PHP2Shell: Is Your Website at Risk? A 2-Minute Check

On 21 October 2026, the PHP project shipped an emergency security release for two critical flaws in the language itself, nicknamed PHP2Shell. Both are rated 9.2 out of 10, and both let an unauthenticated attacker run their own code on a web server. Because PHP runs a large share of the web, from WordPress and Drupal to Joomla and countless custom sites, this is worth two minutes of your evening.

What happened

The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are bugs in how PHP handles a request when it runs out of memory partway through, and in how it reuses memory from a previous request. An attacker can trigger them with a single crafted upload, with no username or password. One of them can fire before any of your application code even runs.

The uncomfortable detail: Amazon's threat intelligence reported seeing exploitation attempts from 17 October, four days before the fix was public. Several vendors now report the bugs are being exploited in the wild. Treat any investigation as starting from 17 October, not from the disclosure date.

Step 1 · Find your PHP version

• Shared hosting (cPanel or Plesk): open "Select PHP Version" or "PHP Selector". The number is shown there.
• WordPress: Dashboard → Tools → Site Health → Info → Server → "PHP version".
• Your own server: run php -v over SSH, and php-fpm -v too if you use PHP-FPM.
• Not sure? Ask your host: "What PHP version am I on, and is it patched for CVE-2026-109618 and CVE-2026-109619?"

Step 2 · Are you safe or at risk?

Your PHP version	Status
8.5.12 · 8.4.27 · 8.3.36 · 8.2.35 or newer	Patched — you are safe
Any 8.5, 8.4, 8.3 or 8.2 below those	At risk — update now
7.4 to 8.1	At risk — end of life; only a minimal backport exists. Ask your host
5.4 to 7.3	At risk — no official fix. Upgrade PHP

This affects both mod_php on Apache and PHP-FPM. Patch both.

Step 3 · What to do tonight

1. Update PHP to a fixed version above. On managed hosting, switch the version in your panel or ask support. On your own server, update through your package manager and restart every PHP worker afterwards (for example systemctl restart php-fpm).
2. Cannot update right away? These interim settings reduce exposure but are not a full fix. Set memory_limit = -1 so applications cannot override it, set session.upload_progress.enabled = 0, and on PHP 8.5 also set fatal_error_backtraces = 0. Restart the workers after any change.
3. Behind Cloudflare? Its managed WAF rules now block known exploit traffic. Treat that as a stopgap, not a cure.
4. Check your logs from 17 October onward for odd multipart uploads followed by memory-limit errors, bursts of HTTP 500s, unusually large PHPSESSID cookies, or PHP workers restarting for no reason.

Only a real patch fully closes this. Everything else just buys time.

Sources

• Tenable — PHP2Shell FAQ
• Wiz Research — PHP2Shell
• Qualys — Threat Research
• Google Cloud — Responding to CVE-2026-109618 and 109619
• php.net — official security releases

Fixing client websites tonight? Bill them in under a minute with Invoiceful — 150+ currencies, GST fields, instant PDF, free and no signup.

Facts current as of 22 October 2026. This is a summary to help you act quickly, not formal security advice; always verify versions on php.net.