Emergency PHP Security Update: Fixing the Critical Remote Code Execution Flaws

Last updated: October 23, 2026

Patch PHP Today: Two Critical RCE Flaws Are Being Exploited

If your website runs on PHP, stop and check your version right now. On October 21, 2026, the PHP team shipped an emergency security release to fix two critical flaws, nicknamed PHP2Shell, that let an attacker run their own code on your server without logging in. Attacks were spotted in the wild within hours.

This affects WordPress, Drupal, Joomla, Magento, Laravel and almost any PHP site, because the bug sits in PHP itself, not in a plugin or theme.

Quick summary

• What: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2 (critical).
• Impact: Unauthenticated remote code execution (RCE) on servers running PHP.
• Fix: Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart every PHP service.
• Workaround: None. PHP says updating is the only safe choice.
• Status: Exploitation observed in the wild; CISA has urged immediate patching.

What Is PHP2Shell and What Happened?

PHP2Shell is the name given to a pair of remote code execution vulnerabilities in the PHP interpreter. They were found by researchers at Calif and reported privately to the PHP security team for a coordinated fix.

The plan went off track on October 20, 2026, when details leaked online two days before the agreed disclosure date. PHP responded the same day with an advance notice and pulled the release forward to October 21 at 14:00 UTC. Fixed versions went live that afternoon.

The leak shrank the gap between disclosure and attack to almost nothing. Amazon Threat Intelligence later traced an exploitation attempt back to October 17, four days before the patch. Cloudflare reported early exploitation signs and pushed temporary WAF rules. watchTowr confirmed attacks against its honeypots from October 21.

Government agencies moved fast too. CISA (USA), CERT-EU, the UK NCSC and Singapore’s CSA all issued alerts telling organisations to patch internet-facing PHP servers first.

How the Two PHP Vulnerabilities Work

Both flaws are memory-safety bugs in how PHP sets up and tears down a web request.

Who is in scope: every PHP installation that serves web requests, whether it runs under PHP-FPM, Apache mod_php, php-cgi, LiteSpeed or FrankenPHP. PHP rates Apache mod_php as the highest risk, because an attack can fire before any of your application code runs.

Researchers showed working attacks against default WordPress, Drupal and Joomla containers, and even a bare “Hello World” script. They also showed the bug can leak PHP worker memory, which may hold passwords, tokens and API keys. Some security firms (watchTowr) score the issue a full 10.0.

Affected and Fixed PHP Versions

Every release before the versions below is vulnerable, and researchers confirmed the bug reaches back to PHP 5.

Priority order: internet-facing servers first, starting with any running PHP as an Apache module.

How to Check If Your Server Is Vulnerable

The command-line PHP and the web PHP can be different versions, so check both.

1. Command line: run php -v over SSH.
2. PHP-FPM: run php-fpm -v (or php-fpm8.3 -v etc. on Debian/Ubuntu).
3. What the website really uses: temporarily upload a file with <?php phpinfo(); and open it in a browser. Note the version and “Server API” line, then delete the file immediately.
4. Hosting panel: cPanel, Plesk, DirectAdmin and most managed hosts show the PHP version under “Select PHP Version” or “PHP Settings”.
5. Containers: check the tag of your base image (for example php:8.3-fpm) and rebuild if it predates October 21, 2026.

Note for Linux users: Debian, Ubuntu and RHEL often backport security fixes without changing the main version number. If php -v shows an older number, check your package changelog for CVE-2026-109618 instead of assuming you are exposed or safe.

Step-by-Step: How to Apply the Emergency PHP Update

Ubuntu / Debian

sudo apt update 
sudo apt list --upgradable | grep php 
sudo apt upgrade

RHEL / AlmaLinux / Rocky (incl. Remi repo)

sudo dnf check-update | grep -i php 
sudo dnf upgrade 'php*'

Docker

docker pull php:8.4-fpm # match your tag 
docker compose build --pull --no-cache 
docker compose up -d

Windows / Source Builds

Download 8.5.12, 8.4.27, 8.3.36 or 8.2.35 from php.net and replace the existing binaries.

cPanel, Plesk and Shared Hosting

Run the panel’s system/EasyApache update, or open a ticket asking your host to confirm they have deployed the October 21 PHP release.

