# PHP2Shell: Two Critical PHP Vulnerabilities, Risks and Fixes

> PHP2Shell: Learn about vulnerabilities CVE-2026-109618 and CVE-2026-109619, vulnerable PHP versions, and urgent measures to secure your websites and applications.

Web & Cybersecurity

## PHP2Shell: Two Critical PHP Vulnerabilities, Risks and Fixes

Two critical vulnerabilities affect the PHP engine itself. Here are their mechanisms, the vulnerable versions, the systems at risk, and the steps to take to fix and check your applications.

![PHP2Shell-Runtime-Under-Attack.webp](https://sdx-development.com/media/News/PHP2Shell-Runtime-Under-Attack.webp?v=1792605446)

[Web & Cybersecurity](https://sdx-development.com/en/news/web-cybersecurity)Published on 21 October 2026 at 20:00

On October 21, 2026, the PHP security team released four security updates for two critical engine vulnerabilities: **CVE-2026-109618** and **CVE-2026-109619**, also known as **PHP2Shell**. In some configurations, they may allow an unauthenticated attacker to execute code on a web server.

 

The issue goes beyond any one CMS, framework, or hosting provider: it affects the **server-side PHP engine**. Whether it runs WordPress, Drupal, PrestaShop, Laravel, Symfony, or a custom-built application, any site using a vulnerable version must be assessed and patched. The actual level of exposure depends on the configuration, PHP processes, and network access.

 

The essentials 

## Two critical vulnerabilities, one priority fix

 

**9.2/10 (CVSS v4.0)** for each vulnerability. The patched PHP versions released on October 21, 2026 are **8.2.35, 8.3.36, 8.4.27, and 8.5.12**. There is no complete workaround: only applying an appropriate patch addresses all known exploitation paths.

 

**In this article** 

[The alert](https://sdx-development.com/en/news/web-cybersecurity/two-critical-php-vulnerabilities-risks-and-fixes#alerte-php) [The two vulnerabilities](https://sdx-development.com/en/news/web-cybersecurity/two-critical-php-vulnerabilities-risks-and-fixes#mecanismes-php) [Who is affected?](https://sdx-development.com/en/news/web-cybersecurity/two-critical-php-vulnerabilities-risks-and-fixes#applications-exposees) [Patched versions](https://sdx-development.com/en/news/web-cybersecurity/two-critical-php-vulnerabilities-risks-and-fixes#versions-php) [Check your exposure](https://sdx-development.com/en/news/web-cybersecurity/two-critical-php-vulnerabilities-risks-and-fixes#audit-php) [Remediation plan](https://sdx-development.com/en/news/web-cybersecurity/two-critical-php-vulnerabilities-risks-and-fixes#plan-correction) [Temporary measures](https://sdx-development.com/en/news/web-cybersecurity/two-critical-php-vulnerabilities-risks-and-fixes#mesures-temporaires) [Frequently asked questions](https://sdx-development.com/en/news/web-cybersecurity/two-critical-php-vulnerabilities-risks-and-fixes#faq-php) [Sources](https://sdx-development.com/en/news/web-cybersecurity/two-critical-php-vulnerabilities-risks-and-fixes#sources-php)

 

## Why is this PHP alert exceptional?

 

On October 20, the PHP team announced an urgent security release. On October 21, it delivered the patches and made the technical details public. CERT-FR and CERT-EU recommend immediate remediation, or even isolating services exposed to the internet when no patch can be applied quickly.

 

Both vulnerabilities fall into the **RCE** (*Remote Code Execution*) category. Unlike an error affecting a particular WordPress plugin or application page, they are located inside the PHP runtime, which handles HTTP requests, forms, memory, and process state.

 

**“Unauthenticated” does not mean “automatically compromised.”** The attack does not necessarily require a user account, but its feasibility varies depending on the execution mode and configuration. The severity lies in the potential for system access before the application’s usual controls have had a chance to do their job.

 

## Understanding the two vulnerabilities

 

The flaws have one thing in common: internal data is used even though its memory state can no longer be trusted. However, they exploit **two distinct mechanisms**.

 

CVE-2026-109618 · memory corruption 

### An interruption during a memory allocation

 

When a memory limit is reached (*out-of-memory* or OOM), PHP used an abrupt exit based on ` longjmp() `. If the interruption occurs while structures associated with a request are being initialized, their subsequent cleanup may interpret incomplete data as valid. This corruption can open the door to code execution.

 

CVE-2026-109619 · use-after-free 

### Internal state persists after a previous request

 

Some global state (errors, sessions, extensions, or objects) can retain a reference to a memory area that has already been freed. If the same PHP process handles another request before resetting this state, it may reuse the stale reference. This is a *use-after-free* flaw.

