PHP2Shell Flaws Put Web Servers at Risk
PHP2Shell affects PHP itself, not just WordPress. Here are the fixed versions, the latest follow-up warning, and what the evidence says about attacks.
PHP has released fixes for two critical vulnerabilities that could let attackers run code on a web server without logging in. Known together as PHP2Shell, the flaws affect PHP itself, so website owners need to check the software running their sites even if WordPress, plugins and themes are already up to date.
The October 21 security releases address CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. PHP issued additional, configuration-specific guidance on October 23.
Updated October 24, 2026.
How this affects your website
Both flaws involve PHP mishandling memory. One occurs when PHP runs out of memory partway through preparing request data. The other leaves behind references to memory from a request that has already finished, which can cause trouble when the same worker handles another request.
Researchers at Wiz demonstrated attacks against WordPress, Drupal and Joomla, including remote code execution and disclosure of information held in memory. Those demonstrations show why the bugs deserve attention, though they do not establish that those sites have been compromised in the wild.
The joint disclosure identifies affected releases dating back to PHP 5.4. Risk varies with the version and server setup. Apache's mod_php is especially exposed because researchers demonstrated an attack before application code even runs. PHP-FPM also needs attention: the PHP Foundation confirms that attacks can reach it through application-level paths.
Which versions should you install?
The first fixed releases are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
PHP 8.1 and older have no new upstream release. The security team provided source backports for 7.4, 8.0 and 8.1, and some vendors may supply their own patched packages. Check your provider's advisory, since a version number alone may not tell you whether a vendor has applied the fix.
There is one more setting to review. In its October 23 follow-up, PHP advises setting session.upload_progress.enabled=0 until the next regular bugfix release to address CVE-2026-115560.
This remaining issue requires a specific combination: upload progress is enabled, the configured session serializer is php_binary or php_serialize, and the application switches it to php at runtime before starting a session. Applications that never change serializers at runtime can keep the feature enabled. The October 21 updates are still necessary.
What do we know about attacks?
Amazon Threat Intelligence reports an exploitation attempt in its MadPot telemetry on October 17, before public disclosure, followed by broader attempts. AWS says it is unclear whether those attempts would have succeeded against real-world systems.
That leaves an important limit on what we know: attackers are trying to exploit PHP2Shell, but this evidence does not establish successful compromises. There is still good reason to patch promptly.
What to do now
Start with the PHP version actually serving your website. The version shown at the command line may be different. If you use managed hosting, ask your host which PHP build is running and whether the security update is active.
For anyone managing their own servers:
- Update affected packages or container images, restart the relevant services and workers, and verify the running version across every site and PHP pool.
- Review the October 23 configuration guidance alongside the runtime update.
- Check web logs, unexpected process execution and file changes. AWS recommends looking back at least to October 17.
WAF rules and configuration workarounds may limit particular attacks, but they cannot replace the update. And if you find suspicious activity, investigate it: patching closes vulnerabilities without telling you what happened before the fix.
Primary sources and further reading
Comments ()