PHP Vulnerability 2026: PHP2Shell Explained and How to Patch It

The latest PHP vulnerability is one of the most serious the language has faced. On October 20, 2026, the PHP security team announced an emergency security release for two critical flaws in the PHP runtime, and patches went out the next day. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws are together known as the PHP2Shell vulnerability.

Both are rated 9.2 (Critical) under CVSS v4.0, and both allow unauthenticated remote code execution. An attacker doesn’t need a login, a password or any access to your application to run code on a vulnerable server.

If your business runs a website, customer portal, CMS or internal application on PHP, this PHP security vulnerability needs your attention today. This guide explains what PHP2Shell is, who is affected, and how to apply the PHP patch.

What Is a PHP Vulnerability?

A PHP vulnerability is a security flaw in the PHP runtime, its extensions, or in applications written in PHP that an attacker can exploit. Depending on where it sits, a flaw can let attackers read sensitive data, crash a server, or in the worst cases run their own code on it.

PHP vulnerabilities generally fall into two groups:

• Application-level vulnerabilities: flaws in code written in PHP, such as SQL injection, cross-site scripting or insecure file uploads. These are fixed by changing the application code.
• Runtime-level vulnerabilities: flaws in the PHP engine itself. These affect every application running on that PHP version, however well it’s written, and can only be fixed by updating PHP.

The PHP2Shell vulnerability is a runtime-level flaw, which is why it affects so many businesses at once.

Is Your PHP Server at Risk?

Our engineers find, patch and verify every vulnerable PHP installation.

Talk to Our PHP Expert!

PHP Vulnerability October 2026: Timeline

• October 20, 2026: The PHP security team gave advance notice of an emergency security release for two critical vulnerabilities. Details had already begun leaking publicly the same day.
• October 21, 2026: PHP released the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, along with full advisories.
• October 21, 2026: Government cyber agencies, including the Canadian Centre for Cyber Security and Singapore’s Cyber Security Agency, issued alerts urging organisations to patch immediately.

What Is the PHP2Shell Vulnerability?

PHP2Shell is the name given to two separate flaws in PHP’s core runtime. Both sit in the PHP engine itself, not in a plugin, framework or line of your own code. Even a well-written, fully updated application is exposed if it runs on a vulnerable version of PHP.

CVE-2026-109618: Out-of-Memory Handling

The first flaw is in how PHP handles an out-of-memory condition. When a request pushes PHP to its memory limit, the runtime is supposed to fail safely. Because of this flaw it doesn’t, and an attacker who triggers the condition on purpose can turn the failure into code execution on the server.

CVE-2026-109619: Stale State and Use-After-Free

The second flaw involves internal state that outlives the memory it depends on. PHP keeps some data tied to each incoming request. If that data isn’t properly reset before its memory is released, PHP can later read memory that no longer belongs to it. This is known as a use-after-free bug, and an attacker can use it to execute code.

Why the PHP2Shell Vulnerability Is So Serious

• No authentication required. Attackers don’t need valid credentials.
• Remote code execution. A successful attack can give an attacker control of the server, including its files, databases and connected systems.
• No complete workaround. In its official release notes, the PHP team states that there are no complete mitigations and that updating is the only safe choice.

Security vendors have reported attack attempts since the disclosure, although CISA had not confirmed active exploitation as of its October 21 alert. Either way, unpatched internet-facing servers are a clear target.

Who Is Affected by the Latest PHP Vulnerability?

Any PHP installation that serves web requests should be treated as at risk until it’s patched. That includes:

• PHP-FPM
• Apache with mod_php
• php-cgi
• FrankenPHP
• LiteSpeed

Apache with mod_php carries the highest risk, because the flaw can be triggered before your application code runs at all.

Affected and Fixed PHP Versions

PHP branch	Status	Upgrade to
PHP 8.5.x	Vulnerable before 8.5.12	8.5.12
PHP 8.4.x	Vulnerable before 8.4.27	8.4.27
PHP 8.3.x	Vulnerable before 8.3.36	8.3.36
PHP 8.2.x	Vulnerable before 8.2.35	8.2.35
PHP 8.1 and older	No official release	Upgrade to a supported branch

PHP is often present in places you might not expect. Singapore’s Cyber Security Agency advises organisations to check for PHP inside third-party applications and components, even if their main website doesn’t use it. Include Docker containers, CI/CD images and staging servers in your review too.

Is Your PHP Server at Risk?

Our engineers find, patch and verify every vulnerable PHP installation.

Talk to Our PHP Expert!

How to Check Your PHP Version

Before you can apply the PHP patch, you need to know what you’re running.

From the Command Line

On a server you manage, run:

php -v

This shows the CLI version. The version serving web traffic can be different, especially on servers with several PHP versions installed, so confirm it with one of the methods below as well.

From a phpinfo() Page

Create a temporary file containing <?php phpinfo(); ?>, open it in a browser and check the version at the top. Delete the file right after, because it exposes server details.

On Shared or Managed Hosting

Look for the PHP version in your hosting control panel (cPanel, Plesk or your provider’s dashboard). For WordPress sites, go to Tools → Site Health → Info → Server.

