On October 21, 2026, the PHP project issued an emergency advisory for two critical remote code execution vulnerabilities now being tracked together under the name PHP2Shell — CVE-2026-109618 and CVE-2026-109619. Security researchers estimate the core flaw reaches back to PHP 5, which means it potentially touches a staggering share of the websites running today. With PHP powering roughly three-quarters of the web, this is not a niche developer problem. It is an internet-wide event.
At Amigo SoftTech, our security desk began tracking PHP2Shell the moment the first advisories landed. This post breaks down exactly what the vulnerability is, who is exposed, and — most importantly — the concrete, battle-tested steps to shut the door on it today. If you run a PHP site, a WordPress store, a Laravel app, or a Magento shop, read this to the end. The good news: it is fixable, and we can help you do it fast.
What Is PHP2Shell?
PHP2Shell is the nickname given to a pair of linked security flaws in PHP, the programming language behind most of the world’s websites. The name says it all: in the worst case, an attacker goes from a plain PHP request to a shell — full command execution — on your server.
CVE-2026-109618 is the headline flaw. It is a remote code execution (RCE) vulnerability rooted deep in PHP core, and researchers report it affects essentially every version from PHP 5 onward. It carries a CVSS severity score of around 9.2, placing it firmly in the “critical” band. An unauthenticated attacker — someone with no account and no password — can potentially exploit it over the network to run their own code with the privileges of your web server.
CVE-2026-109619 is described as a closely related companion vulnerability. The two are disclosed and patched together, which is why the community refers to them collectively as PHP2Shell.
What does “RCE” mean for me? Remote code execution is the most serious class of web vulnerability there is. If someone can run code on your server, they can read your database, steal customer data, plant malware or crypto-miners, deface your site, or use your server as a launchpad to attack others. It is the digital equivalent of handing a stranger the keys to your building.
Why This One Matters More Than Most
Vulnerabilities are disclosed every week. PHP2Shell stands apart for three reasons.
The blast radius is enormous. PHP runs an estimated 70% of all websites with a known server-side language. Because the core flaw reaches back to PHP 5, the pool of potentially affected systems includes not just modern apps but a long tail of older, rarely-updated servers and embedded devices. Wiz researchers described it as affecting “70% of the Internet.”
It needs no credentials. Many serious bugs require an attacker to first log in or trick a user. CVE-2026-109618 is exploitable by an unauthenticated attacker reaching your server over the network. That is the combination attackers prize most: critical impact, zero barrier to entry.
The ecosystem on top of PHP is huge. WordPress alone powers a large share of the web, and it runs on PHP. Add Laravel applications, Magento and WooCommerce stores, Drupal and Joomla sites, and countless custom apps, and the attack surface becomes almost everything.
A concrete scenario
Imagine a mid-sized e-commerce store running on an unpatched PHP version. An attacker scans the internet for vulnerable servers — automated, at scale. They find the store, send a crafted request, and gain the ability to execute commands as the web server user. Within minutes they can exfiltrate the customer database, inject a card-skimming script into the checkout page, and install a backdoor so they can return even after the obvious damage is cleaned up. The store owner may not notice for weeks — until customers report fraud or the site is blacklisted by Google. This is precisely the kind of chain PHP2Shell can enable, which is why speed of patching matters so much.
How the Attack Actually Works
We will keep this at the level needed to understand the risk and defend against it — not a weaponized walkthrough.
The public analysis of PHP2Shell centers on PHP’s session upload-progress feature, a built-in mechanism that tracks the status of file uploads. The proof-of-concept that circulated after disclosure chains several low-level techniques together rather than relying on a single bug:
- A memory leak is used to read information out of the server process that should not be exposed.
- An ASLR bypass defeats a standard operating-system protection that randomizes where code and data sit in memory, so the attacker can reliably find their target.
- A destructor overwrite hijacks PHP’s internal cleanup routines in the Zend memory manager.
- The chain ultimately reaches PHP’s
system()function, letting the attacker execute an operating-system command on the server.
