Security alerts · October 28, 2026

PHP2Shell: two critical PHP flaws let attackers take over web servers without logging in

Two flaws in the PHP core let an attacker on the internet run their own code on a server without logging in. They are already being exploited. The only reliable protection is updating PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 and restarting every PHP process.

What happened

PHP is the programming language behind most websites, including WordPress, Drupal, online shops and many business applications. Two critical flaws were found in its core, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both can allow an attacker on the internet to run their own code on the server without logging in.

The PHP team released fixes on October 21, 2026 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Technical details became public before the fixes were ready, and proof of concept code started circulating soon after. A researcher confirmed successful attacks against honeypot servers on October 24, 2026, and the US agency CISA added both flaws to its catalog of actively exploited vulnerabilities on October 26, 2026.

CERT-EU has issued a warning as well. Palo Alto Networks reports active attacks against the management interface of PAN-OS firewalls, which uses PHP internally.

Why it is dangerous

Both flaws belong to the “use after free” family. Imagine a hotel where a guest checks out, the room is cleaned and given to someone else, but the old entry stays in the front desk book. Anyone who later relies on that entry walks into a stranger’s room. In PHP, a reference is left pointing to memory that an attacker may by then control.

With CVE-2026-109618, PHP forcibly aborts a request that runs out of its memory limit. If that happens at the wrong moment, for example while processing a form with a file upload, it leaves behind partially prepared memory that PHP then treats as valid during cleanup. With CVE-2026-109619, internal PHP records keep pointing into freed memory after an interrupted request, and the next request handled by the same process uses them.

The attacker does not need to log in. Sending crafted requests over the internet is enough. With Apache and mod_php, the PHP team says this works before any application code runs, so it does not matter which website the server hosts. The attacker gains control of the server with the rights of the web server account: they can read databases and configuration files with passwords, change website content or move further into your network.

The CVSS score rates severity on a scale from 0 to 10. The NVD database lists 9.8 for CVE-2026-109618 and 8.1 for CVE-2026-109619, while the vendor rates both at 9.2 under CVSS 4.0. The CISA KEV catalog only lists flaws that attackers are proven to exploit. EPSS estimates the likelihood of exploitation in the coming days, and for both flaws it sits at the very top of the scale.

Who is affected

  • PHP 8.2 before 8.2.35, PHP 8.3 before 8.3.36, PHP 8.4 before 8.4.27 and PHP 8.5 before 8.5.12
  • unsupported branches PHP 8.1 and older, which no longer receive fixes from the PHP project
  • appliances and products that use PHP in their management interface

Every PHP installation that serves web requests is at risk: Apache with mod_php (the highest risk setup according to the PHP team), PHP-FPM behind nginx or Apache, php-cgi, FrankenPHP and LiteSpeed. Typical places are web hosting, company websites and online shops, intranet applications and services running in Docker containers.

PHP also hides inside appliances. On PAN-OS (PA-Series and VM-Series firewalls and Panorama) only the management web interface is affected, GlobalProtect is not. Cisco lists Expressway, Duo Access Gateway and Ultra-Reliable Wireless Backhaul as affected. Other vendors such as Citrix, QNAP, Synology and Veeam have published their own advisories. Note that updating WordPress, a plugin or a framework is not enough. PHP itself must be updated.

How to check if you are affected

On shared hosting, you will find the PHP version in the hosting control panel under website settings, or ask your provider whether they have deployed patched PHP. On your own server, use the following commands. They only read information and change nothing.

php -v
dpkg -l | grep -i php
rpm -qa | grep -i php
apachectl -M | grep -i php
docker exec <container> php -v

The command line version can differ from the one your website uses. Linux distributions also often ship the fix without changing the version number, so for distribution packages compare the package version with the security notice of your distribution. For appliances (PAN-OS, Cisco and others), check the firmware version in their admin interface and compare it with the vendor advisory.

How to fix it

Updating is the only reliable fix. Work in this order:

  • Start with servers and management interfaces reachable from the internet, then move on to internal systems.
  • Update PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or a later version in the same branch. Linux distributions received the fixes in advance, so use their packages. The volunteer run remirepo repository did not have the fixes on release day.
  • Restart every PHP process (PHP-FPM, Apache with mod_php). Rebuild containers from a patched base image, a plain restart is not enough.
  • Verify the version using the steps in the previous section.
  • On shared hosting, get confirmation of the fix from your provider.
  • For appliances, install the vendor fixes and allow access to the management interface only from trusted internal addresses.
  • Move old PHP branches to a supported version or use a backport from your distribution. The PHP team also published source patches for PHP 7.4, 8.0 and 8.1.

If you cannot update right away, temporary measures reduce the risk but do not fully protect you. Set the following values in php.ini or the FPM pool configuration and restart every worker (setting them via ini_set() or .user.ini does not work):

session.upload_progress.enabled = 0
fatal_error_backtraces = 0

The second line applies to PHP 8.5 only. Also lower post_max_size (8M without file uploads, 32M with uploads) and, if the site does not need file upload forms, block multipart/form-data requests at the proxy. If a system cannot be fixed quickly, take it off the internet.

On October 23, 2026 the PHP team disclosed another flaw, CVE-2026-115560, which only affects unusually configured applications. There will be no emergency release, and session.upload_progress.enabled=0 protects against it until the next regular release.

What if you may already be compromised

If a server ran a vulnerable version and was reachable from the internet, assume an attack is possible. Attacker code runs under the web server account. Look especially for the following:

  • unusual processes started by PHP or web server services, such as a shell or unknown programs
  • repeated crashes of PHP or the web server in error logs
  • a high number of large form and file upload requests in access logs
  • new or modified PHP files in the web directory and unknown accounts in the website admin
ps -ef --forest | grep -E -A5 'php-fpm|apache2|httpd'
grep -iE 'segfault|SIGSEGV' /var/log/apache2/error.log
find /var/www -type f -name '*.php' -mtime -14 -ls

Updating alone will not remove an attacker from the server. If you find signs of an attack, disconnect the server from the network, save the logs elsewhere and call in an incident response specialist. Change the database passwords and keys that were stored on the server.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.

← All alerts · RSS

Need help patching or checking your systems?

I can help you find out which systems are affected, update them safely and check whether an attacker already got in. Let us start with an initial consultation, which is deducted from the project price if we work together.

See pricing [email protected]