PHP has released the security updates for php2shell. If you run a PHP website, it's time to check the version actually serving your site and install the relevant fix.
The two vulnerabilities can allow attackers to execute code remotely without logging in. Updating your framework or CMS alone won't fix a vulnerability in the PHP runtime underneath it.
The fixed versions are available
The PHP security advisory published on October 21, 2026 confirms these releases contain the fixes
| PHP branch | Affected upstream releases in this branch | Fixed release |
|---|---|---|
| PHP 8.2 | 8.2.0 through 8.2.34 | 8.2.35 |
| PHP 8.3 | 8.3.0 through 8.3.35 | 8.3.36 |
| PHP 8.4 | 8.4.0 through 8.4.26 | 8.4.27 |
| PHP 8.5 | 8.5.0 through 8.5.11 | 8.5.12 |
Linux distributions and long-term support vendors may backport the fixes without adopting these upstream version numbers. Check your vendor's security advisory and package revision before deciding whether its build is patched.
What went wrong?
Both vulnerabilities have a CVSS 4.0 score of 9.2, rated critical.
CVE-2026-109618 concerns out-of-memory handling. PHP can be interrupted while internal request data is only partly initialized. Cleanup can then use that invalid data, creating an opportunity for remote code execution.
CVE-2026-109619 involves internal state surviving after the memory behind it has been freed. A later request handled by the same worker can access that stale state before PHP resets it.
These are problems in PHP's handling of requests and memory. The application doesn't necessarily get a chance to reject the attack.
Which server setups are at risk?
PHP's warning covers installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
The highest stated risk is Apache with mod_php. The technical advisory describes a demonstrated attack that runs before application code starts. That makes relying on checks inside your application particularly problematic.
PHP-FPM isn't automatically safe. The stale-state advisory describes a validated FPM path that depends on a suitable application operation. The conditions vary between setups, but switching server interfaces isn't a substitute for patching.
What about PHP 8.1 and older?
PHP 8.1 and older no longer receive regular updates from the PHP project. Some distributions and long-term support vendors provide backported fixes.
For this incident, the PHP security team also supplied minimal source backports for PHP 7.4, 8.0 and 8.1. Those patches don't restore ongoing support for these branches. Check your vendor's coverage or plan an upgrade to a supported release.
Configuration changes aren't a complete fix
The official advisory includes temporary measures that reduce exposure to particular attack paths. PHP explicitly says they don't make an unpatched installation safe.
The technical reports explain why. Preventing a predictable PHP memory-limit failure doesn't eliminate every possible allocation failure. Disabling session upload progress blocks confirmed session-related paths, but doesn't cover all stale-state variants.
Use the official advisory for those temporary measures and their limitations. Apply the update as soon as possible.
Updating and checking your servers
Identify every PHP installation, including copies bundled with other software. If a hosting provider manages PHP for you, confirm that it has deployed a fixed build.
Prioritize internet-facing servers. After updating, restart the relevant PHP workers or web server and verify that the website is using the patched build. A version check in your terminal may refer to a different PHP installation.
Keep investigating suspicious activity, too. Unexpected shells, downloads or system-discovery commands started by PHP or web server processes deserve attention. These are general warning signs, not proof of php2shell exploitation.
If you suspect a compromise, preserve the logs and investigate unexpected files, scheduled tasks and user accounts. Patching prevents further exploitation of these vulnerabilities; it doesn't remove access an attacker may already have established.