In short, it is a sophisticated exploit chain, not a one-line trick — but researchers have demonstrated it works, and proof-of-concept code has been published. Security vendors including Cloudflare and Amazon reported seeing large volumes of exploitation attempts shortly after disclosure. Note that reports on how reliable and widespread real-world exploitation is have varied between sources in these early days; the safe assumption for any site owner is that it is being actively probed and to patch without waiting for certainty.
Are You Affected? Versions and How to Check
If you run PHP, assume you are affected until you have confirmed otherwise. CVE-2026-109618 is reported to affect all PHP versions from PHP 5 onward, so modern and legacy installations alike are in scope.
How to check your PHP version
On a server you control, run php -v from the command line, or create a temporary page containing <?php phpinfo(); ?> (and delete it immediately after). In WordPress, your version is shown under Tools → Site Health → Info → Server. If you are on managed or shared hosting, your control panel (cPanel, Plesk) or your host’s support can tell you.
Fixed versions by platform
Distributions released coordinated patches. Confirm the exact build for your specific OS and release against your vendor’s advisory, but these are representative fixed versions:
| Platform | Branch | Fixed version (example) |
|---|---|---|
| Debian 12 (bookworm) | php8.2 | 8.2.35-1~deb12u1 |
| Debian 13 (trixie) | php8.4 | 8.4.27-1~deb13u1 |
| Ubuntu 24.04 (noble) | php8.3 | 8.3.6-0ubuntu0.24.04.13 |
| Ubuntu 22.04 (jammy) | php8.1 | 8.1.2-1ubuntu2.28 |
| RHEL 9 | php | 8.0.30-1.el9_2.2 |
| RHEL 10 | php | 8.3.19-1.el10_0.2 |
| Alpine 3.21 / 3.22 | php82 | 8.2.35-r0 |
| Alpine 3.23 | php83 | 8.3.36-r0 |
Some older releases are marked “no fix” by their maintainers — if you are on one of those, upgrading to a supported branch is the only safe path.
The Fix: Your Emergency Action Plan
Here is the priority order we follow for our own clients. Work top to bottom.
- Patch now — this is the real fix. Update PHP to the patched version for your platform (see the table above) using your OS package manager (
apt,dnf,apk) or your host’s update tooling, then restart PHP-FPM and your web server. Patching is the only complete remedy; everything below buys time, not safety. - Apply the official stopgap if you cannot patch instantly. PHP.net advises disabling the vulnerable feature by setting
session.upload_progress.enabled = 0in yourphp.ini, and keeping it disabled until you have fully updated. Restart PHP after the change. - Restrict network exposure. Limit who can reach your PHP services. Put admin panels behind a VPN or IP allowlist, and isolate internet-facing servers — especially embedded devices — from the rest of your network.
- Run PHP with least privilege. Ensure the web server/PHP process runs as an unprivileged user so that, even if exploited, the blast radius is limited.
- Do not rely on a WAF alone. A web application firewall can add a layer of detection, but researchers caution that no WAF rule is a fully reliable block for PHP2Shell. Treat it as defense-in-depth, never as a substitute for patching.
- Assume-breach check. If your server was internet-facing and unpatched for any window after October 21, review logs for suspicious requests, unexpected new files, modified
.phpfiles, and unknown outbound connections. If anything looks off, treat it as a potential compromise and investigate before you simply patch over it.
The headline is simple: patch today, verify, and monitor. Attackers are automating their scans; the window between “disclosed” and “exploited at scale” is measured in days, not weeks.
How Amigo SoftTech Keeps You Protected
When a critical, internet-wide flaw like PHP2Shell drops, the difference between a quiet weekend and a data-breach headline often comes down to how fast and how thoroughly you respond. That is exactly where our team lives.
Our security desk tracks major CVEs as they are disclosed, so our clients hear about threats from us — with a plan attached — rather than reading about the breach after the fact. For PHP2Shell specifically, here is how we help:
- Emergency patching. We identify every PHP version across your sites and servers and apply the correct patched build, with a tested rollback plan so updates don’t break your application.
