PHP2Shell is the name commonly used for two critical vulnerabilities in the PHP runtime: CVE-2026-109618 and CVE-2026-109619. Under certain request paths and configurations, they can create a risk of remote code execution (RCE). If exploitation succeeds, an attacker may be able to run code with the permissions of the PHP process on the server.
PHP2Shell is not a function or package that can simply be removed from an application. The flaws are in PHP itself, so updating WordPress, Laravel, or another framework does not patch a vulnerable PHP runtime.
What could happen to a website?
The practical risk depends on the PHP version, how PHP handles web requests, server configuration, and which request paths can be reached. Do not assume a server is safe because no symptoms are visible or because it runs a popular CMS. At the same time, a vulnerable version alone does not prove that a server has been compromised. Check both the installed runtime and the available logs.
If an attacker achieves code execution, they may be able to read data available to the web service account, modify application files, establish persistence, or move to other systems when access controls and network segmentation are weak. These are possible post-compromise outcomes, not automatic effects on every PHP installation.
Who should check?
Administrators should inventory every PHP runtime: web servers, PHP-FPM pools, containers, hosting control panels, queue workers, staging environments, and infrequently used machines. The PHP CLI version may differ from the version serving web requests. Use php -v for the CLI, then verify PHP-FPM or the web module through the hosting panel or service configuration.
For Linux distributions and managed hosting, the vendor advisory is authoritative because a vendor may backport a fix without changing the upstream version string. Match the package release and security bulletin rather than relying only on a version banner.
Recommended first steps
- Record all PHP versions and where each runtime is used.
- Install the appropriate fixed release from PHP or your operating system or hosting vendor.
- Restart PHP-FPM, Apache, containers, and workers that may still have the old runtime loaded.
- Review access logs and host activity for the exposure period.
- If you find signs of compromise, follow your incident response process, rotate potentially exposed credentials, and restore from a trusted source.
A web application firewall can reduce some request patterns, but it is not a substitute for a runtime update. Continue with the guide to checking your PHP version and securing a server against PHP2Shell.
Why do the PHP core flaws matter?
PHP sits beneath many web applications. Frameworks and business logic run on top of the same runtime, so an application update does not change how PHP itself processes HTTP requests. If several sites share a PHP-FPM installation, check the server and pools rather than looking at only one project.
The PHP advisory describes two different paths. CVE-2026-109618 involves out-of-memory (OOM) handling while internal request data is only partially initialized. Request cleanup may then treat invalid data as valid. CVE-2026-109619 involves request-owned internal state that can remain after its memory is freed and may be used by a later request handled by the same worker. This explains the technical class of each issue; it does not mean every configuration can be exploited in the same way.
Can every PHP site be exploited?
There is no single answer for every server. The web server, PHP handler, worker configuration, request limits, and application behavior influence which paths are reachable. The PHP team says administrators should check PHP installations serving web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed; it identifies mod_php as the highest-risk configuration. A framework choice or the absence of one application feature is not enough to conclude that a runtime is safe.
It is also useful to distinguish “vulnerable,” “exposed,” and “compromised.” A vulnerable runtime has not been shown to include the fix. An exposed runtime can be reached through a relevant path. A compromised runtime has evidence of successful malicious activity. Each requires a different check: package inventory for patch status, configuration and architecture for exposure, and host or log evidence for compromise.
Fixed versions and older branches
The upstream PHP releases fixing the two CVEs are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Linux distributions, hosting providers, and container vendors may backport the fix. Check the exact package and vendor advisory instead of relying only on the displayed version. PHP 8.1 and older no longer receive regular updates from the PHP project; if your vendor does not provide a backport, plan an upgrade to a supported branch.
Frequently asked questions
Is updating Laravel or WordPress enough?
No. Update the application as part of normal security maintenance, but update the PHP runtime separately.
Can a WAF replace the patch?
No. A WAF may block some patterns, but it does not fix the runtime bug or guarantee that every path is covered.
What if my PHP version looks current?
Verify the runtime serving web requests, not only the CLI. Then match the installed package to the vendor advisory and restart processes that may still have an older runtime loaded.
Do I need to take the website offline?
The usual first step is to install the fixed package and reload the affected services. If you find signs of compromise, follow incident response procedures and decide whether isolation or a rebuild is needed based on the evidence.
For the technical checklist, read how to check PHP versions and secure a server. If a server was exposed, continue with PHP2Shell detection and incident response.
