PHP2Shell: the critical PHP flaws and what to do now

In short: The vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) allow remote code execution on a PHP server. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35: anyone on an earlier version needs to update. On 23 October PHP also advised disabling session.upload_progress until the next release. WordPress and WooCommerce don't need updating: it's the server's PHP that does.

PHP runs a large share of the world's websites: WordPress, WooCommerce, in-house management software, many online shops. On 21 October 2026 the PHP project fixed two vulnerabilities that allow code to be executed on the server remotely. In plain terms: under certain conditions an attacker can take control of the machine. A second advisory followed on 23 October. Here is what happened and what to check today.

What happened

On 20 October PHP announced a security release for two critical flaws. The fixed versions came out the following day: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both vulnerabilities have a CVSS v4.0 score of 9.2 out of 10 and go by the name PHP2Shell:

• CVE-2026-109618: when memory runs out, PHP can stop halfway through preparing the request data. The clean-up that follows treats that incomplete data as valid.
• CVE-2026-109619: some data from a request survives after its memory has been freed. A later request on the same process can use it before it is cleared.

According to PHP's advisory, all web installations are affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest with mod_php: here the demonstrated attack starts before the site's own code has even run.

The second advisory, of 23 October

Two days later PHP published an informational advisory about a case linked to file upload progress tracking in sessions (session upload progress), registered as CVE-2026-115560. The 21 October releases do not close it: the fix will come with the next maintenance release.

The case is rare. It requires the site to set a session serialisation handler of php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before session_start(). Upload progress tracking must also be enabled. If you never change the handler at runtime, you can leave the feature switched on.

The recommendation is nonetheless simple: set session.upload_progress.enabled=0 until the next update. It was already among the mitigations for the second flaw: if you made the change on 21 October, leave it as it is. The setting goes in php.ini, in the PHP-FPM pool or in the web server configuration, and the PHP processes then need restarting. Setting it with ini_set() or in the .user.ini file is not enough.

The same day, Italy's National Cybersecurity Agency (ACN) updated its bulletin (AL07/261021/CSIRT-ITA). It asks organisations to update and to search their logs for signs of attack: unusual HTTP requests, out-of-memory errors, PHP processes ending abruptly, unexpected processes, files modified for no reason and strange network connections. If a service can't be updated quickly, ACN advises considering suspending access to it.

Is it already being exploited?

There are concrete signs. Amazon recorded an exploitation attempt on its honeypot servers on 17 October, before the flaws were made public. After disclosure, proof-of-concept attack code circulated and several security firms saw large-scale scanning.

The picture is less dramatic than it may seem at first reading. Sansec found that the public exploits don't work on a PHP installation with default settings. Arctic Wolf reports plenty of scanning and few successes. That doesn't change the conclusion: the fixed version needs installing anyway, because attacks improve quickly.

WordPress and WooCommerce: what changes

WordPress.org and WooCommerce made it clear on 21 October: there is no WordPress or WooCommerce update to install for these flaws. The problem lies in PHP. It's the server's PHP that needs updating, through your hosting provider or whoever manages the machine.

To see the version, open the dashboard and go to Tools → Site Health → Info → Server. The full number is what counts. If the site is on PHP 8.3 you need at least 8.3.36; on 8.4, at least 8.4.27, and so on. WooCommerce recommends PHP 8.3 or later.

What to do, case by case

Shared hosting (cPanel, Plesk and the like)

In the control panel you choose the PHP branch, for example 8.3. The exact version within that branch, however, is installed by the provider. Check the number in Site Health. A number below the fixed one doesn't necessarily mean the server is exposed: some providers have recompiled PHP with the fix while keeping the same version number. In that case what counts is the build date (Build Date) shown on the phpinfo() page: a date of 21 October 2026 or later is a good sign, but only the provider can confirm it. Delete the phpinfo() file as soon as you have checked. If in doubt, write to support and ask whether the fix has been applied and whether the settings recommended by PHP are active.

If the site is still on PHP 8.1 or older, moving to a supported branch can no longer be put off. Test the site on a copy first: very old themes and plugins may not work with PHP 8.2 or later.

VPS and dedicated servers

• Update the PHP packages through the operating system's package manager or the repository you use.
• Linux distributions often apply the fix without changing the main version number: check the distribution's security advisory and the package version, not just the PHP version.
• Restart PHP-FPM or the web server. Processes that are already running keep using the old code until they restart.
• If you use containers, rebuild the images from an updated base image and redeploy them.
• Set session.upload_progress.enabled=0 as indicated in the 23 October advisory.
• Go through the logs from 17 October onwards with the ACN list to hand.

If you can't update straight away

PHP lists some partial mitigations and states clearly that none of them is complete. For the first flaw: lower limits on request size (post_max_size at 8 MB if the site doesn't receive files, 32 MB if it does) and limits enforced by the web server or proxy. For the second: disable session upload progress, remove invalid or deprecated settings that generate warnings on every request, and fix the fatal errors a visitor can trigger. Hiding warnings with display_errors or @ doesn't help.

A web application firewall helps. Since 21 October Cloudflare has enabled specific rules, including on its no-cost plan. And it has already seen real attack traffic. It's a filter in front of the door, not a new lock: it doesn't replace updating.

Older versions

PHP 8.1 and earlier are out of support and the PHP project no longer releases updates for those branches. Minimal fixes exist for the 7.4, 8.0 and 8.1 branches and some providers distribute them, but staying there means depending on others for every future flaw. PHP 8.2 is also nearing its end: support finishes on 31 December 2026. If you have to update anyway, it makes sense to go straight to 8.3 or 8.4.

This article summarises the official advisories available as of 24 October 2026. It is not a substitute for a technical check of your server: the guidance may change with upcoming PHP releases.

Further reading: WordPress and WooCommerce security: the measures that matter · hosting for a WooCommerce shop

Frequently asked questions

What is PHP2Shell?

It's the name given to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. They allow an attacker to execute code on the server remotely. The CVSS v4.0 score is 9.2 out of 10.

Which PHP versions are safe?

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later. PHP 8.1 and earlier no longer receive updates from the PHP project: they need moving to a supported branch, or else you need fixes from your provider.

Do I need to update WordPress or WooCommerce?

No. WordPress.org and WooCommerce have made it clear that the problem lies in PHP, not in their code. It's the server's PHP that needs updating: on shared hosting the provider does it, on a VPS whoever manages the server.

How do I check the PHP version of my WordPress site?

In the dashboard, open Tools, then Site Health, then the Info tab and the Server section. The full number, for example 8.3.36, tells you whether the fix is there. Some hosts and Linux distributions apply the fix without changing the number: in that case what counts is their official statement and the build date shown by phpinfo().

What does the 23 October advisory say?

PHP recommends setting session.upload_progress.enabled=0 until the next maintenance release, to guard against a rare case registered as CVE-2026-115560. The setting goes in php.ini or in the FPM pool configuration and requires the PHP processes to be restarted.

Is a web application firewall like Cloudflare's enough?

No. Cloudflare has enabled rules even on its no-cost plan and blocks many attempts, but it says so clearly: the firewall reduces the risk and does not replace updating PHP.