PHP2Shell: am I affected and how do I fix it?

MarkRelayJuggling email for all your products and sites? Managing it in one place is simpler.Unlimited domainsUnlimited mailboxesTeam access controlMCP + SkillsWebmail + Broadcast + API + WebhookMarkRelayJuggling email for all your products and sites? Managing it in one place is simpler.Unlimited domainsUnlimited mailboxesTeam access controlMCP + SkillsWebmail + Broadcast + API + WebhookGet MarkRelay

Critical · CVSS 9.2Fix released 2026-10-21Early attacks reported

PHP2Shell is a pre-auth RCE in PHP itself. Upgrade PHP, then restart it.

Two memory-safety bugs in the PHP engine (CVE-2026-109618, CVE-2026-109619) let an unauthenticated attacker run code or read server memory — passwords, API keys, session tokens — on almost any PHP version since 5.4, regardless of the app on top.

Not technical? Read PHP2Shell in plain English — what it means for your website or the SaaS tools you use.

Last reviewed 2026-10-26 · independent, vendor-neutral

Check your website

Enter a URL to see whether the site shows signs of PHP2Shell exposure.

Find PHP2Shell exposure without touching the target

The engine behind this checker, as TypeScript source. Run it in your own pipeline on as many sites as you need.

Ordinary GET requests only
No payloads or exploit attempts
Safe on production sites

$ npx tsx examples/check-website.ts shop.example.comhttps://shop.example.com/  verdict:      outdated  PHP versions: 8.1.2  PHP signal:   header X-Powered-By: PHP  hosting:      Hostinger [shared-hosting]  requests:     1 GET

Seven verdicts, with evidence
One clear outcome per site, backed by every request and response.
Handles the hard cases
Hidden versions (30+ PHP apps), distro backports, WAF challenges, non-PHP stacks.
Fits any pipeline
Table, JSON or CSV. Node, Workers, Deno or Bun, through your own proxy.
Updates included
Re-download the latest release, with new detectors, at no cost.

$99USD

One-time payment · no account needed

Secure payment by Stripe. After payment you can download the package from this page at any time, in the same browser.

What you get

Full TypeScript source, not obfuscated
Test suite with fixtures from real sites
README and runnable examples

Licence

Use it internally, on any number of sites
Run it for your clients, including as a hosted service
Do not resell, share or publish the source code

$99

Check a PHP version

Paste a version, the output of php -v, or one version per line for a whole fleet. Runs entirely in your browser.

Try:

The CLI and the web server can run different PHP builds. Check the version your web server actually uses: php-fpm -v (or php-fpm8.3 -v), or phpinfo() served by that site. Version results assess CVE-2026-109618 and CVE-2026-109619 only. They cannot assess the configuration-dependent CVE-2026-115560; see the session configuration guide.

Branch	Vulnerable	Fixed in
8.5	< 8.5.12	8.5.12
8.4	< 8.4.27	8.4.27
8.3	< 8.3.36	8.3.36
8.2	< 8.2.35	8.2.35
8.1 · 8.0 · 7.4	all	Source backport only
5.4 – 7.3	all	No fix

PHP 8.2 leaves security support on 2026-12-31

Patching to 8.2.35 fixes PHP2Shell, but you will need to move again before the end of 2026. If you are migrating anyway, target 8.4 or 8.5.

What national CERTs say

Germany’s BSI rates PHP2Shell 3 / Orange (“act immediately”) and says only patching or disconnecting from the internet fully protects; reports that the patch can be bypassed were refuted. Japan’s JPCERT/CC and IPA and CERT-EU also advise updating without delay.

Do this now

In this order. Nothing else is a complete fix.

