PHP2Shell exposes two critical PHP vulnerabilities that could allow remote code execution. Learn about CVE-2026-109618, CVE-2026-109619, the latest security news, and how to protect your server.
PHP2Shell has become a major security concern after details of two critical PHP remote code execution vulnerabilities leaked online before the planned public disclosure. Tracked as CVE-2026-109618 and CVE-2026-109619, the flaws have triggered an emergency security response from the PHP security team.
Both vulnerabilities received a critical severity rating of 9.2 on the CVSS 4.0 scale. If successfully exploited, remote code execution vulnerabilities can allow attackers to execute commands on affected systems, potentially giving them a path to compromise web servers and the applications running on them.
The incident is particularly concerning because PHP powers a large part of the web, including WordPress websites, e-commerce platforms, content management systems, and applications hosted on shared servers.
As of October 21, 2026, PHP has announced an emergency security release scheduled for 14:00 UTC. Website owners and server administrators should prepare to install the appropriate security updates as soon as they become available.
What Is PHP2Shell?
PHP2Shell is the name security researchers are using for two critical PHP vulnerabilities that could enable remote code execution. The vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619.
Remote code execution, commonly abbreviated as RCE, occurs when an attacker can cause a vulnerable system to execute code or commands remotely. Depending on the vulnerability and the server's configuration, successful exploitation can lead to unauthorized access, data theft, website modification, or further compromise of the hosting environment.
The name PHP2Shell reflects the potential impact of turning a weakness in PHP into a way to execute commands on a server.
However, there is an important distinction between what researchers have confirmed and what remains unknown. Although the vulnerabilities have been described as critical RCE flaws, the PHP team has not yet published the complete technical details in the advance notice. The precise exploitation requirements and affected versions must be verified against the official security release.
The name PHP2Shell is a label used by researchers, not an official PHP product or vulnerability name.
Why Are the PHP2Shell Vulnerabilities So Dangerous?
The biggest concern is that the vulnerabilities exist in PHP itself rather than in a single website plugin or application.
PHP is used by many popular web platforms, including WordPress, Drupal, Joomla, Magento, and WooCommerce. It also runs behind countless custom applications, hosting control panels, and business systems.
This creates a potentially broad attack surface. A vulnerability in a shared application component can affect multiple websites, even when those websites use different themes, plugins, or application code.
Several factors make PHP2Shell particularly concerning.
1. Critical Remote Code Execution Risk
Both vulnerabilities have received a CVSS 4.0 score of 9.2, placing them in the critical severity category.
If an attacker can exploit a vulnerable PHP installation, the consequences may extend beyond the website itself. Depending on the privileges of the affected process and the server's security controls, an attacker could attempt to access sensitive files, install malicious software, steal credentials, or move further into the hosting environment.
A critical vulnerability does not automatically mean every installation is exploitable. The actual risk depends on the affected version, execution environment, configuration, and available mitigations.
2. A Large Number of Potentially Exposed Servers
PHP is deployed across shared hosting services, virtual private servers, cloud environments, and dedicated infrastructure.
Many administrators also run PHP indirectly through third-party applications or hosting products. As a result, identifying every affected installation may take more work than simply checking the PHP version on a primary web server.
Sansec has warned that the issue could affect a broad range of e-commerce infrastructure. This is especially relevant to stores running platforms such as Magento, Shopware, and WooCommerce.
However, reports claiming that every PHP release from version 5 onward is affected should be treated cautiously until the official advisory confirms the scope.
3. Outdated PHP Versions Create Additional Problems
PHP's support policy makes this incident more complicated.
According to current PHP support information, the maintained release branches are PHP 8.2, 8.3, 8.4, and 8.5. Older branches, including PHP 8.1, PHP 8.0, and PHP 7.x, have reached end of life.
End-of-life versions generally do not receive new upstream security releases. If an affected system runs an unsupported branch, its administrator may need to upgrade PHP or obtain a verified backported fix from the operating system vendor or hosting provider.
This is not a problem that can always be solved by updating a website's plugins or application dependencies.
PHP2Shell Latest News and Security Update
The PHP2Shell incident developed quickly after the vulnerabilities were leaked online on October 20.
The PHP security team subsequently announced an emergency release for October 21 at 14:00 UTC. The advance notice confirmed the critical severity ratings but withheld technical details and the list of affected and fixed versions until the release.
The latest reports provide several important developments.
PHP has scheduled an emergency security release. The official announcement confirms that two critical vulnerabilities are being addressed. Administrators should check the official PHP security announcements for the published fixes rather than relying on early reports or unofficial version lists.
Security researchers confirmed that the leaked vulnerability reports were credible. Researchers at watchTowr confirmed that the vulnerabilities were real and reported reproducing one of them. However, the initial reports did not establish the complete affected version range or the exact conditions required for exploitation.
Sansec warned e-commerce operators to prepare for attacks. In its October 21 research update, Sansec warned that attackers could begin exploiting the vulnerabilities rapidly after technical details and fixes became public. This is a security prediction, not confirmation that widespread exploitation has already occurred.
CERT-EU recommended preparing for immediate patching. Its security advisory advises organizations to identify affected PHP installations and consider isolating internet-facing applications if immediate patching is not possible.
These developments highlight why administrators should not wait for reports of successful attacks before preparing their systems.
How to Protect Your Server Against PHP2Shell
If you manage a website or server that uses PHP, there are several practical steps you can take to reduce the risk.
1. Identify Every PHP Installation
Start by checking which PHP versions are running across your infrastructure.
On Linux servers, you can check the command-line PHP version with:
php -vTo check the PHP version used by PHP-FPM, you can inspect the installed packages or query the relevant service binary. The command-line version may differ from the version used by your web server.
