PHP2Shell: Is Your PHP Website Patched?

Name: Exelon Circuits Pvt. Ltd.
Address: Second Floor, Melric, Old Post Office Road, Iddya Village, Surathkal, Mangaluru, Karnataka 575014, Mangaluru, Karnataka, 575014, IN
Telephone: +91 73494 31090
Price range: $$

PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that let unauthenticated attackers run their own code on web servers. PHP released emergency fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and exploitation attempts have already been seen in the wild.

Because the flaws are in PHP itself, not in one plugin or app, they can affect websites built on WordPress, Drupal, Joomla, Laravel and custom PHP code. This guide explains what PHP2Shell is, who is affected, how to check your website and the 4 steps to secure it today.

What Is PHP2Shell?

PHP2Shell is a pair of memory-safety flaws in the PHP engine. PHP describes them as:

CVE-2026-109618 — remote code execution caused by memory corruption when PHP runs out of memory while cleaning up a request.

CVE-2026-109619 — remote code execution caused by leftover request data being reused by a later request on the same worker.

Both are rated critical (CVSS 9.2). An attacker does not need a login: a specially crafted web request can be enough to take control of the server, steal data or plant a backdoor.

Key Architectural Takeaways

PHP2Shell is a flaw in PHP itself, so every PHP website must check its version.
No login is needed to exploit it, which makes it extremely dangerous.

Why PHP2Shell Is So Serious

Huge reach — PHP powers a large share of the web; one estimate put the affected share at nearly 70% of websites at disclosure.

No authentication needed — attackers can strike before your application code even runs, especially on Apache with mod_php.

Details leaked early — technical information circulated on 20 October 2026, before the coordinated release.

Already exploited — Amazon Threat Intelligence spotted an exploitation attempt dated 17 October, and other security firms reported attacks soon after the patch.

Public exploit code — proof-of-concept exploits appeared on GitHub within days.

Which PHP Versions Are Affected and Fixed?

PHP says all installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

PHP Branch	Fixed Version	Action
8.5	8.5.12	Update now
8.4	8.4.27	Update now
8.3	8.3.36	Update now
8.2	8.2.35	Update now
8.1, 8.0, 7.x, 5.x	No official PHP release	Upgrade to a supported branch, or apply your OS or hosting provider's patched package

On 23 October 2026, PHP also disclosed a related, configuration-dependent issue (CVE-2026-115560) and advised setting session.upload_progress.enabled=0 until the next bugfix release.

Key Architectural Takeaways

Running PHP older than 8.2? You need an upgrade, not just a patch.
Restart PHP services after updating so the fixed version is actually running.

How to Check If Your Website Is Vulnerable

Find your PHP version — check your hosting control panel (cPanel, Plesk), ask your hosting provider, or run php -v on your server.

Compare with the fixed versions — anything below 8.5.12, 8.4.27, 8.3.36 or 8.2.35 on that branch is vulnerable.

Check every server — staging sites, old microsites and forgotten subdomains often run outdated PHP.

Look for signs of compromise — unknown admin users, new files in upload folders, unexpected processes or traffic spikes. Security agencies recommend checking for backdoors on any server that stayed unpatched.

When Did You Last Update Your Website? 4 Steps to Secure It

Outdated software and unpatched flaws make your website an easy target. Follow these four steps:

Step 1: Update Your Website and Plugins

Update PHP to a fixed version first, then your CMS (WordPress, Drupal, Joomla), themes and plugins. Remove plugins you no longer use.

Step 2: Patch Known Security Vulnerabilities

Apply security updates for your server, database and web server software as soon as they are released. Subscribe to security alerts for the software your site depends on.

Step 3: Review Access and Credentials

Remove old admin accounts, change hosting, database and admin passwords, and turn on multi-factor authentication. If your site may have been exposed, rotate API keys too. Our endpoint security guide covers MFA and password managers in detail.

Step 4: Run Regular Security Audits

Scan your website for vulnerabilities, malware and outdated components at least every quarter, and after any major security alert like PHP2Shell. Pair this with strong business network security.

Key Architectural Takeaways

Patching PHP is step one; CMS, plugins and credentials matter just as much.
A web application firewall (WAF) can block attacks while you patch.

PHP2Shell Website Security Checklist

Use this quick checklist to confirm your website is protected:

PHP is updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a patched vendor package)

PHP services were restarted after the update

Staging sites, subdomains and old microsites are also patched

CMS, themes and plugins are fully updated

Old admin accounts are removed and passwords changed

Multi-factor authentication is on for admin and hosting accounts

A security scan has checked for backdoors and unknown files

If you answered "no" to any of these, your website may still be exposed.

Other Key Cybersecurity Alerts

eMudhra certificate security concerns — On 17 October 2026, a researcher found that the private keys behind eight of eMudhra's international intermediate certificates were weak enough to be worked out. eMudhra revoked them on 18 October, Google moved to remove its root from Chrome, and CERT-In issued an advisory. MeitY said the impact on Indian websites was very limited and that Indian DSC and eSign services were unaffected. If your website uses a certificate from this chain, check with your certificate provider.

AI agent security risks — As businesses connect AI agents to email, files and internal systems, poorly controlled agents can give attackers a new route into enterprise data. Limit what each agent can access and log what it does.

Payment API vulnerabilities — Payment and financial platforms remain prime targets. Keep payment plugins and SDKs updated, protect API keys, and monitor for unusual transactions.

Frequently Asked Questions

PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution on web servers.

If your WordPress site runs on an unpatched PHP version, yes. The flaw is in PHP itself, so updating WordPress alone is not enough; PHP must be updated too.

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026.

Those versions have no official PHP fix. Upgrade to a supported PHP branch, or use a patched package from your operating system or hosting provider.

Yes. Exploitation attempts were reported before and after the patch, and public exploit code is available, so patch immediately.

Look for unknown admin users, new or changed files, unexpected server processes and unusual traffic. A professional security audit can confirm whether a backdoor was installed.

Conclusion

PHP2Shell shows how one flaw in widely used software can put millions of websites at risk overnight. Check your PHP version today, update to a fixed release, secure your CMS and credentials, and audit your website for any signs of compromise.

Security Assessment

Need Help Securing Your Website?

Exelon Circuits, an ISO 27001:2022 certified company, helps businesses in Mangaluru, Udupi and across India check PHP versions, patch vulnerabilities and run website security and vulnerability assessments. Talk to our team today: +91 73494 31090.

Book an Assessment Explore Security Services

Sources:

NCSC-NL — php2shell operational information•Canadian Centre for Cyber Security — Alert AL26-026•Akamai — Understanding PHP2Shell•Recorded Future — PHP2Shell exploitation•Fortinet — PHP2Shell outbreak alert•ThePrint — MeitY probe into eMudhra certificate incident