To reduce the risk from PHP2Shell, first inventory the PHP runtimes actually serving applications, then install fixed packages from an official source. PHP2Shell refers to CVE-2026-109618 and CVE-2026-109619. The upstream fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 8.1 and older no longer receive updates from the PHP project, although some vendors may provide backports.
1. Find every PHP installation
On a server, php -v shows the CLI version found in the current PATH. It may not match the version used by a website. Check installed packages and active PHP-FPM services, then map each virtual host to its FPM socket or web module. On shared hosting, review the PHP selector for every domain and ask the provider for confirmation. Also include container images, staging servers, queue workers, and scheduled jobs.
Record the version, package source, service or domain, and system owner. Do not publish a phpinfo() page to the internet: it exposes sensitive configuration details. If one was created for troubleshooting, remove it as soon as the check is complete.
2. Match the installed package to the vendor advisory
Use the PHP security advisory and the advisory from your Linux distribution, container provider, or hosting panel. A vendor may backport the fix without changing the upstream version number. Verify the package release and make sure security repositories are enabled. Do not assume an old installation is safe because a vendor changed its package revision, and do not install binaries from unofficial sources.
3. Update and reload services
Follow the vendor procedure to update the PHP package used by the site. Restart or reload PHP-FPM and the relevant web service, then restart long-running queue workers and recreate containers so they do not keep using old binaries. Check the runtime again using the same path that serves web traffic. For managed hosting, ask the provider to confirm the patch and worker restart for each domain.
4. Add defense in depth
- Restrict administration panels and sensitive endpoints to a VPN or trusted IP range.
- Run PHP under a low-privilege service account and isolate applications from one another.
- Restrict outbound access where practical and keep secrets outside public directories.
- Keep the framework, CMS, plugins, and operating system updated.
- Use a WAF as an additional layer and monitor rule changes and false positives.
These measures can limit the impact of other weaknesses, but they do not replace a PHP core update. For background on the issue, read what PHP2Shell is and how it can affect a server.
Practical checks for common setups
PHP CLI
Run php -v to see the CLI runtime and command -v php to locate its binary. This is useful for cron jobs and scripts, but it does not prove that the website uses that same binary.
PHP-FPM and web servers
Check which PHP-FPM services are active and map each site to its configured socket. A server may have multiple PHP versions installed simultaneously. For containers, inspect the image tag that is actually deployed, not only the Dockerfile in the repository.
Avoid creating a public phpinfo() endpoint to check the web runtime. Use an authenticated internal panel or a temporary diagnostic endpoint limited to administrators, then remove it immediately after the check.
A safer update procedure
- Inventory and schedule. Record domains, runtime versions, pools, package vendors, and applications. Note extension requirements and application compatibility.
- Prepare recovery. Confirm that configuration and data backups are available and that you know how to roll back if the update causes an operational problem.
- Use a trusted source. Update through the distribution security repository, hosting vendor, or an official fixed container image.
- Restart every worker. Reload PHP-FPM and the web server, recreate containers, and restart queue workers, schedulers, and long-running processes.
- Verify the web runtime. Check the installed package, binary, pool used by each site, and worker status. Confirm no process is still using the old runtime.
- Test the application. Check key pages, sign-in, uploads, APIs, background jobs, and error logs. Record the change time and verification results.
Temporary mitigations and their limits
The PHP advisory says an update is the only complete fix. If an update is temporarily impossible, specific settings can reduce some attack paths. For CVE-2026-109619, PHP recommends disabling session.upload_progress.enabled in php.ini, an FPM pool, or server configuration that applies before request parsing, then restarting every worker. Do not rely on ini_set() or FPM .user.ini for this setting. On PHP 8.5, the advisory also names fatal_error_backtraces=0 as a way to block only the confirmed fatal-backtrace path.
For CVE-2026-109618, PHP lists measures such as setting memory_limit=-1 in a way applications cannot override, using a low post_max_size based on upload needs, and enforcing request limits at the web server or proxy. These settings can affect resource use and upload features, so follow the PHP advisory and test the impact rather than copying values blindly. The advisory warns against substituting RLIMIT_AS or RLIMIT_DATA for container or cgroup limits in this context.
Checklist for shared hosting
If you do not have root access, check the PHP version for every domain in the control panel. Open a support ticket referencing CVE-2026-109618 and CVE-2026-109619. Ask which fixed package or backport is installed and when PHP-FPM workers were restarted. Keep the provider's response. If the provider cannot confirm patch status, temporarily reduce exposure of administrative features and consider moving to a host with clear security update practices.
A patch closes the vulnerability but cannot prove that no exploitation occurred before it was applied. Continue with the guide to checking for signs of compromise.