 

### Why forms and HTTP requests matter

 

In the first vulnerability, processing certain multipart requests, such as those used for forms and file uploads, can cause unexpected memory pressure. In the second, a fatal error or certain diagnostics can leave behind state that will be consumed during a subsequent request. PHP’s technical advisories describe these types of scenarios; a vulnerable form in the business logic is not required in every case.

 

For **Apache with ` mod_php `**, the PHP team considers the risk particularly high: a demonstration shows that an unauthenticated request can reach the vulnerable path before any application code runs. **PHP-FPM is not out of danger, however**: error handling and exploitation paths differ, but PHP also classifies it as an affected environment.

 

A successful exploit may allow an attacker to act with the privileges of the PHP process: read files accessible to the service, retrieve application secrets, compromise a database if its credentials are available, modify content, or disrupt the service. The extent of the consequences depends on the server’s permissions, isolation, and architecture.

 

## Which websites, applications, and environments are affected?

 

The scope is not limited to sites that visibly display “PHP.” An application may use PHP behind a proxy, CDN, container, or managed platform. CERT-EU lists the main web interfaces running PHP: ` mod_php `, PHP-FPM, ` php-cgi `, FrankenPHP, and LiteSpeed.

 

| Environment | What to check |
| --- | --- |
| WordPress, Drupal, PrestaShop, Magento | The server’s actual PHP runtime, regardless of the CMS version |
| Symfony, Laravel, custom PHP application | The runtime used by the affected web instances, APIs, workers, and deployments |
| Apache + mod\_php | Priority update: a critical path may be triggered before application code runs |
| Nginx + PHP-FPM, php-cgi, LiteSpeed, FrankenPHP | The runtime version actually loaded by service processes |
| Docker, Kubernetes, CI/CD images | Base image, containers actually redeployed, and replicas still running |
| Shared hosting or managed platform | Patched version or backported patch confirmed by the provider |

 

**Important:** updating WordPress, a plugin, or a Composer dependency does not fix the PHP engine. Conversely, a site with correctly written application code may still be exposed if its interpreter has not received the patch.

 

## Vulnerable and patched versions

 

CERT-FR considers older branches, as well as all versions before the following patches, to be affected:

 

| Branch | Versions to patch | Patched PHP version |
| --- | --- | --- |
| PHP 8.5 | 8.5.0 to 8.5.11 | 8.5.12 |
| PHP 8.4 | 8.4.0 to 8.4.26 | 8.4.27 |
| PHP 8.3 | 8.3.0 to 8.3.35 | 8.3.36 |
| PHP 8.2 | 8.2.0 to 8.2.34 | 8.2.35 |
| PHP 8.1 and earlier | Branches no longer officially supported | Migration or a provider-backported patch to be verified |

 

The PHP project no longer releases official versions for PHP 8.1 and earlier branches. Some Linux vendors and long-term support providers nevertheless offer **backported patches**, without changing the major or minor version. An older version number therefore does not, by itself, prove that the patch is missing: check the distribution’s advisories and the status of the installed package.

 

PHP has also provided minimal source-code backports for branches 7.4, 8.0, and 8.1; this does not mean they have regained standard support. **PHP 8.2 reaches end of life on December 31, 2026**: ideally, its immediate patching should be accompanied by a migration plan.

 

## How can you tell whether your site uses a vulnerable version?

 

A common challenge is checking the right PHP version. On the same machine, the version launched in the terminal may differ from the one used by Apache, PHP-FPM, a container, or a subdomain. The check must therefore target **the web service actually running in production**.

 

First check 

### Inventory and version

 

Inventory domains, APIs, PHP-FPM pools, package versions, container images, and background tasks. Check the effective versions using the platform’s administration tools, system commands, or a temporary, protected application-side check.

 

Second check 

### Actual patch status

 

Compare the information against the PHP advisory or the vendor’s bulletin. After patching, check that services have restarted or that new containers have been deployed. Confirm that no old worker is still receiving traffic.

 

Some diagnostic commands, to be adapted to your system:

 

```
php -v
php --ini
```

 

` php -v ` and ` php --ini ` describe the CLI environment, **not necessarily the environment handling HTTP requests**. For PHP-FPM, check the binary used by the relevant pool, its configuration files, and the service actually running. For Docker or Kubernetes, check both the rebuilt image and the active containers or pods. Never leave a publicly accessible ` phpinfo() ` page in place for this check.

