PHP Security Update October 2026: PHP2Shell Fix Guide

If your website runs on PHP, patch it today. On 21 October 2026, the PHP team shipped an emergency security release for two critical flaws, nicknamed PHP2Shell, that can let an attacker run commands on a web server without logging in. The UK National Cyber Security Centre (NCSC) and the US CISA have both issued alerts urging organisations to act immediately.

This guide explains what happened, who is affected and how to check your own PHP version on any kind of hosting. It also gives you a clear roadmap to fix and protect your site. Last updated: 22 October 2026. This story is moving quickly, so we will keep this page current.

PHP2Shell at a Glance

Detail	Information
Release date	21 October 2026 (emergency, out-of-band release)
CVE identifiers	CVE-2026-109618 and CVE-2026-109619
Severity	9.2 Critical (CVSS v4.0), for each flaw
Impact	Unauthenticated remote code execution
Fixed versions	PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (plus source-only backports for 7.4, 8.0 and 8.1)
Who is affected	Any PHP installation serving web requests: mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed
Exploitation	Active exploitation attempts reported by watchTowr and others (see below)
Official alerts	UK NCSC and CISA (21 October 2026), NCSC-NL and CERT-EU guidance

What Happened

PHP published fixes for two vulnerabilities that share the same root: how PHP behaves when it runs out of memory. An attacker can push PHP into an out-of-memory state at a bad moment, leave its internal data half built, and under certain conditions turn that corruption into remote code execution. According to the NCSC, this can happen without authentication and may affect any web server running PHP.

The details leaked before the planned disclosure, so PHP announced an emergency release on 20 October and shipped it on 21 October at 14:00 UTC. Researchers have since published technical analyses and a public proof of concept. Wiz’s write-up credits AI with helping to uncover the flaws, and fake “proof-of-concept” and “patch” scripts are already circulating.

Are attackers really exploiting it?

Treat it as yes. Security firm watchTowr reports it is observing active exploitation attempts against both CVEs, and Datadog Security Labs reports that Amazon saw exploitation attempts as early as 17 October, four days before the public release. That earlier date comes from a single source, so treat it as indicative rather than final. At the time of its alert, CISA said it had not itself observed exploitation. Either way, internet-wide scanning for a flaw like this starts within hours.

Some security vendors and Cloudflare have added firewall rules for the known attack patterns. That helps, but it is a seatbelt, not a repair. The only complete fix is updating PHP itself.

Why This Matters to Almost Every Business

PHP is the engine behind a very large part of the web. W3Techs reports that PHP is used by roughly 70% of all websites whose server-side language is known (70.8% as of 15 July 2026). WordPress, WooCommerce, Magento, Drupal and Laravel applications all run on it.

That reach is why this flaw is so serious. An analysis by OX Security, based on Shodan data from 21 October 2026, counted roughly 2 million internet-facing PHP servers running affected versions. Almost none of the identifiable servers had been patched at that point, and about 69% (1.37 million) ran old PHP versions that will never receive an official fix. That count only includes servers that reveal their PHP version, so the real number is likely higher. Other trackers use different methods and report different totals, but they all point the same way: a huge unpatched population.

The lesson is simple. Waiting for “a convenient time” is not a strategy.

The Two Flaws

CVE-2026-109618: remote code execution through out-of-memory corruption. When PHP runs out of memory while handling a request, it can be interrupted while some internal data is only partly set up. Cleanup code then treats that unfinished data as valid, which opens the door to memory corruption.

CVE-2026-109619: remote code execution through stale state. Some internal state belonging to one request can survive after the memory behind it has been freed. A later request handled by the same PHP worker may then use that stale state before it is reset.

Technical analysis points to the form and file upload handling that runs before your own code starts, and the session upload progress feature, which is on by default. In practice that means the weak point sits inside PHP itself, not in your theme, plugin or application code. Your site can be perfectly written and still be exposed.

Is Your Website at Risk?

Treat this as urgent if any of these apply:

• Your site runs any PHP version below 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
• You use mod_php with Apache, PHP-FPM, php-cgi, FrankenPHP or LiteSpeed. Reports say mod_php setups face the highest danger.
• You run WordPress, WooCommerce, Magento, Drupal or Laravel. Updating your CMS, themes or plugins will not fix this. The fix is on the server runtime.
• You are on PHP 8.1 or older, which the PHP project no longer supports normally. Use PHP’s source backports, a vendor patch or move to a supported branch.
• You use Docker images or appliances that bundle their own PHP. These need a rebuild or a vendor update.
• You rely on a volunteer-run package repository such as rpms.remirepo.net. PHP’s advisory says it was not expected to have updates ready on release day and urges users to switch to distribution packages or build from source.
• You do not know which PHP version your hosting provider runs.

Managed hosts often patch for you, but “often” is not “confirmed.” Ask for the exact PHP build running on your account.

How to Check Your PHP Version (and Whether You Are Really Patched)

Before you patch, find out what is actually running on the web. The version your command line reports can differ from the one serving your site.