In Containers

Check the base image tag in your Dockerfile and rebuild if it points to a vulnerable PHP version.

What to Do Now: PHP Patch Checklist

Work through these steps in order, starting with internet-facing systems.

1. Inventory every PHP installation. List production servers, staging environments, containers, CI images and third-party products that bundle PHP. Note each version.
2. Prioritize by exposure. Patch public-facing servers first, especially any running Apache with mod_php.
3. Apply the PHP security update 2026. Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch.
4. Don’t assume automatic updates are enough. The Laravel Forge guide, for example, notes that Ubuntu’s unattended upgrades won’t patch PHP installed from a separate package repository. Confirm the installed version after upgrading.
5. Restart PHP services and long-running processes. Restart PHP-FPM, Apache or your web server. Long-running CLI processes such as queue workers keep running the old version until they’re restarted.
6. Rebuild and redeploy containers. Pull the patched base image, rebuild and redeploy. Running containers won’t update themselves.
7. Check with your hosting provider. On shared or managed hosting, ask when the patched version will be deployed and confirm it afterward.
8. Look for signs of compromise. Review servers for unexpected processes, new or modified files, unfamiliar user accounts and unusual outbound connections linked to PHP or your web server.
9. Verify and document. Re-check each system’s version after patching and record what was updated and when.

Temporary Mitigations If You Can’t Patch Immediately

If a server can’t be patched right away, reduce its exposure while you prepare the update:

• Restrict access. Limit the application to known IP ranges or put it behind a VPN where possible.
• Use a web application firewall (WAF). Several WAF and CDN providers have released rules targeting PHP2Shell attack patterns.
• Apply the configuration changes listed in the official advisory. The PHP team has published partial, configuration-level mitigations for specific exploit paths. Apply them exactly as written in the advisory on php.net, and test them first, because some can affect application behavior.
• Take non-essential systems offline until they’re patched.

These steps lower the risk but don’t remove it. The PHP team is clear that updating is the only complete fix.

What If You’re Running PHP 7.x or PHP 8.1?

This is the hardest situation. PHP 8.1 and older branches have reached end of life and receive no official release for PHP2Shell. The PHP security team has published minimal source-level backports for PHP 7.4, 8.0 and 8.1, but these only help teams that build PHP from source themselves.

For most businesses, there are three practical options.

Option 1: Upgrade to a Supported PHP Branch

The long-term fix is to move to a supported version (8.2 to 8.5) and apply the patch. Older codebases may need work first, such as replacing deprecated functions, updating dependencies, and testing for behavior changes between major versions. PHP 8.2’s security support ends on December 31, 2026, so 8.3 or later is the safer target.

Option 2: Use Extended Support as a Stopgap

Some vendors offer commercial extended-support patches for end-of-life PHP versions. This can buy time, but it isn’t a permanent fix, and it keeps you on an aging platform.

Option 3: Isolate the System While You Upgrade

Restrict public access, put the application behind a web application firewall, or take non-essential systems offline until they can be upgraded.

Other PHP Security Vulnerabilities in 2026

PHP2Shell is the most severe PHP vulnerability of 2026, but not the only one. In July 2026, PHP released security updates (8.5.9, 8.4.24, 8.3.33 and 8.2.33) that fixed several PHP security vulnerabilities, including:

• CVE-2026-17543: a SQL injection issue in the PostgreSQL (PGSQL) extension
• CVE-2026-7260: a crash in the Phar extension caused by recursive symlinks
• CVE-2026-17544: an out-of-bounds write in BCMath’s bccomp() function (PHP 8.4 and 8.5)
• CVE-2026-9672: a fix delivered through an upgrade of the bundled libgd library

Another round of security releases followed in September 2026. PHP ships security fixes regularly, and businesses that fall behind on updates build up risk with every release.

How to Protect Against Future PHP Vulnerabilities

PHP2Shell won’t be the last critical PHP vulnerability. A few habits make the next one far easier to handle:

• Stay on a supported PHP version. Only supported branches get official security fixes. Track PHP’s supported-versions schedule and plan upgrades before end of life.
• Keep a PHP inventory. Know every server, container and third-party product running PHP, and which version each uses.
• Subscribe to security announcements. Follow the PHP news archive and your national cyber agency’s alerts.
• Automate patching where possible. Build PHP updates into your deployment pipeline so patched versions roll out in hours, not weeks.
• Run regular security audits. Review application code and server configuration on a schedule, not just after an incident.

How Xicom Can Help

Xicom has been building and maintaining enterprise web applications for more than two decades, including large PHP codebases. Our engineers can assess your exposure to the PHP2Shell vulnerability, apply and verify patches across your servers and containers, and upgrade legacy applications from PHP 7.x or 8.1 to a supported version without disrupting your business. For applications that need more than a version bump, our software development services cover full modernization, from refactoring to re-architecture.

Secure Your PHP Applications Today

The PHP2Shell vulnerability is the most critical PHP security vulnerability of 2026, with no complete workaround. Check your PHP versions, apply the PHP security update, and plan an upgrade path for anything on an end-of-life branch.

Need help patching or upgrading your PHP applications? Contact Xicom to talk to our engineering team.

FAQs