php2shell: critical PHP flaws and what to do now

On 20 October 2026 the PHP team announced a critical security release. The patches arrived on 21 October at 14:00 UTC. The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619 and have been nicknamed "php2shell". They let an attacker run their own code on the server without logging in. CERT-EU has issued an advisory.

What happened

Both flaws sit in the PHP core, not in a plugin or theme. The PHP team rates them CVSS 9.2 out of 10. The details were meant to stay under embargo for longer. Because information leaked early, the release was brought forward.

• CVE-2026-109618: If PHP runs out of memory during a request, it can stop while request data is only partly set up. Cleanup then treats the half-built data as valid.
• CVE-2026-109619: Internal data owned by a request survives after its memory is freed. The next request on the same worker can use it before it is reset.

Cloudflare reports early attack attempts. Code that claims to exploit the flaws is circulating. Whether it works is not confirmed. Don't wait to find out.

Which websites are affected

Every publicly reachable website that runs on PHP. That is most of the web. Typical examples:

• WordPress and WooCommerce
• Shopware, Magento and Adobe Commerce
• TYPO3, Joomla and Drupal
• custom applications built with Laravel or Symfony

According to CERT-EU, all versions from PHP 5 onwards could be affected. The PHP team has not yet published a complete list.

Websites without their own PHP on the server are not directly affected. That includes Shopify stores, sites on Webflow or Framer, and Next.js websites on Vercel. There the provider runs the servers and you have no PHP installation of your own.

Which PHP versions are safe

Linux distributions such as Debian, Ubuntu and Red Hat received the patches in advance. They often backport the fix into their own packages without changing the version number. Check your distribution's security notices or ask your host.

What to do today

1. Find your PHP version. In WordPress it is under Tools → Site Health → Info → Server. On web hosting you will find it in your host's customer area.
2. Install the update. On your own server through the package manager, then restart PHP-FPM or the web server. On web hosting pick the new version in the customer area or ask your host whether the patch is already live.
3. Replace old versions. If your site runs on PHP 8.1, 7.4 or older, it gets no patch. Moving to PHP 8.3 or 8.4 can break old plugins and themes. Test the move on a copy of the site.
4. Check the logs. Unusually frequent PHP worker crashes, new admin accounts or unknown PHP files in the uploads folder are warning signs.

If you can't update right away

The PHP team is clear: only the update closes the flaws. In the meantime these steps reduce the risk:

• Turn off upload progress. Set session.upload_progress.enabled=0 in php.ini or the FPM pool. It has no effect in a .user.ini or via ini_set().
• Use Cloudflare. Cloudflare has deployed firewall rules for known attack patterns, including on the free plan. They only protect traffic that goes through Cloudflare.
• Take the site offline. CERT-EU advises isolating internet-facing applications until the patch is in. For shops and portals with customer data, that is the safe choice.

Frequently asked questions