01
Find every PHP runtime
Web servers, containers, base images, shared hosting, staging. The CLI version can differ from what PHP-FPM or Apache runs.
How
02
Install a fixed release
8.5.12 · 8.4.27 · 8.3.36 · 8.2.35, or your distro’s patched package. Updating WordPress/Drupal/Laravel does not update PHP.
How
03
Restart everything that runs PHP
PHP-FPM pools, Apache (mod_php), FrankenPHP, queue workers, Octane/RoadRunner/Swoole. Old processes keep the old code in memory.
How
04
Verify, then look back
Confirm the version the web server reports. Review logs since early October 2026 and rotate secrets if anything looks wrong.
How

Can’t upgrade today? Temporary mitigations reduce exposure to the known attack paths. On shared hosting? See hosting.

Guides for your setup

Is it being exploited?

Status as of 2026-10-23. Reports differ; assume capable attackers have working exploits.

AWS MadPot reports an exploitation attempt on 17 October 2026, before public disclosure, and further attempts on 21 October at 02:00–08:00 UTC. AWS says it is unclear whether these attempts would have succeeded on real systems. This is honeypot telemetry, not confirmation of a production compromise.
Cloudflare (CTO Dane Knecht): “We are seeing early attacks emerging and are updating mitigations as new vectors show up.”
watchTowr reports exploitation attempts against both CVEs in its honeypot network; on 21 October it told SecurityWeek that none had succeeded so far. Hadrian, Patchstack, Cloudflare and Vega also reported attempts.
Sophos withdrew its 22 October 16:18 UTC report of one successful exploitation. Its 21:21 UTC correction says its telemetry shows scanning and a small number of failed attempts, with no evidence of a successful compromise.
Sansec (22 October): the public exploits do not work against a default PHP installation; most need an existing local file inclusion bug in the application, and nobody has shown one request that works against any vulnerable server. Sansec still says to update PHP.
Red Hat rates both CVEs Important: reliable exploitation needs precise heap manipulation and timing, and it considers RCE difficult on its default PHP-FPM setup, with mod_php at higher risk (RHSB-2026-013).
The Dutch NCSC said it had not seen abuse at the time and treats every internet-facing PHP system as vulnerable until patched.
Neither CVE appears in the CISA KEV snapshot dated 21 October 2026. That does not establish absence of exploitation. Investigate attempts and possible memory disclosure separately from confirmed code execution.
Treat exploit and scanner repositories as untrusted. Public availability does not establish accuracy or safety. Prefer vendor checks, and never test unknown scripts on production systems.

Organisations that went offline (BambooHR, DigiD…) →

Which server setups are exposed

mod_php is the most clearly exploitable, but every SAPI that serves web requests needs the patch.

Setup	…109618	…109619	Notes
Apache + mod_php	RCE confirmed	RCE confirmed	Both CVEs validated to RCE with default limits. Highest-risk setup.
PHP-FPM (nginx, Apache, Caddy…)	Susceptible	RCE confirmed	Session-lifecycle RCE validated on FPM. OOM path confirmed through application-level code paths; no generic FPM exploit published.
FrankenPHP / LiteSpeed LSAPI	Likely	Likely	Advisory rates them likely susceptible. Long-lived workers make cross-request state more relevant, not less.
CLI (cron, queue workers, artisan)	Not covered	Not covered	Not discussed by the advisories and not reachable by HTTP requests in normal use. Upgrade anyway — it is the same package.

Coordinated release schedule in your time zone

The coordinated target was 21 October 2026 at 14:00 UTC. It is not a verified first-availability time for binaries or packages. See the timeline for the differing publication timestamps.

Time zone	Patch released	Date
UTC	14:00	Tue 21 Oct 2026
US Pacific (PDT, UTC−7)	07:00	21 Oct
US Central (CDT, UTC−5)	09:00	21 Oct
US Eastern (EDT, UTC−4)	10:00	21 Oct — “EST” searches mean this
UK (BST, UTC+1)	15:00	21 Oct
Central Europe (CEST, UTC+2)	16:00	21 Oct — NL, BE, LU, DE, AT, FR…
India (IST, UTC+5:30)	19:30	21 Oct
China / HK / SG (UTC+8)	22:00	21 Oct
Japan (JST, UTC+9)	23:00	21 Oct
Sydney (AEDT, UTC+11)	01:00	22 Oct

What an attacker can do

Run code without logging in

Code execution as the PHP worker user (e.g. www-data): web shells, data theft, defacement, lateral movement.