- Rapid vulnerability assessment. A focused scan of your stack to confirm whether you are exposed to CVE-2026-109618 / CVE-2026-109619 and what else needs attention.
- Hardening and configuration review. We apply the stopgaps, lock down
php.ini, enforce least-privilege execution, and tighten network exposure. - WordPress, Laravel, Magento & WooCommerce expertise. We know the PHP ecosystems businesses actually run on, so we secure the framework and plugins, not just the language.
- Managed hosting & monitoring. Ongoing patch management, log monitoring, and intrusion detection so the next critical CVE is handled before it becomes your problem.
- Compromise investigation. If you were exposed before patching, we help you check for signs of intrusion and clean up safely.
Technology moves fast, and so do attackers. Our job is to make sure your business is always a step ahead — patched, hardened, and monitored.
Disclosure Timeline
- October 20, 2026 — PHP maintainers warn administrators that two critical flaws exist and that emergency patches are imminent.
- October 21, 2026 — CVE-2026-109618 and CVE-2026-109619 are formally disclosed; coordinated patches ship across major Linux distributions. The pair is dubbed “PHP2Shell.”
- Days after disclosure — Proof-of-concept exploit code is published and analyzed by security firms; Cloudflare and Amazon report high volumes of exploitation attempts.
- Ongoing — National cybersecurity agencies (including the Canadian Centre for Cyber Security and Singapore’s CSA) issue alerts urging immediate patching.
Frequently Asked Questions
Is my WordPress site affected by PHP2Shell?
If your WordPress site runs an unpatched PHP version (PHP 5 through recent releases), it is potentially affected, because the flaw is in PHP itself, not in WordPress. Update PHP to a patched build and keep WordPress core and plugins current.
What is CVE-2026-109618?
It is the primary PHP2Shell vulnerability: a critical remote code execution flaw in PHP core, rated around CVSS 9.2, affecting PHP versions from 5 onward. An unauthenticated attacker can potentially run code on the server.
How do I patch PHP?
Update PHP to the fixed version for your operating system using your package manager (apt, dnf, or apk) or your hosting control panel, then restart PHP-FPM and your web server. Verify with php -v.
Is there a workaround if I cannot patch right now?
Yes, as a temporary measure PHP.net advises setting session.upload_progress.enabled = 0 in php.ini and restarting PHP. This is a stopgap — you must still fully patch.
Does a web application firewall (WAF) protect me?
A WAF adds a useful detection layer, but security researchers warn that no WAF rule is a fully reliable block for this vulnerability. Do not treat a WAF as a replacement for patching.
How urgent is this?
Very. Proof-of-concept code is public and attackers are actively scanning. Patch today if you possibly can.
The Bottom Line
PHP2Shell is one of the most far-reaching PHP vulnerabilities in years. The flaw is serious, the exposure is vast, and exploit code is already circulating — but it is fixable, and the path is clear: confirm your PHP version, patch to the fixed build, apply the stopgap if you need a moment, and monitor for anything unusual.
If you would rather not do this alone, Amigo SoftTech is ready to help today. We will assess your exposure, patch your systems safely, and harden them against whatever comes next. Contact our team for a priority security check — and let’s make sure PHP2Shell is a non-event for your business.
References
- SANS Internet Storm Center — Critical PHP Vulnerability (CVE-2026-109618, CVE-2026-109619)
- Wiz Vulnerability Database — CVE-2026-109618 (PHP2Shell)
- Canadian Centre for Cyber Security — Alert AL26-026
- BleepingComputer — PHP warns admins of two critical flaws
- Sophos — Proof-of-concept exploit released for PHP vulnerabilities 109618 & 109619
- Singapore CSA — Critical Vulnerabilities in PHP
As of October 25, 2026. Always confirm exact patched versions and guidance against the official PHP.net security advisory and your OS vendor.
Ready to Grow Your Business Online?
Get a free digital marketing audit and find out exactly what is holding your online presence back.