Restart Everything That Loads PHP

Running workers keep the old, vulnerable code in memory until restarted. This matters most for CVE-2026-109619.

sudo systemctl restart php8.3-fpm # adjust to your version 
sudo systemctl restart apache2 # or httpd / nginx / lsws

Verify the Fix

Re-run php -v and your phpinfo check, and confirm the patched version is what the website reports.

Running an Old PHP Version? What to Do Now

PHP 8.1 and older get no official release. Your options, best first:

1. Upgrade to PHP 8.4 or 8.5. It is the only long-term fix.
2. PHP 7.4, 8.0, 8.1: install a patched package from your Linux distribution or an LTS vendor, or apply PHP’s minimal source backports.
3. PHP 7.3 and older (including PHP 5): no fix exists. Upgrade, or take the site off the public internet.

Stopgaps while you patch (not a fix):

• Restrict access to the server (IP allow-lists, VPN, maintenance mode).
• Enable WAF rules from your provider; Cloudflare, Akamai and others have shipped PHP2Shell signatures.
• Watch logs for odd PHP worker crashes, out-of-memory errors and unexpected new files in web directories.

If the server was exposed and unpatched after October 17, treat it as possibly compromised: rotate database passwords, API keys and secrets, and look for web shells.

PHP2Shell Timeline

Frequently Asked Questions (FAQs)

1. What is PHP2Shell?

PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP interpreter that let an unauthenticated attacker execute code on a web server.

2. Which PHP versions are affected?

All versions before 8.5.12, 8.4.27, 8.3.36 and 8.2.35, plus every older branch back to PHP 5.

3. Which version should I update to?

The fixed release for your branch: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you are on 8.1 or older, upgrade to a supported branch.

4. Is my WordPress site affected?

Yes, if the server runs a vulnerable PHP version. The bug is in PHP itself, so updating WordPress, plugins or themes does not fix it. Your host or server admin must update PHP.

5. Is PHP2Shell being exploited right now?

Yes. Exploitation has been seen in the wild since at least October 21, 2026, with one attempt traced to October 17.

6. Can I fix it by changing php.ini or server settings?

No. PHP states that no configuration change fully mitigates these vulnerabilities. WAF rules and access limits only buy time.

7. Do I need to restart after updating PHP?

Yes. Restart PHP-FPM, Apache, LiteSpeed or any service that loads PHP. Old workers keep running vulnerable code until restarted.

8. I use shared hosting. What should I do?

Check your PHP version in the control panel and contact your host to confirm they have installed the October 21, 2026 release.

9. My php -v shows an older version after updating. Am I still vulnerable?

Not necessarily. Distributions like Debian, Ubuntu and RHEL backport fixes. Check the package changelog for CVE-2026-109618 and CVE-2026-109619.

10. What is the CVSS score of PHP2Shell?

PHP rates both flaws 9.2 (critical) on CVSS v4.0. watchTowr rates the issue 10.0.

11. Is Nginx with PHP-FPM safe?

No. PHP-FPM, Apache mod_php, php-cgi, LiteSpeed and FrankenPHP are all in scope. mod_php carries the highest risk.

12. How do I know if my server was already hacked?

Look for unknown PHP files in web folders, new admin users, odd outbound traffic and PHP worker crashes. If in doubt, rotate all secrets and restore from a clean backup.

Final Word: Patch First, Investigate Second

PHP2Shell is one of the most serious PHP security issues in years: it hits the language itself, needs no login, and is already being exploited. The fix is simple. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart every PHP service, and confirm the new version is live. Then check exposed servers for signs of compromise.

Bookmark this page; we will update it as new advisories and distribution patches appear.

Sources

• CISA: Critical Vulnerabilities in PHP Require Immediate Patching
• watchTowr: PHP2Shell FAQ
• Qualys: How to find, mitigate and patch PHP2Shell
• Patchstack: PHP vulnerable to critical RCE, attacks ongoing
• Akamai: Critical RCE vulnerabilities in PHP core
• Wikipedia: PHP2Shell
• PHP 8.4.27 release notes (GitHub)
• Rescana: PHP RCE patch timeline
• CSA Singapore alert AL-2026-151