PHP2Shell Vulnerability Explained: Affected Versions and How to Stay Safe
PHP2Shell Explained: Critical PHP Vulnerabilities, How They Work, and How to Protect Your Server
PHP security became a major concern in October 2026 after the PHP development team disclosed two critical vulnerabilities that could allow unauthenticated remote code execution on vulnerable web-facing installations. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, affect PHP's internal memory management and request-processing lifecycle.
On October 21, the PHP project released security updates addressing both vulnerabilities. On October 23, it published additional guidance about a separate, configuration-dependent risk, CVE-2026-115560, involving session upload progress.
These disclosures highlight an important lesson for website owners and developers: keeping application code updated is not enough if the underlying programming language runtime remains vulnerable.
This guide explains what happened, how the vulnerabilities work, which PHP versions are affected, and how to protect your server using practical steps and official security guidance.
What Is PHP2Shell?
PHP2Shell is the name used in security reporting for two critical PHP vulnerabilities:
CVE-2026-109618: A remote code execution vulnerability involving memory corruption during an out-of-memory condition.
CVE-2026-109619: A remote code execution vulnerability involving stale internal state after memory has been freed.
Both vulnerabilities received a CVSS v4.0 severity score of 9.2. The official PHP security announcement confirms that they can allow unauthenticated remote code execution.
Remote code execution, commonly abbreviated as RCE, means an attacker can potentially cause a vulnerable program to execute instructions they control. If an attacker successfully exploits a web-facing PHP process, they may be able to perform actions with the permissions of that process.
Depending on the server's configuration, this could expose application files, environment variables, database credentials, API tokens, or connected internal services.
However, a critical vulnerability does not automatically mean every PHP website has been compromised. Exposure depends on the installed runtime, serving configuration, request-processing path, and other conditions.
For the original technical details and patched releases, see the PHP 2026 security announcement archive.
What Actually Happened?
The two PHP2Shell vulnerabilities involve different failures in PHP's internal memory-management and request-processing lifecycle. Understanding the distinction helps explain why updating an individual application or changing one configuration setting cannot fully resolve the first two issues.
1. CVE-2026-109618: Memory Corruption During an Out-of-Memory Condition
PHP applications operate under resource limits. One common control is memory_limit, which restricts the amount of memory a script can consume.
These limits help prevent scripts from exhausting server resources. But the runtime must also handle situations where a request reaches that limit.
According to the official PHP advisory, the vulnerability involves an out-of-memory interruption occurring while PHP's internal request data is only partially initialized. During cleanup, the runtime can incorrectly treat that incomplete data as valid.
This can lead to unsafe memory operations and memory corruption. Under suitable conditions, an attacker may be able to turn the resulting corruption into code execution.
Consider a simplified example: a program starts preparing an internal data structure, encounters a fatal resource error before initialization is complete, and then attempts to clean up as though the structure had been initialized successfully.
If cleanup does not safely account for the incomplete state, the program may access memory incorrectly.
This does not mean every request that exceeds PHP's memory limit causes remote code execution. Successful exploitation depends on the vulnerable runtime and the conditions required to trigger the unsafe behavior.
The important point is that the problem exists inside PHP's request-processing machinery, rather than necessarily originating in a particular website's application code.
2. CVE-2026-109619: Stale State and Use-After-Free
The second vulnerability involves a memory-safety problem known as a use-after-free.
When software releases a block of memory, it must stop using references to that memory as though the original data were still valid. If a reference remains, later code may access memory that has already been freed or reused for another purpose.
The PHP security advisory explains that request-owned internal state could survive after the memory backing it had been freed.
A later request handled by the same long-running worker could encounter that stale state. Under suitable conditions, the unsafe access could potentially be exploited to achieve remote code execution.
In simple terms: PHP released memory but did not fully clear a reference to it. Later processing could then use that invalid reference.
This matters because many production PHP deployments reuse workers to improve performance. A server is not necessarily starting a completely new PHP process for every incoming request.
The exact exploitation path depends on the serving environment. Administrators should not assume that every request, worker, or PHP application is equally exploitable.
Why Are These Vulnerabilities So Serious?
Both flaws affect PHP itself rather than one particular CMS, framework, or plugin.
That distinction matters because application-level security checks cannot necessarily prevent a vulnerability in the runtime from being triggered. A well-maintained WordPress, Laravel, or custom PHP application may still depend on a vulnerable PHP installation.
The PHP project explicitly states that updating is the only safe choice for the two critical vulnerabilities because there are no complete mitigations.
For additional technical context, read the official PHP advisory and the PHP security release announcements.
Which PHP Versions Are Affected?