Read other requests’ memory

Worker memory can hold DB passwords, API keys, session cookies, TLS material and other users’ form data.

Leak data quietly

The memory-disclosure path needs no code execution, so tools that watch for malicious processes may never fire.

Common mistakes

The fastest ways to think you are safe when you are not.

If you think…	Reality
“I updated WordPress / my plugins.”	The bug is in the PHP interpreter. Application updates do not touch it. A plain “Hello World” script on a vulnerable PHP is exposed.
“I set session.upload_progress.enabled = 0.”	That blocks some confirmed paths of one CVE. It does nothing for CVE-2026-109618. PHP’s own developers say the only mitigation is upgrading.
“I ran apt upgrade, so I’m done.”	Running PHP-FPM / Apache processes keep the old binary in memory until restarted.
“php -v says I’m patched.”	That is the CLI. The web server may use a different package, container or version. Check `php-fpm -v` or `phpinfo()`.
“I’m behind Cloudflare / a WAF.”	WAF rules reduce risk on known payloads; attackers are already mutating them, and origins are often reachable directly. It buys time, it is not the fix.
“My version looks old, so I’m vulnerable.”	Maybe not. Debian, Ubuntu and RHEL backport fixes without changing the upstream number. Check the package changelog.

The two CVEs at a glance

How it unfolded

2026-10-17AWS retrospectively identifies a MadPot exploitation attempt on 17 October. It does not establish successful compromise of real systems; the report was published on 21 October.
2026-10-20 15:00 UTCCVE IDs start circulating on forums and social media, with an incorrect CVSS 10.0.
2026-10-20 19:30 UTCPHP publishes its pre-announcement early.
2026-10-20 ~20:00 UTCCalif mistakenly publishes a video showing its proof of concept.
2026-10-20 23:00 UTCMitigation advice goes out to some critical-infrastructure providers, and may have leaked.
2026-10-21 03:02 UTCCloudflare WAF rules go live for all plans, including Free.
2026-10-21 07:41 UTCChainguard ships fixed images, breaking the embargo by more than six hours.
2026-10-21 11:51 UTCBambooHR takes its service offline as a precaution (US, Canada, Ireland).
2026-10-21 (CEST)Dutch government and education sites, including DigiD and MijnOverheid, go offline as a precaution.
2026-10-21 14:00 UTCScheduled coordinated release (not a verified first-availability time): PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, plus source backports for 7.4, 8.0, 8.1. Originally planned for Oct 22.
2026-10-21 15:03 UTCBambooHR reports the fix applied and testing under way.
2026-10-21 18:01 UTCBambooHR restores service after patching and validation; monitoring continues.
2026-10-21 21:15 UTCAlmaLinux moves patched PHP packages for every stream on AlmaLinux 8, 9 and 10 into its production repositories.
2026-10-22 00:07 UTCCloudLinux completes the stable-repository release of fixed alt-php packages for CloudLinux OS 7, 8 and 9.
2026-10-23PHP publishes an informational advisory for the separate CVE-2026-115560: an unusual session serializer switch with upload progress enabled can permit RCE. It recommends keeping upload progress disabled until the next regular bugfix release.
2026-10-25Palo Alto confirms release of PAN-OS 10.2.18-h13, 11.1.16-h4 and 11.2.10-h16. Other maintenance branches retain their own fix schedules; this is not confirmation that every PAN-OS deployment is patched.
2026-10-25Oracle publishes a PHP2Shell Security Alert covering Solaris 11 and eight Communications products. It states that the listed patches cover both original CVEs; installation must be verified per product.

Full timeline from the 2024 audit → · Compared with 2021’s Java bug: PHP2Shell vs Log4Shell →