On WordPress

Go to Tools → Site Health → Info → Server and read the PHP version. This shows what your web server is using right now.

On shared or managed hosting

In cPanel open MultiPHP Manager. In Hostinger hPanel look under the PHP configuration for your website. In Plesk open PHP Settings. Pick the newest build of your branch, or ask support to confirm the exact patch version in writing.

With a temporary phpinfo() page

If you cannot see the version anywhere else, upload a one-line file containing <?php phpinfo();, open it in your browser, note the version, then delete the file immediately. It exposes sensitive server details.

On a VPS or dedicated server

php -v                              # command-line PHP (may differ from the web)
php-fpm8.3 -v                       # or php-fpm -v, for the FPM binary
apachectl -M | grep -i php           # is mod_php loaded?

Then update through your package manager and restart the service that actually serves PHP. The unit names below are examples, so adjust them for your PHP branch:

# Debian / Ubuntu
sudo apt update && sudo apt upgrade
sudo systemctl restart php8.3-fpm   # and/or: sudo systemctl restart apache2

# RHEL / Alma / Rocky
sudo dnf upgrade "php*"
sudo systemctl restart php-fpm      # and/or: sudo systemctl restart httpd

With Docker and containers

Updating the host does nothing for a container that carries its own PHP. Pull a patched base image (for example a newer php:8.3-fpm tag), rebuild your application image and redeploy so every running container is replaced. Check anything that bundles PHP too, such as control panels, appliances and CMS platforms in a box.

The 7-Step PHP2Shell Fix Roadmap

These steps follow the priorities the NCSC recommends, turned into a practical plan for site owners and business teams.

Step 1: Find every PHP system (today)

List all production sites, staging servers, subdomains, microsites, containers and old projects. Start with anything reachable from the internet. Do not limit your search to old versions, because every PHP installation may be affected. Also look for products that bundle PHP, such as control panels, appliances and plugins. NCSC-NL has published an inventory of software with a PHP dependency that may be affected.

Step 2: Know your target version

Your PHP branch	Update to
8.5	8.5.12 or later
8.4	8.4.27 or later
8.3	8.3.36 or later
8.2	8.2.35 or later, then plan your move (security support ends 31 December 2026)
8.1, 8.0, 7.4	PHP has published minimal source backports, and some vendors (for example CloudLinux and Ubuntu ESM) ship their own patched packages. Use those or, better, move to a supported branch.
Older than 7.4	Move to a supported branch, or ask your vendor for a fix. Do not leave it facing the internet.

Step 3: Patch and restart (today)

Back up your files and database first. On managed hosting, switch to the fixed version in your control panel or ask support to do it. On a VPS or dedicated server, update through your package manager or build from source, then restart PHP-FPM or Apache so the new build is actually running. For containers, rebuild and redeploy. Confirm with php -v and a check of the web server’s PHP version, since the command line can differ from the web.

Step 4: If you cannot patch right now

Limit public access to the unpatched instance, put a web application firewall in front of the site, and ask your host for a patch date in writing. The NCSC goes further: if a system cannot be updated or mitigated quickly, consider taking it offline until it is fixed. A temporary maintenance page costs far less than a compromised server.

You may also see two settings suggested as stopgaps, based on the Datadog analysis of CVE-2026-109619. Apply them in the main PHP configuration (not per-request), and restart every worker afterwards:

• session.upload_progress.enabled=0
• fatal_error_backtraces=0 (PHP 8.5 only)

Step 5: Check for signs of compromise

If your server was exposed before patching, assume nothing. Because exploitation attempts were reported from around 17 October, review logs back to at least that date. Preserve copies of logs and configuration before you change anything. Look for:

• A web worker starting a shell. PHP, Apache or php-fpm processes spawning sh or bash is the strongest warning sign. A successful attack can still return a normal HTTP 200 and leave the worker running.
• Unusually large form submissions. POST requests (application/x-www-form-urlencoded) with enormous field names, or binary data in a field with an empty name.
• Memory errors before any script runs. PHP log lines like Allowed memory size of … bytes exhausted followed by Unknown on line 0.
• Crashing workers. Apache log entries such as child pid … exit signal Segmentation fault can indicate failed attempts.
• New footholds. Unfamiliar files in upload and plugin folders, new admin users, unexpected scheduled tasks and odd outbound connections.

Attackers who get code execution often leave backdoors that survive the update. If you are not confident doing this yourself, bring in a professional incident response team. Also make sure your firewall or proxy actually inspects large request bodies, because rules that only look at the first part of a request can be bypassed.

Step 6: Rotate secrets if anything looks wrong

Change database passwords, API keys, SMTP credentials and CMS secret keys, and force password resets for admin accounts. Do this only after the server is clean, otherwise the new secrets can be stolen too.

Step 7: Harden and plan ahead

Disable PHP extensions you do not use, run each site under its own low-privilege user, keep your firewall rules current and enforce HTTPS. Subscribe to the official PHP announcements and set a monthly patch window. The researchers expect more instances of this bug pattern to surface, which is exactly why a routine matters more than a one-off panic. Finally, schedule your move off PHP 8.2 before security support ends on 31 December 2026. Our guide to a monthly WordPress maintenance checklist is a good starting routine.

