PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Is Your Website Vulnerable? How to Check and Fix It
By Marcus Reeve — Lead Security Analyst at EzyAudit AI · Updated 25 October 2026
On Tuesday 21 October the PHP project shipped an emergency release for two bugs it rated critical: CVE-2026-109618 and CVE-2026-109619, together nicknamed PHP2Shell. I have been doing this a long time and I do not reach for the word “unprecedented” lightly, but a flaw that lets a stranger run code on your server with a single unauthenticated request, that affects every PHP version back to 5.4, and that was already being tried against honeypots four days before the fix came out, is about as bad as it gets for anyone who runs a website.
If your site runs WordPress, WooCommerce, Magento, Laravel, Drupal, Joomla, or anything else written in PHP (which is about three-quarters of the web), this applies to you. The good news: checking takes a minute and the fix is usually one click in your hosting panel. This post explains what the vulnerability is in plain English, how to find out whether your site is exposed, and exactly what to do about it.
What is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?
PHP2Shell is the name given to two separate memory-handling bugs inside the PHP engine itself, not in any plugin, theme or framework. That distinction matters: you cannot fix it by updating WordPress, and no amount of careful coding in your own application avoids it, because the flaw is triggered before your code even runs.
- CVE-2026-109618 — when PHP runs out of memory while it is still setting up a request, the clean-up code can be tricked into treating half-initialised data as real. An attacker who controls that moment controls what PHP executes.
- CVE-2026-109619 — internal state belonging to one request can survive after its memory has been freed. The next request handled by the same worker can pick up that stale state and run with it.
Both are remote code execution (RCE) bugs: the attacker does not need an account, a password, or a vulnerable plugin. One crafted web request to any PHP page can be enough. Every way of running PHP on a web server is affected (PHP-FPM, Apache mod_php, php-cgi, LiteSpeed, FrankenPHP), with mod_php considered the most exposed. Amazon’s honeypot network recorded an exploitation attempt on 17 October, so you should assume attackers have working exploits and are scanning for targets now.
Which PHP versions are affected, and which are fixed?
Everything from PHP 5.4 onwards is vulnerable until patched. The fixed releases are:
| Your PHP branch | Fixed in | Status |
|---|---|---|
| PHP 8.5 | 8.5.12 | Supported — update |
| PHP 8.4 | 8.4.27 | Supported — update |
| PHP 8.3 | 8.3.36 | Supported — update |
| PHP 8.2 | 8.2.35 | Supported — update |
| PHP 8.1 and older | No official release | End-of-life — see below |
If you are on PHP 8.1, 8.0 or 7.x, the PHP project no longer supports your branch and will not ship a fixed release for it. It has published minimal source patches for 7.4, 8.0 and 8.1 as a courtesy, and some hosts and Linux vendors have backported them, but the only reliable fix is to move to a supported branch. (You should do that anyway: an end-of-life PHP is a standing invitation, not just for this bug but for every one found after it.)
Why you cannot just look at the version number
Here is the part that trips people up, and it is why I wanted to write this post rather than just link to the advisory. Most hosts and Linux distributions apply security fixes by backporting them into the build they already ship, without changing the version number. On our own servers, for example, PHP still reports 8.3.35, one release behind the fix, yet the build date is 21 October and the patch is in. A scanner that simply compares version numbers would flag that server as vulnerable when it is not, and a server that reports 8.3.36 but was built from an unpatched source tree would be called safe when it is not.
Three things actually tell you whether you are protected: the version number, the build date of the PHP binary, and whether the server has been restarted since the update (an updated package does nothing until running PHP workers are replaced). You need all three, and only one of them is visible from outside your server.
How to check whether your website is vulnerable (in about a minute)
We added PHP2Shell detection to EzyAudit AI within days of the advisory, and we built it to be honest about the problem above rather than guess. There are two levels.
Step 1: Run a free scan
Go to ezyaudit.ai, add your website, verify that you own it (a DNS record, a small file, or an email link) and press scan. Alongside the 95+ other checks, the scanner now reads the PHP version your server announces and compares it with PHP’s own published security advisories, which we refresh every day. If your server exposes an old version you will see a finding naming CVE-2026-109618 and CVE-2026-109619 and the release that fixes them. If your server is on an end-of-life branch, that is flagged as a high-severity issue in its own right.