 

## Remediation plan: eight actions to take

 
1. **Map your environment.** List internet-facing PHP applications and identify their versions, execution modes, and owners.
2. **Prioritize.** Address internet-accessible services first, especially Apache ` mod_php ` instances and applications containing sensitive data.
3. **Back up.** Preserve configurations, data, and deployment images, and prepare a rollback plan without reverting to a vulnerable version long-term.
4. **Patch.** Install a secure PHP version or packages explicitly validated by your provider as backported patches.
5. **Restart or redeploy.** Replace all affected processes: Apache or FPM workers, containers, pods, and other instances.
6. **Verify the patch is in effect.** Check the version or package reference actually serving requests across all instances.
7. **Test essential user journeys.** Check authentication, forms, uploads, APIs, any payments, scheduled tasks, and error logs.
8. **Monitor and document.** Track anomalies, retain evidence of remediation, and investigate signs of compromise predating the update.

 

If there are credible signs of compromise, an update will not necessarily remove access that an attacker has already obtained. In that case, isolate the affected system, preserve logs, examine exposed files and secrets, and follow an appropriate incident response procedure.

 

## What should you do if an immediate update is not possible?

 

PHP emphasizes this point: **no workaround provides complete protection**. CERT-EU recommends considering the temporary isolation of public-facing services that cannot be patched and verified.

 

Caution 

## A web application firewall is no substitute for a patched runtime

 

WAF rules, limiting multipart requests, or disabling certain features may reduce exposure to documented scenarios, but they do not eliminate the two vulnerabilities. Some protections may also block legitimate forms or file uploads: assess the consequences before deployment.

 

For example, CERT-FR mentions disabling session upload progress via ` session.upload_progress.enabled=Off ` and, depending on the case, filtering multipart traffic. The PHP project also cites adjustments related to ` memory_limit ` to limit certain paths for the first vulnerability. These measures are partial and can be difficult to implement safely: they should be decided by the responsible administrator, checked across all processes, and removed or reevaluated after the patches are installed.

 

Do not conclude that there is no risk simply because a WAF is active, an external scanner detects nothing, or PHP errors are not displayed in the browser. None of these observations proves that the runtime’s memory handling has been patched.

 

## Frequently asked questions for website owners

 

### My WordPress site is up to date. Am I protected?

 

Not necessarily. WordPress and its plugins are separate components from the PHP engine. Each layer must be updated, and in particular you must check the PHP version actually used by the site.

 

### My site uses Nginx and PHP-FPM. Am I less exposed?

 

The exploitation path demonstrated with ` mod_php ` is particularly concerning, but PHP also includes PHP-FPM among the environments that need patching. The risk level differs between architectures; “less directly demonstrated” should not be taken to mean “not vulnerable.”

 

### I use shared hosting. Who is responsible for taking action?

 

The provider often manages the PHP engine, but responsibilities depend on the contract and service plan. Ask for confirmation that the patch has been applied, check maintenance notifications, and run functional checks on your site.

 

### My application runs in Docker. Is updating the server enough?

 

No, not if PHP is bundled in the application images. You must rebuild the images using a patched base image, redeploy all replicas, and check that no old instance remains in production.

 

### Are attacks already taking place?

 

On October 21, CERT-EU reported that proof-of-concept demonstrations were circulating publicly, increasing the likelihood of attacks. This does not establish that any particular site has been compromised. For exposed services, the priority remains rapid patching and log monitoring.

 

### Is a simple update command enough?

 

It is a step, not final proof. You must verify the correct package source, update all instances, ensure processes have actually restarted, and check that the application works after deployment.

 

## What this alert means for web application security

 

PHP2Shell is a reminder of a frequently overlooked reality: a site’s security depends not only on the quality of its business logic, installed plugins, or framework. It also depends on the engine that executes its code, how that engine manages memory, and how rigorously production environments are updated.

 

The right approach is therefore practical: **inventory, patch, redeploy, verify, and monitor**. Organizations that cannot apply patches quickly must explicitly decide whether to keep their internet-facing services online.

 

## Sources and reference documentation

 

*This article is based on public advisories published on October 21, 2026. Maintainers and distribution vendors may provide additional remediation guidance.*

 

View official advisories 5 references

 

- [PHP — October 21, 2026 security advisory and patched versions](https://www.php.net/index.php#2026-10-21-1).
- [PHP / GitHub — CVE-2026-109618, corruption during an out-of-memory condition](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w).
- [PHP / GitHub — CVE-2026-109619, stale global state](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp).
- [CERT-FR — alert and measures to reduce exposure](https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-014).
- [CERT-EU — Security Advisory 2026-018](https://cert.europa.eu/publications/security-advisories/2026-018/).

WEB & CYBERSECURITY

## Build a reliable web foundation before an incident.

Code, dependency and sensitive-path audits turn a technical alert into a controlled action plan.

- Clear priorities and risks
- Tested fixes with a rollback plan
- Long-term maintenance

[Request a project audit](https://sdx-development.com/en/contact)[View services](https://sdx-development.com/en/services)

---

[View the HTML page](https://sdx-development.com/en/news/web-cybersecurity/two-critical-php-vulnerabilities-risks-and-fixes)