PHP2Shell: Two Critical PHP Flaws Put Business Websites at Risk

If your business website runs on WordPress, Drupal, Joomla, Laravel or almost any other PHP application, this one affects you.

On October 21, 2026, the PHP project released emergency security updates for two critical vulnerabilities, nicknamed PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 (Critical) on the CVSS v4.0 scale, according to the official PHP security advisory. They let an attacker with no account or password run code on a web server, and they can also let an attacker read server memory that may hold passwords, login tokens, API keys and certificates.

Why this one is different

Most website security news is about a single plugin or theme. PHP2Shell is in PHP itself, the engine underneath the site. That means:

• Your site can be vulnerable even if its own code is perfectly secure. Because the flaw is in the engine, even a basic PHP page on an unpatched server can be attacked.
• Updating WordPress or your plugins does not fix it. The fix comes from your server, your hosting provider or your container image.
• It's old. The researchers who found it say the flawed code has been in PHP for more than a decade.

The flaws affect every PHP setup that serves web pages, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates Apache mod_php as the highest risk, with a demonstrated attack that fires before any application code runs.

Is it being attacked?

Details leaked online a day before the planned disclosure, which pushed the release forward. Since then, security firms including Cloudflare and watchTowr have reported active exploitation attempts against both flaws. At the time of writing, no confirmed break-in had been publicly reported, but the window to patch quietly has closed. Some organizations took their sites offline as a precaution.

Step 1: Update PHP (the only complete fix)

• PHP 8.5: update to 8.5.12
• PHP 8.4: update to 8.4.27
• PHP 8.3: update to 8.3.36
• PHP 8.2: update to 8.2.35

After updating, restart Apache, PHP-FPM and any long-running PHP workers. An update that hasn't been loaded doesn't protect you.

• PHP 8.1 and older get no official update. Some Linux distributions and support vendors have backported fixes; check with yours, or plan an upgrade. PHP 8.2 itself reaches end of life on December 31, 2026.
• Linux package versions can look old. Distributions often backport fixes under the original version number, so check the package changelog for the CVE numbers rather than the version string.
• Shared hosting or managed WordPress? Contact your host today and ask in writing whether your PHP is patched for CVE-2026-109618 and CVE-2026-109619.

Step 2: If you can't update right away

The PHP team is clear that none of these make a server safe. They only narrow specific attack paths while you schedule the update. They are technical settings, so pass this section to whoever manages your server.

For CVE-2026-109618 (out-of-memory corruption)

• Set memory_limit=-1 at the server level so applications can't override it (for example, php_admin_value in the FPM pool or Apache configuration), and make sure no other setting puts a finite limit back.
• Lower post_max_size: 8M if the site doesn't accept file uploads, 32M if it does, with upload_max_filesize below it.
• Enforce limits on request size, form-field count and header count at the web server, proxy or firewall.
• Don't use RLIMIT_AS or RLIMIT_DATA as a substitute; PHP warns these can trigger the vulnerable path.

For CVE-2026-109619 (stale global state)

• Set session.upload_progress.enabled=0 in php.ini or the FPM pool (not with ini_set() or .user.ini) and restart every worker.
• On PHP 8.5, also set fatal_error_backtraces=0.

A web application firewall (WAF) helps buy time. Cloudflare deployed rules for these flaws, but reported that attackers were already changing their requests to get around them.

Step 3: After you patch

• Re-check memory settings. The fix adds a new hard memory limit; a process that hits it ends immediately. Make sure memory_limit and post_max_size fit what your application actually needs.
• Look for signs of earlier attacks: unusual multipart requests followed by memory-limit errors or repeated HTTP 500 errors, unusually large PHPSESSID cookies, and unexplained PHP worker restarts.
• If you see them, rotate secrets stored on or used by the server: database passwords, API keys and application secrets.

The bottom line

PHP2Shell is a server problem that a website update won't solve. If you aren't sure who maintains the server your website runs on, or which PHP version it uses, now is the time to find out. CyberArm can check your site's PHP version, coordinate with your hosting provider and apply the update or temporary protections. Start with a free IT and security assessment, or see our cybersecurity packages, which include patch management.