On October 21, 2026, the PHP development team released patched versions for four maintained branches.
| PHP branch | Fixed release | Official release notes |
|---|---|---|
| PHP 8.5 | 8.5.12 | PHP 8.5.12 |
| PHP 8.4 | 8.4.27 | PHP 8.4.27 |
| PHP 8.3 | 8.3.36 | PHP 8.3.36 |
| PHP 8.2 | 8.2.35 | PHP 8.2.35 |
Versions earlier than the corresponding fixed release are affected by the two main PHP2Shell vulnerabilities.
These are upstream PHP version numbers. Linux distributions and managed hosting providers may backport security fixes into packages that display different version strings. Consult your operating system or hosting provider's security advisory before deciding whether a particular package is vulnerable.
PHP 8.2 is also approaching the end of its upstream support period. According to the official PHP release schedule, PHP 8.2 security support ends on December 31, 2026. Administrators should plan to move to a supported branch rather than relying on an end-of-life runtime.
Important: These patch releases address CVE-2026-109618 and CVE-2026-109619. They should not be interpreted as fixing the separate session-upload-progress issue described below.
Which Server Configurations May Be Exposed?
The PHP security announcement identifies web-serving PHP installations as potentially affected, including:
PHP-FPM
Apache with
mod_phpPHP CGI (
php-cgi)FrankenPHP
LiteSpeed
The risk is not identical across every deployment. The PHP project identifies Apache mod_php as the highest-risk configuration for the demonstrated attack path, where an unauthenticated request can trigger the attack before application code runs.
However, administrators using PHP-FPM or other web-facing environments should not assume they are safe.
You should also consider installations that are easy to overlook:
PHP inside Docker containers or Kubernetes workloads.
Separate PHP versions configured for different websites.
Hosting control panels and bundled application appliances.
Staging systems exposed to the internet.
Older applications running in separate PHP-FPM pools.
Scheduled jobs and command-line scripts that use a different PHP binary.
The key is to identify the PHP runtime that actually handles public web requests—not merely the version reported by your terminal.
A Third Issue: CVE-2026-115560
On October 23, 2026, the PHP project published additional guidance about a separate, configuration-dependent remote code execution risk tracked as CVE-2026-115560.
Unlike the two main PHP2Shell vulnerabilities, this issue involves a specific combination of session configuration and application behavior.
According to the published advisory, the vulnerable conditions require the application to:
Configure
session.serialize_handlerasphp_binaryorphp_serialize.Change that setting to
phpat runtime usingini_set().Call
session_start()after the runtime change.Leave session upload progress enabled.
The PHP team describes this combination as unlikely in practice. Applications that do not change the session serialization handler at runtime do not need to disable upload progress solely because of this specific issue.
Until the issue is addressed in a regular bug-fix release, PHP recommends disabling session upload progress:
session.upload_progress.enabled = 0Apply the setting in the PHP configuration layer that takes effect before request processing. Then reload or restart the relevant service as appropriate and verify the effective setting.
If you already applied this mitigation following the October 21 advisory, the PHP project says to leave it in place; no additional action is needed for this issue.
Do not confuse the mitigation with a complete fix for PHP2Shell. Disabling session upload progress is a specific measure for CVE-2026-115560. It does not replace upgrading PHP to fix CVE-2026-109618 and CVE-2026-109619.
How to Protect Your PHP Server
The following steps are intended for website owners, developers, and server administrators. Commands and service names vary by operating system and deployment, so verify your environment before making production changes.
Step 1: Check the PHP Version
Start by checking the command-line PHP version:
php -vThis displays the version available in your shell. It does not necessarily show the version used by your public website.
Next, inspect the CLI configuration:
php --iniIf you use PHP-FPM on a system managed by systemd, identify the active service:
systemctl list-units --type=service | grep -i phpThen check the installed PHP-FPM package and running service using your operating system's package manager and service tools.
For Docker deployments, inspect the version inside the actual running container rather than assuming that the version in your local shell matches the production runtime.
Do not stop after running php -v. A server can have multiple PHP versions, separate FPM pools, or different runtimes for command-line and web requests.
Step 2: Upgrade to a Patched Release
Use the official PHP downloads page and your operating system's security advisories to determine the appropriate update.
For upstream releases, the fixed versions are:
PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35
If your provider supplies a backported security patch, follow its documented remediation instructions. Do not replace system-managed PHP binaries with arbitrary downloads, as this can break extensions, package management, and production services.
Before upgrading a production environment:
Back up relevant configuration and application data.
Review compatibility with installed PHP extensions.
Test the update in staging if possible.
Prepare a rollback plan.
Schedule any service restart or deployment interruption appropriately.
For containerized applications, update the base image to a patched build, rebuild the image, deploy it, and replace the running containers. Changing an image tag in a configuration file without redeploying does not patch the runtime already serving requests.
Step 3: Restart or Reload the Relevant Services
Installing an update does not necessarily mean all existing PHP workers have stopped using the old runtime.
