PHP SECURITY VULNERABILITY · PHP2SHELL · GUIDE

PHP2Shell: is your PHP site patched?

Only if it runs PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a later version on the same line. On October 21, 2026, PHP released security fixes for two critical flaws, together called PHP2Shell. Any lower version on those lines is not patched, unless your host or Linux distribution ships a backported fix. PHP 8.1 or older needs a patched package from your host or a support vendor, or an upgrade to a supported line. This page explains what happened, how to check your site in a few minutes, and what to do if you cannot do it yourself.

WHAT HAPPENED

Two critical flaws in PHP itself.

PHP gave advance notice on October 20, 2026, and released the fixes on October 21, 2026. The two flaws are CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 on CVSS v4.0, the standard severity score. Both can allow unauthenticated remote code execution: a stranger, without logging in, can run their own code on a server where PHP answers web requests.

THE NAMES

CVE-2026-109618 and CVE-2026-109619.

A CVE (Common Vulnerabilities and Exposures) number is the public ID for one security flaw. Use both numbers when you ask your host or read a changelog, so there is no doubt which fix you mean.

WHO IS AT RISK

Any PHP install that serves web pages.

The PHP project names every installation serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. If your site runs on PHP and serves pages to visitors, it is on this list until it is patched. PHP rates the risk highest for Apache with mod_php.

FIXED VERSIONS

Find your line. Be at or above the fix.

PHP 8.2 security support ends December 31, 2026, so a site on 8.2 needs the fix now and a move to a newer line before the year ends.

PATCHED WHEN AT OR ABOVE

PHP 8.58.5.12
PHP 8.48.4.27
PHP 8.38.3.36
PHP 8.28.2.35

OLDER THAN 8.2

No release from the PHP project.

PHP 8.1 and older no longer receive updates from the PHP project. A hosting provider or an extended-support vendor may supply a patched package. Trust that package only when its changelog names both CVE-2026-109618 and CVE-2026-109619.

HOW TO CHECK YOUR SITE

Four steps, a few minutes.

You do not need to read code. You need your PHP version and the list above.

Find your PHP version

Ask your hosting provider which PHP version your site runs, or look for the PHP version setting in your hosting control panel. If you have access to the server, a phpinfo() page shows the version that serves your site (the command php -v shows the command-line version, which can differ). Remove any phpinfo() page when you are done, because it shows details about your server to anyone who opens it.

Compare it to the fixed versions

Read the first two numbers of your version, then the last. A site on 8.4 needs 8.4.27 or later. A site on 8.3 needs 8.3.36 or later. Anything lower on the same line is not patched, unless your host or Linux distribution ships a backported fix: check that its changelog names CVE-2026-109618 and CVE-2026-109619.

Update, then restart PHP

Install the fixed version, or ask your host to. Then restart the PHP workers (PHP-FPM, or Apache if PHP runs inside it) so the fixed code is the code that is running. An update that is installed but not restarted still runs the old code.

Check again

Look at the version once more after the restart. It should show the fixed version or later for your line. If your host or distribution backported the fix instead, confirm the updated package is the one running and that its changelog names CVE-2026-109618 and CVE-2026-109619. Until PHP's next regular release, PHP also suggests setting session.upload_progress.enabled=0 in php.ini (or your PHP-FPM pool settings) and restarting PHP again, to close one unlikely remaining path.

IF YOU CANNOT DO THIS YOURSELF

Site Shield does it for $100 a year per site.

Site Shield covers the update and an annual security review of your site. Moving to a newer PHP line is project work, quoted in advance. A real person sets you up on a short call, and nothing is touched until you grant access. We have not looked at your site: this page is general guidance about a public PHP flaw.

Get Site Shield See what Site Shield covers →

SOURCES

Read it from the source.

Every fact about PHP2Shell on this page comes from these public notices.