PHP2Shell: All you need to know about the security flaws putting websites at risk and how to fix them

PHP has released emergency security updates for two critical flaws that could let hackers run malicious code on a web server without logging in.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. They affect PHP itself, the programming language behind websites and applications such as WordPress, Drupal and Joomla. Each scores 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS), which makes them critical.

What is PHP2Shell?

PHP runs on a web server. It handles visitors’ requests, pulls information from databases, processes forms and builds pages.

PHP2Shell is two bugs in how the language handles memory and the state of a web request, according to security firm Qualys. They sit in PHP itself, not in WordPress, Drupal or Joomla.

WordPress says the flaws affect any server hosting a PHP application and that no WordPress update is required or planned.

The first flaw, CVE-2026-109618, appears when PHP runs out of memory mid-request and leaves data half set up. The second, CVE-2026-109619, occurs when PHP keeps pointing to request data after the memory behind it has been freed.

Wiz, one of the firms that reported the bugs, says it demonstrated attacks that run code on WordPress and Drupal sites before login. It adds that one flaw can also leak the memory of a running PHP process.

An attacker needs no account. What follows depends on the server’s setup and the permissions the compromised PHP process holds.

Read also: Your WordPress Website Could be at Risk Due to a Newly-Discovered Flaw, Here’s What You Can do to Protect it

Who is exposed?

PHP says any installation serving web requests is at risk. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

PHP says the risk is highest for Apache’s mod_php. It says a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs.

Wiz says affected versions go back to PHP 5.4. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive updates from the project. PHP provides minimal source backports for 7.4, 8.0 and 8.1 to people who build from source or have no vendor support.

PHP says 8.2 stops getting security fixes at the end of the year, so those users should plan an upgrade.

Some Linux distributions and vendors may backport the fixes to older versions, so check their advisories. Where none exist, plan a move to a supported version. Products, containers and hosting panels that bundle their own PHP need separate updates.

Why did the release come early?

Details of the flaws leaked online a day before the planned disclosure, according to security firm Huntress. PHP brought the release forward and published the fixes on October 21.

Sansec, another security firm, says it expects mass exploitation now that the patches and technical write-ups are public. It says Cloudflare has already reported early attacks.

Also read: NITDA issues urgent warning to website owners against Jupiter X Core WordPress plugin

What you should do now

Updating WordPress, Drupal, Joomla or a plugin will not fix a flaw in PHP itself. Take these steps:

Update PHP. Install a fixed version through your package manager, then confirm the web server is using it. WordPress users can see their version under Tools > Site Health > Info > Server. Many hosts show it in their control panel too.

Check every installation. Look at containers, control panels and any application that bundles its own PHP.

Ask your host. On shared hosting you may not control PHP. Ask your provider whether it has patched, and do not assume it has. WordPress says hosts may already be patching and adding firewall rules. It still advises checking with your host.

Watch your repository. Sansec warns that Remi’s repository, common on PHP servers, did not have the fix on release day. It advises using your distribution’s packages or building from source.

Use mitigations only as a stopgap. PHP says there are no complete mitigations, and updating is the only safe choice. Measures, such as capping request sizes and switching off upload tracking, do not make an installation safe.

Check for compromise. Look for unexpected processes launched by PHP, unfamiliar files and odd outbound connections. A patch will not remove malware already planted.

Ordinary visitors cannot fix this, because the flaws sit on servers rather than phones or laptops. That does not mean every PHP website has been hacked. Updating to a fixed version is the only complete fix.