PHP2Shell Critical Vulnerability: Is Your Website at Risk?

What happened with the PHP vulnerabilities?

On October 21, 2026, the PHP project released security updates for two critical vulnerabilities. Qualys refers to the vulnerabilities collectively as PHP2Shell. Its research describes memory-handling flaws that can expose vulnerable PHP environments to remote code execution. The following sections explain how the vulnerabilities work, which deployments need attention, and how to verify remediation.

Both bugs come down to how PHP handles memory while it processes a web request:

• CVE-2026-109618: if the server runs out of memory at a bad moment, PHP can be left holding half-prepared request data, and its cleanup code then works on that broken state. That opens a route to remote code execution.
• CVE-2026-109619: PHP can keep pointing at request data after the memory behind it has been freed. A later request handled by the same worker can then trigger a use-after-free. Researchers have shown remote code execution this way.

Qualys also notes that researchers have shown attackers reading PHP worker memory without authentication. That memory can contain passwords, session tokens and API keys, which means a server doesn't have to be fully taken over for the damage to be serious.

Apache with mod_php needs attention first, because PHP reports a working exploit there that triggers before your application code even runs. But PHP lists every setup that serves web requests as at risk, including PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. How easy an attack is depends on your configuration and your application. The official PHP advisory recommends identifying affected installations and applying the security updates immediately.”

Which PHP versions fix it?

These upstream releases contain the fix for both vulnerabilities:

These are upstream release references. Some vendors provide security backports without changing the visible PHP version number, so verification must consider the vendor package and build.

One catch: if your server gets PHP through Ubuntu, Red Hat, Debian or another distribution, the fix may arrive as a backported package that still shows an older version number. Check your vendor's advisory rather than trusting the number alone.

PHP 8.1 and earlier are outside regular upstream support. The PHP team has provided limited source backports for 7.4, 8.0 and 8.1, but the sensible options are a fixed build from your distribution or support vendor, or an upgrade to a supported release.

Does your business actually use PHP?

Most business owners don't know, and that's completely normal. PHP runs quietly behind a huge share of the web. If your website is built on WordPress, Magento, Drupal, Joomla or Laravel, it runs on PHP. So do many customer portals, booking tools, quoting systems and older in-house applications. If your developer built something years ago and nobody has touched it since, assume it is worth checking.

Find your setup and what to do next

Your next step depends on who looks after the server. Find the one that sounds like you:

How do you check which PHP version you are running?

Ask your developer or host first. They can answer in a couple of minutes. If you manage the server yourself, running php -v is a start, but be careful: the version it prints can belong to a different installation than the one serving your website. Servers often carry several PHP versions side by side, and a hosting panel may add its own. Confirm the version the web server actually uses, not just the one on the command line.

How to Check Whether Your Business Is Protected Against PHP2Shell

Installing a security update is important, but you also need to verify that the correct PHP runtime is protected. Use this five-step checklist to review your website or business application.

What if you can't patch today?

Updating is the only complete fix. If a patched build can't go live immediately, PHP's guidance lists interim measures that reduce exposure to specific attack paths, and they should be treated as a bridge, not a solution:

• Set session.upload_progress.enabled=0 at server or pool level (not through application code) and restart every PHP worker.
• Cap request sizes, for example post_max_size at 8M if your app doesn't take uploads, and enforce limits at the web server or proxy as well.
• If you must, restrict public access to the affected service or isolate it until the update is ready.

How do you confirm the fix actually worked?

Installing a package is one step, not the finish line. After you update:

1. Find every PHP installation, including containers and anything bundled with other software.
2. Update the right package, binary or image, and check the full package version against your vendor's advisory.
3. Restart or replace the workers, then confirm the running site uses the new runtime.
4. Put temporary settings back to sensible values and test how the app behaves under heavy load.

Why running old PHP is the bigger risk

Each time a serious PHP flaw lands, the businesses that scramble are the ones on unsupported versions, because the clean fix simply isn't available to them. If this week's alert made you realise your site runs on PHP 7.4 or 8.0, that's worth acting on beyond this one patch. Our team handles legacy system modernization for PHP, .NET and Classic ASP applications, and can also rescue and modernise unstable applications, or provide dedicated PHP developers to take over maintenance.

Frequently asked questions