php2shell, the critical PHP vulnerability (CVE-2026-109618 and CVE-2026-109619). What to do and how to protect yourself
In short: on October 20, 2026 the details of two critical PHP vulnerabilities leaked. They are tracked as CVE-2026-109618 and CVE-2026-109619, and nicknamed „php2shell". Both are rated 9.2 out of 10 (CVSS 4.0) and both allow remote code execution on the server without logging in. Patches are scheduled for October 21 at 16:00. PHP powers most websites, so this affects almost every site owner.
If you found this article by searching for „php2shell" or the CVE numbers, you probably already sense something serious is going on. Below we explain, in plain language, exactly what the problem is, what could happen and how to protect yourself step by step.
What is php2shell and what are CVE-2026-109618 and CVE-2026-109619
php2shell is two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that let an attacker run code on the server remotely, without logging in, which in practice means taking over the site and the server. Both are rated 9.2 out of 10 on CVSS 4.0.
These are two separate, critical vulnerabilities in PHP itself, the software that runs on the server and „assembles" your website on every visit. The PHP security team rated both 9.2 out of 10 on CVSS 4.0, which puts them in the top, critical band.
Key facts:
- They are RCE (Remote Code Execution) flaws, meaning they let an attacker run arbitrary code on the server.
- The attack requires no login and no privileges on the site.
- Details leaked before a patch existed (a zero-day situation). That is why the PHP team moved the release forward and reserved the right to ship even sooner if mass exploitation begins.
- „php2shell" is the nickname going around among researchers. It says it all: from an HTTP request to a „shell", that is, remote control of the server.
How the flaw works and how the attack happens
In simple terms: the attacker sends a specially crafted HTTP request to the site. Instead of being handled like a normal visit, the request triggers a bug in PHP and makes the server run the attacker's commands. The result is a „shell", remote access to the system as if someone sat down at your server.
Full technical details have not been published officially yet (they are due with the patch). Early industry reporting links the issue to multipart request handling and PHP's session mechanism, and the suggested stopgap is disabling the option that tracks file upload progress. Treat that as a hint rather than a confirmed full analysis, because the official write-up is still to come.
Why is this so dangerous? Because the bug is in PHP itself, not in a single plugin or theme. PHP runs „underneath" a huge part of the internet, so one flaw in it opens the door to very many sites at once.
Who is affected
Short answer: almost anyone with a website. PHP powers, among others:
- WordPress (that is, most sites in the world),
- Joomla, Drupal,
- WooCommerce, Magento, PrestaShop shops,
- Laravel apps and many custom systems,
- hosting control panels and tools that do not even advertise they run PHP.
Reports indicate that PHP versions from 5 through 8 may be affected, and that fixes will likely reach only currently supported branches. That means old, unsupported PHP versions may get no patch at all. Researchers estimate over a million servers directly exposed to attack.
What could happen if you do nothing
If someone exploits this flaw on an unpatched server, in the worst case they can:
- take full control of the website and the server,
- tamper with the content of the site (spam, redirects to other sites, fake payment pages in a shop),
- steal data, including customer data and the database contents,
- leave a hidden „back door" (backdoor) to return even after you patch,
- use your server to send spam or attack others, which ends with your domain on blacklists.
The consequences can be long-lasting: lost customer trust, search ranking drops after the site is flagged as unsafe, and tedious cleanup after an infection.
How to check whether your site is exposed (your PHP version)
- Find out which PHP version your site runs. The fastest way is your hosting panel (a „PHP" or „PHP version" section) or asking your provider. In WordPress you can also see it under „Tools → Site Health → Info".
- Determine whether it is a supported version. If it is an old, unsupported branch, the risk is higher, because there may be no patch for it.
- Check whether the site is public-facing (almost every business site is). Patch internet-facing systems first.
How to protect your site against php2shell, step by step
1. Update PHP (the only permanent fix)
As soon as your host releases patched PHP packages, install them. Public-facing sites first. Most shared hosts will apply the patch on their side or let you switch the PHP version in the panel. Watch your provider's announcements.
2. Apply temporary measures until the patch is out
This is only a stopgap to reduce risk until you can update:
- consider disabling session.upload_progress.enabled in php.ini (a measure recommended for the pre-patch window),
- add rules on your web application firewall (WAF), for example if you use Cloudflare,
- limit or temporarily disable file upload features where they are not essential.
3. Cut off end-of-life PHP
If your site runs an unsupported PHP version that may get no fix, plan to upgrade the environment. Until then, the safest option is to take the app off the internet or put it behind a WAF.
4. Back up before updating
Before any major change, make a website backup. If the update disturbs something, you can roll back to a working version in minutes. It also helps to know how to update a site without breaking it.
5. Turn on monitoring and detection
Set up website monitoring to catch unusual behavior quickly: sudden content changes, downtime or warnings appearing. The sooner you spot a problem, the smaller the damage.
How to tell if you have already been breached (signs and IOCs)
Typical traces of PHP exploitation:
- web server processes (php-fpm, php-cgi, apache2) launching shells or network tools: sh, bash, cmd, powershell, as well as curl, wget, nc,
- reverse shell patterns in command lines: /dev/tcp/, fsockopen, mkfifo,
- quick recon commands run „from the website": whoami, id, uname -a, ipconfig,
- new, unknown files in the website directory (often webshells),
- new admin accounts, unusual cron jobs, unexpected log entries.
What to do if you are a victim
- Isolate the server or the site to stop the attacker from doing more.
- Preserve the web server and PHP logs before they are overwritten. They are the evidence of what happened.
- Do not stop at deleting one file. Infections usually leave backdoors that bring them back. You need a proper audit of the compromised site.
- Restore the site from a clean backup from before the infection, then close the hole (update PHP) and change all passwords (panel, database, FTP, admin accounts).
Timeline of the php2shell vulnerability
- October 20, 2026: details of two critical PHP vulnerabilities appear online; the post is taken down, but screenshots are already circulating. Researchers confirm the flaws are real.
- October 20, 2026: the PHP team publishes an advance notice of an emergency security release and schedules it for October 21.
- October 21, 2026, 16:00: the patches are due. First reports of exploitation attempts also appear, so response time matters.
Do not want to deal with this? That is what we are for
If your site is under our care, you do not need to know the CVE numbers or watch the announcements. We track them for you, check which PHP version your site runs, and roll out the update or a mitigation as soon as they are available. Monitoring flags unusual activity, and backups protect you in case of trouble.
Not sure which PHP version your site runs, or whether it is exposed? Get in touch, we will check your PHP version and secure the site before someone else gets there first. See also what our website care covers.
Sources and official advisories
- PHP: official security release announcement
- Huntress: Rapid Response: php2shell (CVE-2026-109618 and CVE-2026-109619)
- watchTowr: CVE-2026-109618 and CVE-2026-109619 analysis