By CISA’s deadline for federal agencies to patch PHP2Shell passed yesterday. Censys estimates 32.51 million PHP services still run vulnerable versions. If you run PHP — on a server, in a container, behind a managed host — read this before you move on.
What PHP2Shell Is
PHP2Shell is the name for two critical vulnerabilities disclosed on October 21: CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. Both enable unauthenticated remote code execution. Neither requires your application to do anything wrong.
CVE-2026-109618 exploits how PHP handles memory exhaustion during request parsing. When an allocation fails mid-operation, PHP’s cleanup routine encounters partially initialized data — and interprets stale heap bytes as valid PHP values, including destructor callbacks. An attacker who grooms memory correctly can call system() with whatever they want. CVE-2026-109619 is a use-after-free: request-owned state persists after its memory is freed, and subsequent workers on the same process can read it before it’s reset.
The detail that matters most: exploitation fires during request parsing, before any application code runs. Your login walls, rate limits, and input validation are irrelevant. The exploit lands at the PHP runtime layer, not your application layer.
How Bad Is Exploitation?
Exploitation started before the patch dropped. Amazon’s MadPot honeypot recorded PHP2Shell attempts on October 17 — four days before disclosure. Delft University’s Threat Intelligence Lab tracked over 50,000 exploitation requests from more than 600 IP addresses across 70 countries. Of those, 171 addresses went past probing to deliver actual exploit code or malware droppers.
Perplexity security researcher Adel Karimi confirmed 35 successful shell executions across three honeypots running PHP 8.4.26 under Apache mod_php. His verdict: “This is now confirmed RCE with usable memory disclosure, not just a crash followed by a suspicious process.” An Israeli cybersecurity firm reported 25 servers compromised via a chained PHP2Shell attack on October 26. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 26, with a federal agency deadline of October 29.
Affected Versions
Every PHP installation serving web requests is affected — PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. Apache mod_php carries the highest demonstrated risk. The fixed versions:
- PHP 8.5 → update to 8.5.12
- PHP 8.4 → update to 8.4.27
- PHP 8.3 → update to 8.3.36
- PHP 8.2 → update to 8.2.35
- PHP 8.1 and older → no official fix; use a verified vendor backport or migrate
One gotcha: Ubuntu 24.04 may display an older version string while the package itself contains the backported fix. Verify your package version rather than trusting the display string alone.
How to Patch
Managed hosting: Most major hosts confirmed complete patches as of October 28 — Kinsta, WP Engine, Cloudways, DreamHost, SiteGround, Flywheel, Namecheap, and OVHcloud. Do not accept “we added firewall protection” as confirmation. Ask specifically whether PHP itself was updated for CVE-2026-109618 and CVE-2026-109619. WordPress users can verify their current PHP version under Tools → Site Health → Info → Server.
Self-hosted / VPS: Install the updated PHP package from your Linux distribution’s repository, then restart your web stack. Verify:
php -v
# Must show 8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+Docker / containers: Pull the fixed image, then recreate your containers. Pulling a new image does not replace the running container. Verify what your running container is actually using:
docker container inspect \
--format '{{.Config.Image}} {{.Image}}' \
YOUR_PHP_CONTAINERCloudflare’s WAF rules for known PHP2Shell exploit vectors are available to all tiers including free. Enable them. They are a stopgap — they cover known patterns, not every variant. Patching is the only complete fix.
Check If You Were Already Hit
Exploitation began October 17. If your system ran a vulnerable PHP version since then, a five-minute check is worth running:
- Look for new administrator accounts you did not create (WordPress: Users dashboard)
- Check for
.phpfiles insidewp-content/uploads/ - Run
site:yourdomain.comin Google for unexpected indexed pages - Search error logs for: Fatal error: Allowed memory size exhausted paired with Unknown on line 0
- Check for unfamiliar plugins added after October 17
If something looks off, do not just patch. Restore from a pre-October-17 backup and rotate every credential your server held. Patching a compromised system seals the door with an attacker already inside.
