What Is PHP2Shell?

PHP2Shell is the name for two security flaws in PHP itself, the language that runs WordPress and most small business websites. They are tracked as CVE-2026-109618 and CVE-2026-109619, and both carry a critical CVSS 4.0 score of 9.2.

CVE-2026-109618 is a memory corruption bug that can be triggered when a request runs PHP out of memory. CVE-2026-109619 is a stale state bug in PHP's session upload progress handling, and PHP has confirmed it can be used for remote code execution against PHP-FPM. Session upload progress is on by default, so a site is exposed even if its code never uses sessions.

Both flaws can let an attacker send a specially crafted request to a website and run their own code on the server. No password needed. Once that happens they can change pages, steal data, send spam, or use the server to attack others.

PHP released the fixes on October 21, 2026. Security companies reported attack attempts within days, and some started before the fix was public.

Is Your Website Affected by CVE-2026-109618 or CVE-2026-109619?

If your website runs on PHP and the server has not been updated since October 21, assume yes.

That includes:

  • WordPress, WooCommerce, Joomla and Drupal sites
  • Custom PHP sites and Laravel apps
  • Tools like phpMyAdmin
  • PHP running inside Docker containers

It does not matter whether the server uses Apache or Nginx. Every way of running PHP for the web is on the list.

If You Are a Miami Web Lab Client

Your sites are protected.

We updated PHP on every server we run within a day of the release. We rebuilt every Docker container that runs PHP and shut down the ones that did not need to be running. Then we checked every site for changed files, unknown processes and other signs of a break in. We found none.

There is nothing you need to do.

How to Check Your Own Server

If you manage your own server, start here.

Ubuntu and Debian

Ubuntu and Debian patch PHP without changing the version number, so php -v will still show the old version after the fix. Check the package build instead:

dpkg -l | grep -E '^ii\s+php[0-9.]+-(fpm|cgi|cli)|libapache2-mod-php'

The fixed builds on Ubuntu are:

  • Ubuntu 22.04 with PHP 8.1: 8.1.2-1ubuntu2.28 or higher
  • Ubuntu 24.04 with PHP 8.3: 8.3.6-0ubuntu0.24.04.13 or higher

Other servers

If you installed PHP from php.net, a PPA, or Remi, php -v is accurate. You need 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer.

PHP 8.1 and older no longer get official releases. If you are on one of those and your Linux vendor does not ship a patch, it is time to upgrade.

Docker

This is the one people miss. A container has its own copy of PHP, and updating the server does not touch it. Check each one:

for c in $(docker ps -q); do docker exec $c php -v 2>/dev/null | head -1; done

How to Fix PHP2Shell

Ubuntu and Debian

sudo apt update
sudo apt install --only-upgrade 'php8.3*'
sudo systemctl restart php8.3-fpm

Swap 8.3 for your version. If you use Apache with mod_php, restart Apache instead.

AlmaLinux, Rocky and Red Hat

sudo dnf update 'php*'
sudo systemctl restart php-fpm

Docker

Make sure your Dockerfile uses a version tag like php:8.2-apache and not a pinned build like php:8.2.33-apache. Then rebuild with the pull flag so Docker downloads the patched image instead of reusing the old one:

docker compose build --pull
docker compose up -d

Run php -v inside the container afterward to confirm it shows a fixed version.

Shared hosting and managed WordPress

You cannot patch PHP yourself on shared hosting. Ask your host directly whether they have applied the PHP2Shell fix. A good host will answer with a yes and a date.

How to Check If You Were Hit

Patching stops new attacks. It does not undo one that already happened. After you patch, look for:

  • PHP files in your site folder that you did not upload, especially in image or upload folders
  • Files owned by the web server user instead of your deploy user
  • Unknown processes running as www-data
  • New cron jobs or user accounts
  • PHP worker crashes or memory errors in your logs

If you find any of these, change every password and API key the site uses, then restore from a clean backup.

The Bottom Line

PHP2Shell is serious and it is being used right now. The fix is a routine update, but only if someone actually runs it on every server and every container.

If you are our client, that is done. If you are not and you are not sure who is watching your server, contact us. We will check it and tell you straight whether you are exposed.

Lea este artículo en español.