For Debian and Ubuntu systems, you can inspect installed PHP packages with:
dpkg -l | grep -E 'php[0-9.]|php-fpm'For RHEL-based systems, use:
rpm -qa | grep -i phpThese commands help identify installed packages, but they do not guarantee that every PHP installation has been discovered.
Also check Docker containers, virtual machines, hosting control panels, and third-party applications that bundle their own PHP runtime.
2. Install the Official Security Updates
Once the PHP security team publishes the affected versions and fixes, update every affected installation.
For Debian or Ubuntu, you can inspect available package updates with:
sudo apt update
apt list --upgradableAfter confirming that the appropriate security update is available, upgrade the relevant PHP packages through your operating system's package manager.
For Docker deployments, update the PHP base image or runtime packages as appropriate, rebuild the affected images, and redeploy the containers.
For example, if your Dockerfile contains:
FROM php:8.3-fpmDo not assume that rebuilding this image automatically resolves PHP2Shell. The image tag may still resolve to an image containing an older PHP patch level. Verify the resulting PHP version and ensure that the image includes the official fix.
Important: The commands above are general maintenance examples. They do not identify a specific PHP2Shell patch version. Confirm the fixed release before deploying.
3. Address End-of-Life PHP Versions
If your server uses PHP 8.1 or an older release, do not assume that an official upstream patch will be available.
PHP's supported branches are PHP 8.2 and later. If you cannot upgrade immediately, contact your operating system vendor or hosting provider to determine whether a verified backported security fix is available.
Where the affected system cannot be patched promptly, consider restricting public access or isolating the application from untrusted networks.
A web application firewall may provide an additional layer of protection, but it should not be treated as a substitute for fixing a vulnerability in the PHP runtime itself.
4. Monitor Suspicious PHP Processes
Security monitoring can help detect activity that may indicate a compromised web server.
Investigate unexpected child processes launched by PHP-FPM, PHP-CGI, Apache, or other web server processes.
Examples of suspicious activity include PHP processes starting:
Shells such as
shorbashDownload utilities such as
curlorwgetInterpreters such as Python or Perl
Unexpected commands that enumerate users, inspect the operating system, or explore the network
These behaviors are not conclusive proof of PHP2Shell exploitation. Some legitimate applications use external processes, so investigate the parent process, command line, timing, and surrounding activity.
Huntress has recommended monitoring PHP process behavior and preserving relevant logs when suspicious activity is discovered.
5. Investigate Signs of a Possible Compromise
If you suspect that an attacker has exploited your server, updating PHP alone may not be sufficient.
A successful intrusion could leave behind malicious files, compromised credentials, scheduled tasks, or other persistence mechanisms.
Consider taking the following steps:
Isolate the affected server if active compromise is suspected.
Preserve PHP, web server, authentication, and system logs.
Inspect the web root for unexpected files and modifications.
Review cron jobs, scheduled tasks, user accounts, and running processes.
Rotate potentially compromised credentials after securing the environment.
Restore from a known-clean backup if necessary, following an investigation of the incident.
If the server handles sensitive information or business-critical applications, involve your security team or incident response provider.
Can a WordPress Plugin Update Fix PHP2Shell?
No. Updating WordPress, its themes, and its plugins is good security practice, but it does not directly patch vulnerabilities in the PHP runtime.
PHP2Shell concerns the PHP execution environment itself. Even if WordPress and all its plugins are up to date, the underlying PHP installation may still require a security update.
The same principle applies to other PHP-based applications, including Magento, Drupal, Joomla, and custom PHP websites.
Application-level security controls may help reduce exposure, but administrators should prioritize the official PHP fix or a verified vendor-provided backport.
Is PHP2Shell Being Actively Exploited?
As of the initial reports published on October 20 and 21, researchers had not confirmed widespread exploitation of these vulnerabilities.
However, the absence of confirmed attacks does not mean affected servers are safe. Security researchers have warned that exploitation attempts could increase once technical details or working exploit code become publicly available.
The distinction matters because a vulnerability can be genuine and dangerous before attackers begin exploiting it at scale.
Administrators should monitor official advisories and reputable security research for updates on exploitation activity, affected versions, and detection methods.
Final Verdict
PHP2Shell is a serious security incident that deserves immediate attention from website owners, developers, hosting providers, and system administrators.
The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have been assigned critical severity ratings, and the reported remote code execution risk makes the incident particularly concerning for internet-facing PHP servers.
The most important steps are straightforward: identify every PHP installation, prepare to apply the official security updates, address unsupported PHP versions, and monitor servers for suspicious activity.
Do not rely solely on a WordPress update, a plugin patch, or a web application firewall. The priority is to secure the underlying PHP runtime and investigate any evidence that a system may already have been compromised.
For the latest confirmed information, consult the official PHP security announcements and verify the affected and fixed versions before making changes to production systems.
SEO description: PHP2Shell exposes two critical PHP vulnerabilities that could allow remote code execution. Learn about CVE-2026-109618, CVE-2026-109619, the latest security news, and how to protect your server.
Sources
PHP Official Website, Upcoming Critical PHP Security Release: https://www.php.net/
Huntress, Rapid Response: php2shell, Leaked Critical PHP Vulnerabilities: https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
The Hacker News, PHP2Shell: Two Unpatched Critical PHP RCE Flaws: https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
Sansec, Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619: https://sansec.io/research/php2shell
CERT-EU, Security Advisory 2026-018: Critical Vulnerabilities in PHP: https://cert.europa.eu/publications/security-advisories/2026-018/
BleepingComputer, PHP Warns Admins of Two Critical Flaws, Emergency Patches Coming Tomorrow: https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/
Ars Technica, PHP Warns It Plans to Release Two Emergency Patches: https://arstechnica.com/security/2026/10/php-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches/
