PHP2Shell Vulnerability: How to Fix Critical PHP Bugs (2026)

If you run anything on PHP — a WordPress site, a Laravel app, a college project on a VPS or a client site on shared hosting — this is the week to stop and update. On 21 October 2026 the PHP team pushed an emergency security release for two critical bugs that security researchers have nicknamed PHP2Shell. Both let an attacker run commands on your server with a single HTTP request, without logging in, and attacks have already been seen in the wild.

In this post I'll explain what happened in plain language, which versions are affected, and exactly how to fix it on a VPS, Docker or shared hosting.

What happened (quick timeline)

• 20 Oct 2026 — PHP announces an upcoming security release. Details about the bugs leak on social media before the planned disclosure date.
• 21 Oct 2026 — PHP ships fixed versions in an emergency release. Security firms report exploitation attempts the same day.
• 23 Oct 2026 — A third, lower-risk bug (CVE-2026-115560) is disclosed. PHP says it only affects unusually configured apps and will be fixed in the next regular release.

The bugs were found by researchers at Calif and reported to the PHP team. Some reports say scanning started a few days before the public release.

The two bugs, in simple words

CVE-2026-109618 — memory error during request start-up (CVSS 9.2)

When PHP receives a request, it parses the form data ($_POST, uploads and so on) before your code runs. If PHP runs out of memory during that step, it can leave a half-built internal data structure behind. When PHP cleans up at the end of the request, it trusts that broken structure. An attacker who sends a carefully crafted, very large POST body can make that cleanup step run their command.

CVE-2026-109619 — stale data reused after a fatal error (CVSS 9.2)

PHP workers (like PHP-FPM processes) handle many requests one after another. After certain errors, some internal data that should have been thrown away survives into the next request, even though its memory has already been freed (a "use-after-free"). An attacker can abuse that leftover state to run code. PHP confirmed it can be reached through upload processing, and on PHP 8.5 through fatal-error backtraces.

Why this one is so serious

• No login needed — the attack happens while PHP is reading the request, before your app's login check or any framework code runs.
• Every web setup is in scope — PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP. PHP rates Apache mod_php as the highest risk.
• Huge exposure — Palo Alto Networks counted over 22 million internet-facing instances that may be vulnerable.
• It can be silent — a successful attack may not crash anything or show an error.

Am I affected?

You are affected if your PHP version is lower than the fixed version for your branch:

How to check your PHP version

On the server terminal:

php -v

Careful: the command-line PHP can be a different version from the one serving your website. To see the version your site actually uses, create a temporary file in your web root:

<?php echo PHP_VERSION; ?>

Open it in the browser, note the version, and delete the file right away. On shared hosting you can also see the version in cPanel → Select PHP Version or MultiPHP Manager.

How to fix it

The PHP team is clear: no configuration change fully fixes these bugs — updating is the fix.

1. Ubuntu / Debian VPS

sudo apt update
sudo apt upgrade        # pulls the patched php packages from your distro
php -v                  # confirm the new version

Then restart every PHP process so the old, vulnerable code is no longer in memory:

# PHP-FPM (change 8.3 to your version)
sudo systemctl restart php8.3-fpm

# Apache with mod_php
sudo systemctl restart apache2

# Nginx doesn't run PHP itself, but reload it if you changed config
sudo systemctl reload nginx

Linux distributions received the patches in advance, so check your distro's security notice if apt doesn't show an update yet.

2. CentOS / AlmaLinux / Rocky

sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm httpd

3. Docker

Your containers keep the old PHP until you rebuild them. Pull the latest official image for your branch, rebuild and redeploy:

docker pull php:8.3-fpm
docker compose build --no-cache
docker compose up -d

If you pin exact tags (for example php:8.3.30-fpm), bump them to the fixed version.

4. Shared hosting / cPanel

You usually can't patch PHP yourself. Check in cPanel which version is selected, and if it isn't a fixed release, open a support ticket asking your host to confirm they've applied the October 2026 PHP security update (CVE-2026-109618 and CVE-2026-109619). If you're on PHP 8.1 or older, switch to 8.3 or newer from Select PHP Version after testing your site.

5. WordPress, Laravel and other apps

Updating WordPress plugins or Composer packages does not fix this — the bug is in PHP itself, not in your app. Update the server's PHP as shown above.

Can't update today? Temporary steps

These reduce the risk but don't make you safe. Use them only until you can patch:

• Take risky sites off the public internet or put them behind a firewall / VPN if they don't need to be public.
• In php.ini (or your FPM pool config), set:

  session.upload_progress.enabled = 0
  ; PHP 8.5 only:
  fatal_error_backtraces = 0

  This has to be in the main config — ini_set() and .user.ini don't work for it. Restart all PHP workers afterwards.
• Keep request bodies small: set post_max_size to 8M (or 32M if you need uploads) with upload_max_filesize lower than that, and also limit request size at Nginx/Apache (for example client_max_body_size 8m; in Nginx).
• If you use Cloudflare or another WAF, turn on its managed rules for these CVEs.

How to tell if someone already tried

• Huge POST requests in your access logs, especially form posts several megabytes in size with very long field names.
• "Allowed memory size exhausted … Unknown on line 0" errors in PHP logs that line up with those big requests, or segmentation faults in Apache / PHP-FPM logs.
• Strange processes started by www-data, apache or php-fpm — like sh, bash, curl or wget. This is the strongest sign of a successful attack.
• New unknown PHP files in upload folders, new admin users or new cron jobs.

If you see signs of compromise, patching alone isn't enough: rotate your database and API passwords, check for web shells and backdoors, and restore from a clean backup if needed.

Quick checklist

1. Check the PHP version your website uses (not just php -v).
2. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your vendor's patched package).
3. Restart PHP-FPM / Apache, and rebuild Docker images.
4. Upgrade off PHP 8.1 and older.
5. Scan your logs for the signs above.

It takes about ten minutes on most servers, so do it today. If you manage client sites, check every server, not just your main one.

Sources

• CERT-EU Security Advisory 2026-018
• Datadog Security Labs — PHP2Shell analysis
• watchTowr — PHP2Shell FAQ
• Unit 42 Threat Brief
• CISA alert