PHP2Shell Vulnerability: How to Fix Two Critical PHP Remote Code Execution Flaws

Two critical PHP security vulnerabilities, collectively known as the PHP2Shell vulnerability, have triggered emergency security updates and reports of exploitation attempts. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws affect the PHP runtime and can expose web servers to remote code execution and sensitive memory disclosure.

The PHP project released patched versions on October 21, 2026: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Administrators should identify affected deployments, install the appropriate security update, restart PHP workers, and investigate suspicious activity. The official PHP advisory states that updating is the only complete mitigation. Read the PHP security advisory.

This guide explains what the PHP2Shell vulnerability means, which PHP installations are affected, how to update PHP safely, and how Vulert can help teams monitor vulnerabilities in their open-source PHP dependencies.

What Is the PHP2Shell Vulnerability?

The PHP2Shell vulnerability refers to two critical flaws in the PHP interpreter itself. Unlike a vulnerability confined to a WordPress plugin, Laravel application, or Composer package, these flaws exist in the PHP runtime that processes web requests.

Both vulnerabilities received a CVSS v4.0 score of 9.2. Depending on the vulnerable code path and server configuration, an attacker may be able to execute code without authenticating first. The flaws can also expose memory belonging to PHP worker processes, potentially revealing sensitive information.

PHP is widely used to power content management systems, e-commerce platforms, APIs, and business applications. Consequently, a vulnerability in the runtime can affect applications across many industries, even when those applications do not contain a vulnerable third-party library.

PHP2Shell CVE Identifiers

• CVE-2026-109618: A critical PHP runtime vulnerability associated with dangerous memory-handling behavior and remote code execution.
• CVE-2026-109619: A second critical PHP runtime vulnerability associated with additional memory disclosure and exploitation risks.

For technical details, consult the official advisories: CVE-2026-109618 advisory and CVE-2026-109619 advisory.

Which PHP Versions Are Affected?

The reported vulnerabilities affect PHP installations serving web requests, including versions dating back to PHP 5.4. The PHP project has published fixes for supported release branches. Older branches may require vendor-specific updates or carefully evaluated backports.

Important: Some Linux distributions and commercial hosting providers backport security patches without changing the upstream version number to match the table. Check the package changelog, vendor advisory, or security status before concluding that a package remains vulnerable based only on its displayed version.

PHP 8.2 is also approaching its scheduled end of security support on December 31, 2026. Teams still running it should plan a longer-term upgrade in addition to applying the immediate fix.

Which PHP Configurations Are at Risk?

The PHP security advisory identifies several affected execution environments. The risk is highest for Apache’s mod_php configuration, where a demonstrated attack can trigger before application code executes.

• Apache mod_php: Considered particularly exposed because an unauthenticated request can trigger the vulnerable path before normal application processing.
• PHP-FPM: Also affected. The precise attack path and exploitability differ between the two flaws and the way the application handles requests.
• php-cgi: Included among the affected PHP execution environments.
• FrankenPHP and LiteSpeed: Also identified in the PHP project’s security guidance.
• CMS and framework applications: WordPress, Laravel, and other PHP applications can be exposed when they run on a vulnerable PHP runtime, even if their application dependencies are current.

Do not assume your application is safe because it uses PHP-FPM rather than mod_php, or because it has no known vulnerable Composer packages. Runtime vulnerabilities and application dependency vulnerabilities are different attack surfaces.

How to Fix the PHP2Shell Vulnerability

The priority is to update the PHP runtime used to serve production requests. Updating your application’s dependencies alone will not fix a flaw in the PHP interpreter.

Step 1: Identify the PHP Version

On a server where you have appropriate access, run:

php -v

This shows the PHP CLI version. However, the command might not report the same version used by Apache, PHP-FPM, a container, or a managed hosting environment. Check the runtime serving actual web traffic as well.

Step 2: Update the Runtime Through Its Package Manager or Hosting Provider

Use the official PHP downloads, your Linux distribution’s security repositories, your container image publisher, or your hosting provider’s supported upgrade process. Select the correct patched release for your environment and confirm the package includes both fixes.

For Docker-based deployments, update the PHP base image and rebuild the application image. For managed hosting, confirm that the provider has updated the PHP runtime assigned to your website. Avoid downloading untrusted binaries or applying a version change without checking extension compatibility.

Step 3: Restart PHP Workers and Web Services

After upgrading, restart or reload the relevant services so running workers stop using the old runtime. Depending on the environment, this may include Apache, PHP-FPM, application workers, and long-running queue processes. Use your platform’s documented service-management procedure.

Step 4: Verify the Deployed Version

Check the runtime version again and confirm that the web-facing environment is using the patched build. Test key application flows, including authentication, uploads, background jobs, and API endpoints.

Step 5: Review Logs and Investigate Suspicious Activity

Because exploitation attempts have been reported, patching should be accompanied by a review of security logs. Look for unusual requests, unexpected HTTP 500 responses, abnormal worker restarts, suspicious session cookies, and unexpected processes or outbound connections.

Do not treat the absence of obvious errors as proof that no compromise occurred. If you find credible indicators of exploitation, preserve relevant logs, follow your incident response plan, rotate potentially exposed credentials, and investigate the affected host.