Your Quick Timeline

When	What to do
Today	Inventory PHP systems, back up, patch, restart
Within 24 hours	Add firewall rules, restrict or isolate anything unpatched
Within 48 hours	Scan for compromise, review logs back to 17 October, rotate secrets if needed
This week	Move any PHP 8.1 or older site to a supported branch (or confirm a vendor backport)
Before 31 Dec 2026	Upgrade off PHP 8.2
Every month	Review and apply PHP and CMS security updates

Mistakes to Avoid

• Assuming the September update was enough. It was not. You need the October builds.
• Updating WordPress and stopping there. The flaw is in PHP, not in your plugins. See our guide on protecting your WordPress site for the wider picture.
• Forgetting the restart. An installed patch is not a running patch.
• Forgetting containers. A patched host does not patch the PHP inside your Docker image.
• Running random exploit or “patch” scripts. Fake proof-of-concept code and booby-trapped detection scripts are circulating. Use only official sources.
• Ignoring old and forgotten sites. Unmaintained microsites are the easiest targets.
• Patching without checking for compromise. An update closes the door but does not remove an intruder who is already inside.

How Can You Fix and Protect Your PHP Website

Patching a PHP website sounds simple until a plugin breaks, a legacy site fails on the new version, or nobody knows which server runs what. Our PHP development team handles the whole job:

• PHP2Shell exposure check: we map every PHP version, server and website you run, including forgotten ones.
• Safe patching and upgrades: backup, staging test, update, restart and verification, with a rollback plan.
• Compromise assessment: we review files, users, scheduled tasks and logs for signs of intrusion.
• Hardening and monitoring: secure configuration, firewall rules, uptime checks and a regular patch schedule through our WordPress support and maintenance services.
• Version migration: a tested path off PHP 8.2 and older branches for WordPress, WooCommerce, Magento, Laravel and custom PHP sites. If you are budgeting for it, see our PHP development cost guide.

Do not wait for a scan to find you first. Contact us to request a PHP security check, and we will tell you exactly where your website stands and what to fix first.

Frequently Asked Questions

What is PHP2Shell?

PHP2Shell is the name used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Each is rated 9.2 on CVSS v4.0 and can allow unauthenticated remote code execution on servers that handle PHP web requests.

Which PHP versions fix it?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP has also published source-only backports for 7.4, 8.0 and 8.1, and some vendors ship their own patched packages. Anything older needs a vendor fix or a move to a supported version.

Is PHP2Shell being exploited right now?

Security researchers, including watchTowr and Datadog, report exploitation attempts in the wild, and Datadog reports activity from around 17 October. CISA said it had not observed exploitation when it published its alert. Treat every unpatched server as a target.

Does updating WordPress fix it?

No. WordPress runs on PHP, and the flaw is in PHP itself. Update the PHP version on your server or hosting account.

I already installed the September PHP update. Am I safe?

No. The September releases (8.5.11, 8.4.26, 8.3.35 and 8.2.34) are below the new fixed versions, so you need the October update as well.

How do I check which PHP version my website uses?

In WordPress, open Tools → Site Health → Info → Server. On hosting panels such as cPanel, hPanel or Plesk, check the PHP version or PHP selector. On a server, run php -v and also confirm the version your web server uses, because they can differ.

Will a firewall or Cloudflare protect me?

A web application firewall can block known attack patterns and is worth enabling, but it is only a stopgap. Rules that miss large or unusual requests can be bypassed. Update PHP.

Can I just change a PHP setting instead of updating?

Not safely. Settings such as disabling session upload progress reduce one attack path, but PHP says no configuration change fully closes the vulnerability. Use them only until you can patch.

What if my host has not patched yet?

Ask for a date in writing, add firewall protection, and consider moving the site to a patched environment or taking it offline until it is fixed.

Will updating PHP break my website?

A patch release within the same branch (for example 8.3.35 to 8.3.36) rarely breaks anything, but you should still back up and test. Moving to a newer branch is a bigger change and is best tested on staging first.

Final Thoughts

PHP2Shell is one of the most serious PHP vulnerabilities in years, and the fix is available now. Find your PHP systems, patch and restart, check for compromise, then harden your setup so the next alert is a routine task. If you want a specialist team to do it with you, 1Solutions is ready to help.

Sources

• UK NCSC: Critical security issue affecting PHP (21 October 2026)
• CISA: Critical Vulnerabilities in PHP Require Immediate Patching (21 October 2026)
• NCSC-NL: Operational information on the php2shell vulnerabilities (GitHub)
• Datadog Security Labs: PHP2Shell technical analysis and detection guidance
• watchTowr: PHP remote code execution and exploitation status
• OX Security: CVE-2026-109618 and CVE-2026-109619 analysis (21 October 2026)
• PHP.net: supported versions
• W3Techs, PHP usage statistics, 15 July 2026