, staging, development) and the PHP version each web server runs.
2. Check whether your host or platform has already applied a fixed PHP build, and get that confirmed in writing.
3. Test the upgrade on staging, including checkout, admin, cron jobs and any custom modules.
4. Deploy to production, restart PHP-FPM or Apache, and re-verify the running version.
5. Review web-server and PHP logs from 17 October 2026 onward for the signs listed above.

PHP2Shell FAQ

What is PHP2Shell?

PHP2Shell is the name for two critical memory-safety vulnerabilities in core PHP, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution.

What are the CVE numbers for PHP2Shell?

CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale global state across requests).

How severe is PHP2Shell?

PHP rates both CVEs 9.2 on CVSS v4.0. NVD lists 9.8 on CVSS 3.1 for each, according to Brandefense.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026.

Which PHP versions are vulnerable?

Every release before the four fixed versions is listed as affected in PHP’s GitHub advisories. The research page says affected releases date back to PHP 5.4, but PHP itself does not confirm how far back older branches are affected.

Is PHP 8.1 affected, and will it get a patch?

PHP 8.1 and older are not on the supported list and received no new release. According to Brandefense, PHP published minimal source backports for 7.4, 8.0 and 8.1, and distributions or LTS vendors may ship their own backports.

Do I need to restart anything after upgrading PHP?

Yes. Restart Apache, PHP-FPM and any long-running PHP workers so the patched code is loaded.

Does PHP2Shell affect PHP-FPM or only mod_php?

Apache with mod_php is the highest risk, with a demonstrated exploit that triggers before application code runs. PHP-FPM should still be treated as exposed: sources differ on whether a complete FPM exploit has been shown, but the PHP team says source analysis suggests susceptibility.

Does a WAF protect me from PHP2Shell?

A WAF adds a layer but is not a fix. Cloudflare enabled protection by default from 21 October 2026, and Endor Labs reports attackers are already mutating payloads to evade such rules.

Can I fix PHP2Shell by changing php.ini?

Only partially. Settings such as memory_limit=-1, session.upload_progress.enabled=0 and fatal_error_backtraces=0 (PHP 8.5 only) block specific known paths. PHP says updating is the only safe choice.

Does PHP2Shell affect WordPress, Drupal and Joomla?

The research page demonstrated pre-authentication RCE on all three using the latest container images at the time of testing, and says exploitation does not require those applications.

Is PHP2Shell being exploited in the wild?

Attack traffic and honeypot attempts have been reported by Cloudflare and Amazon. As of 22 October 2026, neither CVE was in CISA’s KEV file and no confirmed breaches had been cited in the sources checked.

How do I tell if my server was compromised?

Look for PHP workers spawning shells or tools such as curl, wget or nc, repeated HTTP 500 errors after unusual multipart requests, and malformed PHPSESSID cookies. If you suspect compromise, isolate the server and preserve the logs.