UrgentEmergency response
PHP2Shell: security check and update for PHP applications
Two critical flaws in the PHP core allow remote code execution. They are being actively exploited. Every PHP installation that answers web requests is affected, whatever the framework, shop or CMS on top.
We have been developing with PHP since 1998 and run PHP applications for clients. We check your systems, close the hole, and bring applications stuck on old PHP versions to a current, maintainable state.
- Vulnerabilities
- CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2, remote code execution (RCE) in the PHP core, known as PHP2Shell
- Affected
- PHP 8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36, 8.2 before 8.2.35, and every older version (8.1, 8.0, 7.x, 5.x) without patched packages
- Server setups
- PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed
- Status
- Actively exploited, in the CISA Known Exploited Vulnerabilities (KEV) catalog since 26 October 2026
- Only complete fix
- Update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or to a patched package from your distribution or hoster
What is PHP2Shell?
PHP2Shell is the name given to two security flaws in the PHP interpreter itself, published on 21 October 2026. The first (CVE-2026-109618) abuses how PHP handles running out of memory in the middle of a request: a crafted multipart request can steer the cleanup logic onto invalid data. The second (CVE-2026-109619) abuses global state that is not reset between two requests on the same worker. In both cases an attacker can run code on the server without logging in, and with Apache and mod_php even before the application starts.
Because the bug is in the core, the application does not matter: a carefully written shop is just as exposed as a neglected plugin. The PHP version alone decides.
Why old PHP versions are especially at risk now
Official updates exist only for PHP 8.2 to 8.5. PHP 8.1 received its last security updates at the end of 2025, PHP 8.0 at the end of 2023, PHP 7.4 at the end of 2022, PHP 5.6 back in 2018. Applications on these versions have been without protection against new flaws for years, and for PHP2Shell they only have unofficial backports or packages from individual hosters.
Many of them are still running because an upgrade was postponed: old WordPress, TYPO3 or Drupal installations without a maintenance contract, shops on Magento 1 or early Shopware versions, in-house applications on Symfony, Laravel, Zend or frameworks that no longer exist. Exactly these systems are now open on the internet, and the attacks are automated.
How to tell whether you are affected
- Your website, shop or portal runs on PHP, for instance on WordPress, TYPO3, Drupal, Magento, Shopware, Symfony or Laravel, and nobody has applied an update since 21 October 2026.
- The PHP version is older than 8.2, or you do not know which version is running.
- Your hoster or agency has not been in touch, or you no longer have a contact.
- There are unexplained files, new admin accounts, unusual load or spam being sent from the server.
What we do
Immediate check
Inventory of every system running PHP: version, server setup, hoster, exposure. An assessment of what is open, within hours of your request.
Close the hole
Update to a patched PHP version, for older branches apply a backport, restart all workers, confirm the application still runs.
Stopgap if an update is not possible right away
Disable session.upload_progress, enforce a memory limit, set limits for request size and multipart parts at the proxy, web application firewall rules. Lowers the risk, does not replace the update.
Check for compromise
Search for web shells, unexpected files, processes and cron entries, review of access and PHP logs since mid-October. If something is found: isolate, rotate credentials, rebuild cleanly.
Upgrade to current standards
For applications on PHP 5.6, 7.x, 8.0 or 8.1: move to a supported PHP version including the code changes, update the framework, shop or CMS and its extensions, test, and move to maintained hosting.
Stay maintainable
An update routine, monitoring and documentation, so the next flaw of this kind is a planned working day rather than an emergency.
Send us a short note on which systems might be affected. We reply at short notice and tell you honestly what can be done right away and what cannot.
Frequently asked questions
- My hoster has already updated PHP. Am I safe?
- If all your systems run 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or a patched package and the workers were restarted: yes, against this flaw. You should still check whether someone got in between 17 October and the update.
- My application only runs on PHP 7.4. What now?
- Short term, a backport or patched package if your hoster offers one, plus the stopgap measures. Medium term there is no way around an upgrade, and that is exactly what we offer: adapt the code, update dependencies, test, move.
- Is a firewall or CDN enough?
- A web application firewall can catch known attack patterns and is useful as a stopgap. It does not protect against variants. The hole is closed only by the update.
- What does it cost?
- The immediate check is a small fixed effort. For closing the hole and an upgrade you get a concrete estimate after the check. We also tell you when a system is no longer worth the effort.
Keywords: PHP2Shell, CVE-2026-109618, CVE-2026-109619, PHP security vulnerability, PHP remote code execution, PHP RCE, PHP update, PHP upgrade, PHP 5.6, PHP 7.4, PHP 8.0, PHP 8.1, PHP 8.2, PHP 8.3, PHP 8.4, PHP 8.5, PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed, end of life, legacy PHP, security check, emergency, WordPress, TYPO3, Drupal, Magento, Shopware, Symfony, Laravel, web shell, compromise, shop security, CMS security, patch, backport, Germany
Last updated: 6 November 2026 · PHP security release of 21 October 2026 · CISA Known Exploited Vulnerabilities