PHP2Shell: How to Fix CVE-2026-109618 and CVE-2026-109619

PHP2Shell is the name for two critical PHP vulnerabilities in the language itself, tracked as CVE-2026-109618 and CVE-2026-109619. They are remote code execution (RCE) bugs. They let an attacker run code on your web server without logging in. The fix is to update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart every PHP worker. Attackers are already probing for it, so do this today.

What happened, in plain words

Picture this. It is Wednesday morning and your WordPress site, your Laravel API and an old internal tool all run on PHP. Overnight, news breaks that one bad web request can take over any of them. No password needed. No plugin bug needed. The hole is in PHP itself.

That is PHP2Shell. Here is how the week unfolded.

• October 20, 2026. Details of the two flaws leaked online before the planned disclosure date. The PHP team pulled its fix forward by a day.
• October 21, 2026, about 13:35 UTC. PHP released fixed versions for every supported branch. It also shipped small source patches for PHP 7.4, 8.0 and 8.1.
• Same day. Security firms such as watchTowr, Cloudflare and Hadrian reported attack attempts in the wild. Public proof-of-concept code was already out.

The researchers at Wiz who found the flaws say they reach back to PHP 5.4. That means almost every PHP server built in the last ten years is in scope.

The two flaws behind PHP2Shell

You do not need to know the internals to fix this. But a short version helps you explain it to your team.

Both bugs can be turned into remote code execution. In simple terms, the attacker gets to run their own commands with the same rights as your PHP process. From there they can read your database passwords, plant a web shell or move deeper into your network.

Is your server affected?

If it serves web pages with PHP and you have not patched since October 21, assume yes. The PHP team lists every common way of running PHP as at risk.

• PHP-FPM. The usual setup behind Nginx, and common in Docker and Kubernetes.
• Apache with mod_php. This is the highest risk. The attack can work before any of your own code runs.
• php-cgi, FrankenPHP and LiteSpeed. All in scope.

Apps built on PHP carry the same risk. That means WordPress, Drupal, Joomla and Magento sites. It means Laravel and Symfony apps and shared hosting panels. It also means vendor tools that never tell you they run PHP.

Which versions are safe

Use this table to check where you stand. Find your branch and compare it with the fixed version.

How to fix PHP2Shell: a step-by-step plan

Work through these steps in order. If you run many servers, start with the ones the internet can reach.

Step 1: Find every PHP install

The hard part is often finding them all. Old staging boxes and forgotten admin tools are where attackers get in. Run this on each server to see the version.

php -v
php-fpm -v        # name may be php-fpm8.3 or similar
apachectl -M | grep php   # shows if mod_php is loaded

For containers, check the image rather than the host.

docker run --rm your-image:tag php -v
kubectl get pods -A -o jsonpath='{..image}' | tr ' ' '\n' | grep -i php | sort -u

Step 2: Save evidence before you change anything

Attacks started before the patch shipped. So copy your web server logs, PHP logs and config files somewhere safe first. If something did get in, you will need them.

Step 3: Update PHP

Linux vendors got the patches early, so updated packages should already exist. Use your normal package manager.

# Debian / Ubuntu
sudo apt update
sudo apt install --only-upgrade 'php*'

# RHEL / Rocky / Alma / Amazon Linux
sudo dnf update 'php*'

Then check the version again with php -v. Make sure it matches the fixed version for your distro. Distros often keep their own version number and add the fix as a backport, so read your vendor's security notice to confirm.

A note for Remi repo users. If you install PHP from rpms.remirepo.net, that repo did not have updates ready on release day. Switch to your distro's packages or build from source so you are not left waiting.

Step 4: Rebuild your containers

Patching the host does nothing for PHP inside a container. Pull a fresh base image, rebuild and redeploy.

docker build --pull --no-cache -t your-image:patched .
kubectl rollout restart deployment/your-php-app -n your-namespace

If you pin base images by digest, update the digest. A pinned old digest will quietly rebuild the vulnerable version. A scanner like Trivy for container vulnerability scanning will flag any image still on an old PHP build.

