PHP2Shell is the name given to two critical remote code execution vulnerabilities in the PHP interpreter, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. PHP fixed them on 21 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Because the bugs sit in PHP itself rather than in an application, an unauthenticated attacker can reach them before any of your own code runs.
Official guidance from php.net: only an update is a complete fix. The published workarounds reduce exposure to specific attack paths but do not make an installation safe.
What the two vulnerabilities are
PHP's security advisory describes two separate memory-safety bugs in request handling:
- CVE-2026-109618, RCE via out-of-memory corruption: when PHP runs out of memory while setting up request data, the data can be left partly initialized, and request cleanup then treats it as valid.
- CVE-2026-109619, RCE via stale global state: request-owned state can survive after its memory has been freed, and a later request handled by the same worker may use it before it is reset.
Who is at risk
According to PHP, every installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team rates mod_php as the highest risk, because a demonstrated exploit lets an unauthenticated request trigger the attack before any application code runs. Details leaked online on 20 October, a day before the coordinated release, and security researchers published exploitation write-ups for WordPress, Drupal and Joomla on the day of the patch.
How to fix PHP2Shell
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux distributions and LTS vendors received the patches in advance, so check your vendor's packages first.
- PHP 8.1 and older no longer receive updates from the PHP project. The security team posted minimal source backports for 7.4, 8.0 and 8.1, but the real answer is moving to a supported version.
- Restart every PHP worker after updating, so no process keeps running the old code.
- Treat this as an emergency change, not a scheduled upgrade, and confirm the running version on every host and container image.
If you cannot update immediately
PHP lists stopgaps that narrow specific attack paths. For CVE-2026-109619, set session.upload_progress.enabled=0 in php.ini or the FPM pool and restart every worker; setting it at runtime with ini_set() does not help. On PHP 8.5, also set fatal_error_backtraces=0. For CVE-2026-109618, PHP suggests a low post_max_size (8M without uploads, 32M with) and request-size limits at the web server or proxy. These buy time; they are not a fix.
CVE-2026-115560: the follow-up notice
On 23 October PHP published an informational advisory about a separate, unlikely RCE path, CVE-2026-115560. It only applies when an application switches session.serialize_handler to php at runtime before calling session_start() while session upload progress is still enabled. The recommended setting is the same one as above, session.upload_progress.enabled=0, and PHP will publish the full advisory with its next regular release.
If you run a structured patch process, this is a good test of it. Our guide to vulnerability management and the OWASP Top 10 course below cover how to triage, prioritize and verify fixes like this one.
