PHP2Shell Vulnerability: What It Is and How to Patch
Two critical PHP flaws nicknamed PHP2Shell can let attackers run code on web servers without logging in. Here is what is affected, which versions fix it, and why Ondřej Surý is part of the story.
- PHP2Shell is the nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 and able to allow code execution without a login.
- The fix is PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (released October 21, 2026), or a vendor package with the backport, followed by a restart of every PHP process.
- Ondřej Surý is trending because his Debian and Ubuntu packages delivered fixes for old, unsupported PHP versions as far back as 5.6.
PHP2Shell is the nickname for two critical flaws in PHP, the server language behind a large share of websites, tracked as CVE-2026-109618 and CVE-2026-109619. Each is rated 9.2 out of 10 under CVSS v4.0 and can let an attacker run code on a web server without logging in. The fix is to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, released on October 21, 2026, or to a vendor package that carries the backported patch.
As of October 26, 2026, the PHP project, CERT-EU and the UK's National Cyber Security Centre all say updating is the only complete fix. Below: what the flaws are, which versions are affected, why Debian packager Ondřej Surý is part of the story, and how to check your own servers.
What is PHP2Shell?
PHP2Shell is not one bug but a pair of memory-handling flaws inside the PHP interpreter. The PHP project's October 21 security advisory describes CVE-2026-109618 as remote code execution through out-of-memory corruption, and CVE-2026-109619 as remote code execution through stale global state left behind between requests.
Because the problem sits in PHP itself rather than in any one application, it reaches every PHP setup that answers web requests. Both the PHP advisory and CERT-EU's advisory 2026-018 list PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates the risk highest for mod_php, where a demonstrated attack works before any application code runs.
The flaws are also old. heise online reports that every release from PHP 5 onward is affected, and Laravel Forge's advisory says the bugs date back to 2004. That is why University of Washington IT reminds admins that servers running WordPress, Drupal, Nextcloud or phpMyAdmin all need the PHP update.
According to heise, the flaws were first found by security firm Calif during a code audit with the PHP Ecosystem Security Team, sponsored through OpenAI's "Patch the Planet" initiative, with Wiz and OpenAI helping to reproduce them. The PHP2Shell label spread as details leaked ahead of the planned disclosure date.
Affected and fixed PHP versions
The PHP project shipped four fixed releases on October 21. If you run a supported branch, these are the minimum safe versions:
- PHP 8.5: update to 8.5.12
- PHP 8.4: update to 8.4.27
- PHP 8.3: update to 8.3.36
- PHP 8.2: update to 8.2.35
- PHP 8.1, 8.0, 7.4 and older: end of life, with no new official releases. PHP published minimal source backports for 7.4, 8.0 and 8.1 for distributions and people who build PHP themselves.
Each release note on php.net carries the same warning: "There are no complete mitigations, updating is the only safe choice." The PHP 8.6.0 RC4 test build also includes the fixes. PHP adds that the 8.2 branch reaches end of life on December 31, 2026.
For older branches, packagers filled the gap. Laravel Forge lists fixed package revisions such as 8.1.34-9, 1:8.0.30-25 and 1:7.4.33-31. These keep the old PHP version number, so the version alone will not tell you whether a server is protected.
Why Ondřej Surý is trending
Ondřej Surý is a Czech volunteer who has built PHP packages for Debian and Ubuntu for more than 20 years, according to a HeroDevs profile. His repositories, packages.sury.org and the ondrej/php PPA, are a common source of PHP on Linux servers. Laravel Forge, for example, installs PHP from them.
When the PHP project limited new releases to 8.2 through 8.5, Surý shipped backported fixes for branches as old as PHP 5.6. Sysadmin Mattias Geniar's patch tracker lists his fixed builds for PHP 5.6 through 8.1 and logs his first packages within minutes of the upstream release on October 21.
HeroDevs says his packaging work is unpaid and funded by donations, and that admins publicly credited him with rescuing Debian and Ubuntu users stuck on old PHP versions. That helps explain why his name is trending next to "php vulnerability." HeroDevs sponsors Surý and sells PHP support itself, which readers should keep in mind.
Timeline: from leak to patch
On October 20, release manager Jakub Zelenka posted advance notice on the PHP announce list of a security release set for October 21 at 14:00 UTC, covering two critical flaws. The team said it might release earlier if details became public. heise reports that public disclosure had been planned for October 22 and was pulled forward by a day after a leak.
The fixes landed on October 21. The UK NCSC issued an alert the same day, and WordPress.org told site owners to update PHP immediately. By October 22, heise listed Debian, Fedora, Gentoo, Ubuntu, Red Hat, Slackware and SUSE among the distributions shipping fixed packages.
On October 23, PHP published an informational advisory on a third issue, CVE-2026-115560. It only affects apps with an unusual session configuration, so PHP will fix it in the next regular release rather than with another emergency update. Until then, it suggests turning off session upload progress, the same setting already advised for CVE-2026-109619. CERT-EU updated its advisory the same day.
Is PHP2Shell being exploited?
Reports differ, and the picture may change quickly. CERT-EU says technical details are public and early proof-of-concept code is circulating, which "raises the likelihood that attackers are already exploiting the vulnerabilities."
On October 22, heise reported that Cloudflare had recorded millions of attempts and that Amazon now described the bugs as widely exploited, while also noting that no successful attacks had been confirmed. CircleID reported that security firm Patchstack saw probing on October 21 but, at that point, no hard evidence of successful breaches.
The response was unusually drastic. heise reports that Germany's BSI advised taking vulnerable sites offline, and that government sites in Denmark, Finland, France and the Netherlands, Berlin's Charité hospital site and parts of berlin.de went offline as a precaution. The NCSC says organisations that cannot patch or mitigate "should consider taking the system offline until it can be fully mitigated."