For example, a systemd-based PHP-FPM installation might use:
sudo systemctl restart php8.4-fpmReplace php8.4-fpm with the service name actually installed on your system. Apache mod_php, LiteSpeed, FrankenPHP, and containerized deployments may require different procedures.
Restarting services can interrupt active requests, so use your normal production change-management process.
Step 4: Verify the Patch Is Active
After the update:
Check the installed package version.
Confirm the relevant PHP-FPM or web-server service is running.
Verify the runtime that handles HTTP requests.
Confirm old containers or workers have been replaced.
Review your provider's advisory if security fixes are backported.
The goal is to establish that the public-facing runtime has actually been patched. A successful package installation alone is not sufficient evidence.
Step 5: Apply the Session Upload Progress Mitigation
For CVE-2026-115560, configure:
session.upload_progress.enabled = 0Place the setting in the appropriate system or pool configuration so it takes effect before the affected request processing begins.
Then reload or restart the relevant service as required and verify the effective configuration. The precise method depends on how PHP is deployed.
This setting may disable functionality that some applications use to display file-upload progress. Test affected upload workflows and keep the mitigation in place until the PHP project or your vendor provides an appropriate fix.
For the latest guidance, refer to the PHP news archive.
Step 6: Review Logs and Investigate Suspicious Activity
Patching addresses the known vulnerabilities, but it cannot reverse a compromise that has already occurred.
Review logs covering the period when the server was exposed. Depending on your environment, this can include:
Web-server access and error logs.
PHP-FPM logs.
Application and authentication logs.
Operating-system and endpoint-security alerts.
Unexpected child processes or outbound connections.
Unexpected changes to application files, uploaded content, accounts, or scheduled tasks.
Look for activity that deviates from normal application behavior. However, the absence of obvious indicators in logs does not prove that the server was never compromised.
If you discover credible signs of exploitation, follow your incident-response process. This may involve isolating the server, preserving evidence, rotating credentials and API keys, rebuilding from a trusted image, and investigating other systems that the compromised process could reach.
Step 7: Check Every PHP Installation You Operate
A single server may run multiple websites, PHP versions, containers, or application pools.
Create an inventory of the PHP runtimes you manage and record:
Runtime version and package source.
Public-facing service or application.
Patch status.
Relevant configuration and session settings.
Person or team responsible for updates.
Date the fix was verified.
This is particularly important for shared hosting, VPS fleets, and containerized deployments, where one updated application may coexist with another service that still uses an old runtime.
Does Updating WordPress, Laravel, or Composer Fix PHP2Shell?
No—not by itself.
Frameworks and content management systems can provide useful security protections, but they do not automatically patch the PHP interpreter underneath them.
Updating WordPress core, a Laravel dependency, or packages installed through Composer is not equivalent to updating the PHP runtime. Administrators must verify that the actual interpreter serving requests has received the relevant security fix.
This is also why routine infrastructure maintenance matters alongside application-level security testing.
For another perspective on developer tools and open-source software, read our related article: ArtCraft: Open-Source Alternatives to Adobe Creative Cloud Built With Claude.
You can find more technology and development articles on the Pratham Prajapati blog.
What Developers and Server Administrators Should Learn
PHP2Shell illustrates three important lessons.
1. Runtime security is part of application security. Code reviews, dependency scans, and framework updates are valuable, but they cannot replace patch management for the language runtime and operating system.
2. Error handling can become a security boundary. Memory exhaustion and fatal errors must not leave internal structures in a state that later cleanup routines or requests can misuse.
3. Verification matters as much as installation. The PHP CLI, PHP-FPM, Apache module, containers, and managed hosting environments may use different versions or configuration files. An update is only effective when the vulnerable runtime has actually been patched.
Conclusion: Patch First, Verify, Then Investigate
The PHP2Shell vulnerabilities demonstrate how bugs deep inside a widely deployed programming language can create serious risks for web infrastructure.
The PHP project released fixes for CVE-2026-109618 and CVE-2026-109619 on October 21, 2026, and administrators should prioritize updating affected web-facing installations.
The separate CVE-2026-115560 advisory also shows why security maintenance must continue after an emergency release. Administrators should follow the latest official PHP guidance, apply the session upload progress mitigation where relevant, and verify that the actual runtime serving requests is protected.
If you maintain a PHP website, start by identifying the runtime, applying the appropriate vendor-supported fix, restarting and verifying the relevant services, and investigating any signs of prior compromise.
The most important takeaway is straightforward: keeping your application updated is not enough if the PHP runtime underneath it is still vulnerable.
Sources and Further Reading
The following primary and secondary sources provide additional details, release information, and security guidance.
Official PHP sources
CVE records and security advisories
Technical analysis and independent reporting
Related reading on this blog
Editorial note: This article is informational and is not a substitute for your operating system vendor's security advisory or a professional incident-response assessment. Verify the latest official release and vendor guidance before applying changes to production systems.