PHP2Shell explained: how to check and patch CVE-2026-109618 and CVE-2026-109619

On 21 October 2026 the PHP project released emergency security updates for two critical flaws now widely known as PHP2Shell. They can let an attacker run their own code on a web server without logging in, and they sit in PHP itself, so they affect WordPress, WooCommerce, Laravel, Drupal, Joomla and custom PHP sites alike. Details became public before the fixes were out, so every site running PHP should be checked now.

This guide explains what PHP2Shell is, how to tell whether your site is affected and what to do about it. It is general information based on the PHP project's advisory, not a substitute for your hosting provider's guidance.

What is PHP2Shell?

PHP2Shell is the name given to two vulnerabilities in the PHP language runtime:

• CVE-2026-109618, remote code execution via out-of-memory corruption. When PHP runs out of memory at the wrong moment, request data can be left half set up, and cleanup then treats it as valid.
• CVE-2026-109619, remote code execution via stale global state. Data belonging to one request can survive after its memory is freed, and a later request handled by the same PHP worker can use it.

The PHP project says all PHP installations that serve web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php, where an exploit was demonstrated that triggers before any application code runs. Security firms rate both flaws 9.2 (critical) on CVSS v4.

Which PHP versions fix PHP2Shell?

• 8.5: 8.5.12
• 8.4: 8.4.27
• 8.3: 8.3.36
• 8.2: 8.2.35
• 8.1 and older: No regular update from the PHP project. Upgrade to a supported branch, or use a vendor or host that provides a backported fix.

Anything older than the versions above on the same branch is affected. Because PHP 8.1 and older are past end of life, the PHP security team published minimal source backports for 7.4, 8.0 and 8.1, but those are for people who build PHP themselves. For almost every business the right move is to move to PHP 8.2 or newer on the patched release.

How to check your PHP version

Pick whichever fits how your site is hosted:

• WordPress: go to Tools → Site Health → Info → Server. The "PHP version" line shows the exact release, for example 8.3.36.
• Hosting control panel: cPanel (MultiPHP Manager), Plesk (PHP Settings) and Hostinger hPanel (Advanced → PHP Configuration) all show the PHP version per website. Each site on the same account can use a different version, so check every one.
• Command line (VPS or dedicated server): run php -v for the command-line PHP, and check the PHP-FPM or Apache module version too (php-fpm -v, or a temporary phpinfo() page you delete afterwards), because the web server can use a different build from the command line.
• Docker: check the FROM php:… line in your Dockerfile and rebuild from a patched image tag.

On managed hosting the provider usually patches PHP builds for you, but only for the versions it still supports. A site pinned to an old version such as 7.4 or 8.0 may still be exposed even after the host has patched newer builds.

What to do now

1. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your Linux distribution's or host's patched package.
2. Restart PHP (PHP-FPM pools, Apache or LiteSpeed) so the new build is actually running, then re-check the version.
3. Move off PHP 8.1 and older. Test your site on PHP 8.2+ in a staging copy first: old plugins, themes and custom code are the usual blockers.
4. Check every site and server, including staging sites, old microsites and internal tools. Forgotten installs are the easiest targets.
5. Watch your logs for unusual errors, crashes or new files in upload folders, and run your security scanner after patching.

If you can't update immediately

The PHP project is clear that only updating is a complete fix. Its interim measures reduce exposure to the known attack paths but do not make a server safe. They are server-level settings, so ask your host or developer to apply them:

• Turn off upload progress tracking: session.upload_progress.enabled=0 in php.ini or the FPM pool, then restart every worker. Setting it with ini_set() or a .user.ini file is not enough.
• On PHP 8.5, set fatal_error_backtraces=0 and restart.
• Keep request sizes small: for example post_max_size = 8M if the site doesn't take uploads (32M if it does), with upload_max_filesize below it, and enforce request limits at the web server or proxy too.

Treat these as a stopgap of hours or days, not a substitute for the update.

Does PHP2Shell affect WordPress and Shopify?

• WordPress, WooCommerce, Laravel, Drupal and other PHP software: yes, if the server runs an unpatched PHP version. Updating WordPress or plugins does not fix it, because the flaw is in PHP itself.
• Shopify: your Shopify store does not run your own PHP, so PHP2Shell is Shopify's responsibility on its own platform. Any PHP apps, middleware or older WooCommerce sites you run alongside it still need checking.

Need a hand checking or upgrading your sites? Our team updates PHP, WordPress and WooCommerce sites and tests them on newer PHP versions before going live — talk to Dzimark.

Sources

• PHP: Security advisory, 21 Oct 2026 — critical remote code execution vulnerabilities
• PHP: CVE-2026-109618 advisory (GHSA-w8hw-w9fx-j79w)
• PHP: CVE-2026-109619 advisory (GHSA-6wmf-4rv5-p3rp)
• NCSC-NL: operational information on PHP2Shell