How to check and patch your server
The steps below are general information drawn from the official advisories. Follow your host's or vendor's instructions for your own systems.
- Find every PHP install. The NCSC advises listing all systems that run PHP, starting with internet-facing ones, and remembering that PHP can be bundled inside third-party products and appliances.
- Check the version. On a server, run php -v. In WordPress, go to Tools, then Site Health, then the Info tab and the Server section, as WordPress.org explains. On managed or shared hosting, Codeable advises confirming the patch with your host.
- Do not rely on the version number alone. Ubuntu, Red Hat and Surý's end-of-life builds often backport the fix without changing the version. Laravel Forge and Geniar both suggest checking the package revision or changelog for the two CVE numbers.
- Update through your package manager or vendor. Use your distribution's updates, a fresh official Docker image, or your control panel's PHP update. Geniar's tracker shows fixes for cPanel, Plesk, CloudLinux and LiteSpeed, with gaps for some very old branches.
- Restart everything that runs PHP. PHP-FPM, Apache, queue workers and other long-running processes keep the old code in memory until restarted, Laravel Forge warns. Geniar found that mod_php needed a full Apache restart rather than a graceful reload.
- Plan your move off end-of-life PHP. Backports for 8.1 and older are a stopgap. WordPress.org notes that versions before 8.2 no longer receive security updates from the PHP project.
Updating WordPress, plugins or themes does not fix PHP2Shell. WordPress.org says "No WordPress update is required or planned for these issues." The same is true for other PHP apps: the server's PHP has to be updated.
What about temporary mitigations?
PHP and CERT-EU list configuration changes, such as disabling session upload progress and tightening request size limits, that reduce exposure. Both stress that these do not make an installation safe. Firewall rules from providers such as Cloudflare, which heise and Codeable say extend to free plans, are an extra layer rather than a replacement for the update.
Our take
Based on the advisories cited here, PHP2Shell stands out for its reach. The flaws sit underneath every PHP application, span roughly two decades of releases, and leaked before the patch was out, which is why national agencies went as far as suggesting takedowns.
The quieter lesson is about who keeps old software safe. Many servers still run PHP versions the project no longer supports, and for a lot of them the fix arrived through a volunteer-run repository. Staying on a supported branch is the most reliable protection against the next emergency. The same logic applies to phones; our guide to which Samsung devices get One UI 9 covers update eligibility on the mobile side.
What to watch next
- A fix and full advisory for CVE-2026-115560 in PHP's next regular release.
- Whether agencies or vendors confirm successful compromises. As of October 26, 2026, reports of exploitation are mixed.
- PHP 8.2's end of life on December 31, 2026, and the PHP 8.6.0 release cycle, with RC5 planned for November 5.
Frequently asked questions
What is the PHP2Shell vulnerability?
PHP2Shell is the nickname for two memory-handling flaws in the PHP interpreter, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 under CVSS v4.0 and can allow unauthenticated remote code execution on servers that run PHP for web requests. The PHP project released fixes on October 21, 2026.
Which PHP versions fix PHP2Shell?
The fixed upstream releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are end of life and only get fixes through vendor or distribution backports, which often keep the old version number. Check your package revision or changelog for the two CVE numbers, and plan to move to a supported branch.
Do I need to update WordPress to fix PHP2Shell?
No. WordPress.org says no WordPress update is required or planned, because the flaws are in PHP itself. You can see your PHP version under Tools, Site Health, Info, Server, and should confirm with your host that the server's PHP has been patched.
Why is Ondřej Surý linked to the PHP vulnerability?
Ondřej Surý is a volunteer who maintains widely used PHP packages for Debian and Ubuntu, including packages.sury.org and the ondrej/php PPA. During PHP2Shell he shipped backported fixes for end-of-life PHP versions from 5.6 to 8.1, which the PHP project no longer updates. Admins publicly credited that work, which pushed his name into search trends.
Is PHP2Shell being actively exploited?
As of October 26, 2026, reports are mixed. CERT-EU says proof-of-concept code is circulating, and heise reported millions of attempts seen by Cloudflare, but also said no successful attacks had been confirmed. Officials advise patching immediately either way.
Sources
- [ANNOUNCE] Upcoming Critical PHP Security Release, The PHP Group (php.announce)
- PHP News Archive 2026 (security advisory and 8.x releases), The PHP Group (php.net)
- Security Advisory 2026-018: Critical Vulnerabilities in PHP, CERT-EU
- Critical security issue affecting PHP, UK National Cyber Security Centre
- Critical PHP Security Release, WordPress.org
- PHP security advisory (CVE-2026-109618, CVE-2026-109619), Laravel Forge
- php2shell: Critical flaws allow code injection in PHP, heise online
- php2shell: Updates roll out as websites go offline and attacks begin, heise online
- PHP2Shell: The Volunteer Who Patched PHP 5.6 Through 8.5, HeroDevs
- PHP CVE-2026-109618 and CVE-2026-109619: how to apply the patches, Mattias Geniar (ma.ttias.be)
- Critical PHP vulnerabilities (Oct 2026), University of Washington IT
- PHP Security Release on 21 October 2026: What WordPress Site Owners Need to Do, Codeable
- PHP Releases Emergency Security Patches as Researchers Report Exploit Attempts, CircleID
How we wrote this
GessyMorgan explainers are built from public reporting and official sources. This post draws on the 13 sources listed above, each linked where we use it. It was drafted with AI assistance and checked against those sources before publishing. We did not test products, attend events or interview anyone for this article. Facts are current as of October 26, 2026, and we update the post when they change.