Can You Mitigate PHP2Shell Without Updating?

There are configuration changes that may reduce exposure to particular attack paths, but they are not equivalent to patching. The PHP project explicitly states that there is no complete configuration-based mitigation for these vulnerabilities.

For example, the official guidance describes disabling session upload progress for one attack path and adjusting selected memory and request-size settings for another. The appropriate settings depend on the specific CVE, PHP branch, and application configuration.

Before applying any temporary workaround, read the official advisory and assess application compatibility. Disabling session upload progress may affect upload-related functionality, while changing memory limits can alter application behavior.

Do not rely on a workaround as your permanent fix. Web application firewall rules, reverse-proxy restrictions, and request-size limits can add layers of protection, but they cannot guarantee that a vulnerable runtime is safe. Prioritize a supported, security-patched PHP build.

Why PHP Dependency Security Still Matters

Fixing the PHP runtime addresses these two specific flaws. It does not eliminate vulnerabilities in the application’s third-party libraries.

PHP projects commonly depend on packages installed through Composer, the PHP dependency manager. Applications may include Laravel components, Symfony packages, Guzzle, Doctrine, authentication libraries, serialization libraries, and many other dependencies. A vulnerable package can introduce a separate security problem even after the PHP runtime has been patched.

For example, a team could upgrade to a fixed PHP version but still run an outdated framework component with a known remote code execution vulnerability. The runtime update and the dependency update solve different problems, and both need appropriate security processes.

A reliable PHP security program therefore tracks two categories:

• Runtime security: PHP interpreter versions, operating-system packages, hosting images, and service restarts.
• Dependency security: Vulnerabilities in Composer packages and their transitive dependencies, including the versions recorded in composer.lock.

Keeping these categories separate makes ownership clearer. Infrastructure or platform teams usually manage the PHP runtime, while application engineering teams often own Composer dependencies. Both teams should coordinate during a critical incident.

How to Check PHP Composer Dependencies for Vulnerabilities

Composer includes an audit command that can identify known security advisories affecting dependencies recorded in a project. Run it from the application directory:

composer audit

For reproducible dependency management, commit the project’s composer.lock file and run security checks against the resolved dependency set. If an advisory affects a package, review the affected version range, the fixed release, and any framework compatibility requirements before upgrading.

For example, inspect the installed dependency tree with:

# Inspect the resolved dependency tree
composer show --tree

# Review security advisories
composer audit

# Update a specific package after confirming a safe version
composer update vendor/package

Replace vendor/package with the actual affected package. Do not blindly update every dependency in production during an emergency. Review the change, run automated tests, and deploy through your normal release process unless your incident response policy requires a different approach.

How Vulert Helps With PHP Dependency Vulnerability Monitoring

Vulert is a Software Composition Analysis (SCA) platform focused on monitoring open-source dependencies for known security vulnerabilities. It analyzes dependency manifests and lockfiles, compares identified packages with a vulnerability database containing more than 458,000 known vulnerabilities, and alerts teams when issues affect their dependencies.

For PHP teams, Vulert supports Composer dependency files such as composer.lock. This helps application teams identify known vulnerabilities in PHP packages and understand which versions need attention.

Vulert complements, rather than replaces, PHP runtime patch management. It does not fix the PHP interpreter vulnerabilities described in the PHP2Shell advisories merely by scanning a Composer lockfile. You must update the underlying PHP runtime separately.

Vulert can help teams manage the dependency side of the broader response through:

• Manifest and lockfile scanning: Review PHP Composer dependencies for known vulnerabilities.
• Continuous monitoring: Receive alerts when newly disclosed vulnerabilities affect monitored dependencies.
• Fix guidance: Review recommended versions and available commands for upgrading vulnerable packages.
• Dependency Health: Group findings by package to help teams identify upgrades that can resolve multiple vulnerabilities.
• Jira integration: Create tickets for dependency remediation and track work through existing engineering workflows.
• SBOM support: Upload SPDX or CycloneDX software bills of materials to assess the vulnerabilities associated with inventoried components.

These capabilities are particularly useful when a security incident prompts a wider review of the application stack. After patching PHP itself, teams can check their Composer dependencies for other known vulnerabilities and establish ongoing monitoring instead of relying only on a one-time audit.

PHP2Shell Response Checklist

Use this checklist to coordinate your infrastructure and application teams:

• ☐ Identify all production servers, containers, and hosting environments running PHP.
• ☐ Determine the actual PHP runtime version serving web requests.
• ☐ Identify whether the environment uses mod_php, PHP-FPM, php-cgi, or another supported runtime.
• ☐ Install the appropriate security-patched PHP release or verified vendor backport.
• ☐ Rebuild and redeploy affected container images.
• ☐ Restart relevant web services and long-running PHP workers.
• ☐ Verify the deployed runtime and test critical application functionality.
• ☐ Review web, application, and infrastructure logs for suspicious activity.
• ☐ Investigate possible compromise rather than assuming patching proves the host was never attacked.
• ☐ Run composer audit against application dependencies.
• ☐ Review vulnerable Composer packages and upgrade them through a tested deployment process.
• ☐ Establish continuous monitoring for future dependency vulnerability disclosures.

Frequently Asked Questions