PHP2Shell: patch today, harden this week
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, let an attacker run commands on your server with one HTTP request, before your application code starts. Logins do not help. (Run WordPress and not a developer? Start here.) We have been running and rescuing PHP stacks for clients for years; tell us what you have and we will patch it, check it and hand you a written protection plan.
What PHP2Shell actually is
Details leaked on October 20, PHP shipped emergency releases on October 21, and honeypots saw attacks the same day. Both flaws are rated CVSS 9.2.
CVE-2026-109618
A crafted POST body makes PHP run out of memory halfway through setting up the request. Shutdown then treats the half-built data as real and calls a function the attacker chose.
CVE-2026-109619
Internal state outlives the request it belongs to, so the next request on the same worker acts on freed memory. The upload-progress path is on by default, even without sessions.
Who is affected
Anything serving HTTP through PHP: mod_php, PHP-FPM, php-cgi, LiteSpeed, FrankenPHP, PHP inside Docker images. WordPress, Laravel, Magento, Drupal and custom apps alike.
Fixed releases
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For 8.1, 8.0 and 7.4 there are only minimal backports and distribution packages. PHP 7.3 and older, including PHP 5, have no fix.
Why a login does not help
PHP parses the request before your code runs. A successful attack can return a normal 200 response and leave the worker alive, so a healthy-looking site proves nothing.
No config-only fix
PHP says no setting fully mitigates these flaws. Disabling upload progress and capping request size buy time; only the patch closes the door.
From exposed to patched and proven
One senior engineer owns your case end to end. You get a short report at every step, in plain language.
Inventory
Every PHP that answers HTTP: servers, containers, managed hosting, forgotten staging boxes. Versions compared against the fixed releases.
Patch and restart
Distribution packages, rebuilt Docker images or a hosting-panel update, then every worker restarted and the running version verified, not assumed.
Compromise check
PHP and web-server logs read for the known indicators, web workers checked for spawned shells, the document root scanned for web shells, secrets rotated if anything looks off.
Harden and report
Request-size limits at the proxy, WAF rules, upload progress and memory limits set the safe way, and a written plan for legacy PHP that cannot be patched.
Engineers who run PHP in production
PHP, WordPress and the rest
PHP and WordPress have been part of our stack for over a decade, next to Node, Python and the clouds they run on.
Takeovers are routine
Old codebases nobody wants to touch are a regular part of our work. We will not judge the PHP 5 box; we will plan its exit.
DevOps in the same team
Reverse proxies, WAF rules, container rebuilds and monitoring are done by the people who patch the code, not handed to a ticket queue.
Findings in writing
What was vulnerable, what we changed, what we found and what to do next, on paper you can forward to a client or an auditor.
What people ask first
What is PHP2Shell?
The name given to two critical vulnerabilities in the PHP interpreter, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. An attacker can send a crafted HTTP request and run commands on the server before your application code starts. Fixed releases came out on October 21, 2026, and exploitation in the wild has been reported since the same day.
Which PHP versions are affected?
Every release before 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1, 8.0 and 7.4 have no official release, only minimal source backports and distribution packages. PHP 7.3 and older, including PHP 5, have no fix at all and need an upgrade.
My site is behind a login. Am I safe?
No. PHP parses the malicious request before your application runs, so authentication in WordPress, Laravel or any other framework does not block it. Only a patched PHP, or blocking the request upstream, helps.
Can I just change a php.ini setting instead of updating?
No. PHP states that no configuration change fully mitigates these vulnerabilities. Settings such as session.upload_progress.enabled=0 close one path and buy time, but patching is the only complete fix.
How fast can you help, and what does it cost?
Send us your stack and hosting details and we reply the same business day with an assessment and a fixed quote. Patching a typical site takes hours, not days. Legacy PHP 5 and 7 systems that need an upgrade get a planned, priced path.
Tell us what runs PHP. We take it from there
Hosting, PHP version if you know it, and what the site does. We reply the same business day with a plan and a fixed price.
Get a protection plan