Step 5: Restart every PHP worker

This step is easy to miss. PHP-FPM and Apache keep old worker processes in memory. Until you restart them, the old code is still running.

sudo systemctl restart php8.3-fpm   # match your version
sudo systemctl restart apache2      # or httpd on RHEL

Step 6: Check for signs of a break-in

Patching closes the door. It does not remove anyone who already walked through it. Look for these warning signs.

• New or changed PHP files in your web root, uploads folder or cache folders.
• Odd cron jobs or scheduled tasks you did not create.
• New user accounts, in the operating system or in your CMS admin panel.
• The web server starting a shell, such as www-data running sh, curl or wget.

A quick way to spot recently changed PHP files:

find /var/www -name '*.php' -mtime -3 -ls

If you find anything, treat it as an incident. Rotate database passwords, API keys and cloud credentials that the app could read. On AWS, Amazon GuardDuty threat detection can help you spot odd outbound traffic from a hacked server.

What if you cannot patch today?

Sometimes a legacy app breaks on a new PHP version, or a change freeze is in place. Here is what helps, and how much.

• Put a WAF in front of it. Cloudflare says it has rules for the known attack paths, and they are on for all plans, including free. AWS, Google Cloud and other WAF vendors are shipping rules too. Our guide to setting up AWS WAF covers the basics. This buys time. It is not a fix.
• Cut internet access. If a server does not need to be public, close it off. The UK's NCSC has advised taking systems offline if you cannot fix them right away.
• Apply PHP's temporary settings, but do not trust them. PHP lists settings that reduce exposure, such as turning off session.upload_progress.enabled. watchTowr warns that config changes alone do not stop exploitation. Use them only on top of other steps.
• Use the source backports. For PHP 7.4, 8.0 and 8.1, the PHP team released small patches you can build from source. If you have an extended-support vendor, ask them for a package.

Be honest with yourself about old versions. If you are on PHP 7.3 or older, there is no patch at all. The real fix is an upgrade, and PHP2Shell is a good reason to finally book it.

Why this one is different

Most PHP security news is about a plugin or a framework. You patch one app and move on. PHP2Shell sits under all of them. That is why researchers are comparing it to the biggest bugs of recent years.

Two more details make it worse. The flaws leaked before the patch, so attackers had a head start. And one confirmed attack path uses a PHP feature that is on by default. So most servers meet the conditions out of the box.

The good news is that the fix is simple for supported versions. Update, rebuild, restart and check. Teams with a clean asset list and automated builds can be done in hours. Teams without one will spend most of the time on Step 1.

A quick checklist to share with your team

Copy this into your ticket or chat channel.

1. List every server, container and managed host running PHP.
2. Save logs and configs from internet-facing servers.
3. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the vendor package with the fix.
4. Rebuild and redeploy container images with a fresh base.
5. Restart PHP-FPM, Apache and any other PHP workers.
6. Check for new PHP files, cron jobs, accounts and shell activity.
7. Put a WAF in front of anything you could not patch, or take it offline.
8. Plan the upgrade for anything on PHP 8.1 or older.

Sources

These are the primary sources behind this guide. Check them for updates, since details may change.

• PHP security release announcement
• PHP advisory for CVE-2026-109618
• PHP advisory for CVE-2026-109619
• UK NCSC alert on the PHP flaws
• Wiz Research write-up on PHP2Shell

Need help patching PHP2Shell?

If you run a lot of PHP across cloud accounts, containers and old servers, this can take longer than it should. SquareOps is an AWS Advanced Consulting Partner and our SRE team runs 24/7 operations for production systems. We can help you find every PHP install, patch and rebuild safely, and check for signs of compromise. If you want a second opinion on what you found, we can do that too.

Our DevOps team can also set up automated image rebuilds, so the next fix like this takes minutes rather than days.

Talk to a SquareOps engineer about PHP2Shell. Tell us what you run and we will tell you where to start.