Be aware of the limits: most well-configured servers hide their PHP version entirely (ours do), and as explained above the number alone cannot prove a patch is or is not present. So the free scan will either say “this version predates the fix, confirm with your host” or, if the version is hidden, nothing at all. For a definitive answer you need step 2.
Step 2: Install the server check for a definitive answer
From your EzyAudit dashboard, open the Domains tab and click Server check next to your verified site. You get a small, read-only PHP file (about fifteen lines, and you can read every one of them) to drop into your website’s root folder. During each scan EzyAudit asks that file for the real PHP version, the build date and a handful of security settings, straight from inside the server. The file answers only requests carrying your site’s private key; anyone else gets a 404.
With it in place, your report says one of four things, and means it:
- PHP up to date — you are running a release that includes every published fix. Nothing to do.
- PHP patched by vendor build — the version number is old, but the build is dated on or after the advisory, which is how most hosts deliver fixes. Almost certainly safe; your host can confirm.
- PHP missing security fixes — version and build date both predate the fix. This is a critical finding, it lowers your score, and it triggers an alert. Act today.
- PHP no longer receives security fixes — you are on 8.1 or older. The only remedy is a supported branch.
The full step-by-step is in our server check guide. If you use the EzyAudit mobile app, the Websites screen can email you the file instead.
Find out if PHP2Shell affects your site
Free scan, no install, results in about a minute — then follow the fix steps below if anything is flagged.
How to fix CVE-2026-109618 and CVE-2026-109619
1. Update PHP (the real fix)
On shared or managed hosting (Hostinger, SiteGround, Bluehost, Kinsta, WP Engine and the like): most hosts have already patched their fleet. Open your hosting panel, find the PHP settings for your site, and either select the newest version of your branch or check the PHP info page for a build date of 21 October 2026 or later. If you cannot find it, ask support one question: “Does my PHP build include the fix for CVE-2026-109618?” A good host will answer with a build date, not a version number.
On a VPS or your own server: update the PHP packages from your distribution (apt upgrade, dnf update) or, if you build from source, move to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Then restart PHP (systemctl restart php8.3-fpm, or Apache if you use mod_php). This last step is the one people forget, and until you do it the old, vulnerable workers are still serving your traffic.
On PHP 8.1 or older: change the PHP version for your site to 8.3 or 8.4 in your hosting panel. Test your site afterwards; most modern WordPress and e-commerce setups run on 8.3 without changes, and anything that breaks is a plugin or theme that was already overdue for replacement.
2. If you cannot update today, reduce the attack surface
These are stop-gaps, not fixes, but they close the known exploit paths while you arrange the update:
- Set
session.upload_progress.enabled = 0inphp.inior.user.iniand restart PHP. The public exploit for CVE-2026-109619 relies on this feature, and almost no site needs it. - If you have a web application firewall (Cloudflare, including the free plan, pushed rules for the known exploit vectors on day one), make sure it is enabled in front of your site.
- If a system genuinely cannot be patched, follow the UK NCSC’s advice and consider taking it offline until it can.
3. Re-scan to confirm
Run your EzyAudit scan again. With the server check installed, the PHP finding should now read up to date or patched by vendor build. If it still says fixes are missing, the update did not take: the usual culprits are a second PHP version running alongside the one you updated, or workers that were never restarted.
What if you were already hit?
Because exploitation started before disclosure, patching closes the door but does not evict anyone already inside. Look for files you did not create in your web root and uploads folders (especially .php files with random names), admin accounts you do not recognise, unexpected scheduled tasks, and outbound traffic from the server. If you find any of these, treat the server as compromised: restore from a backup taken before 17 October, patch, then rotate every password and API key the site held. EzyAudit’s security audit guide covers the full checklist.
Stay ahead of the next one
PHP2Shell will not be the last critical PHP flaw, and the lesson of this week is that the gap between disclosure and mass exploitation is now measured in hours, not weeks. The sites that come through these events unharmed are the ones that find out automatically. EzyAudit’s monitoring plans re-scan your sites on a schedule, keep the PHP advisory feed current every day, and alert you the moment a new fix is published that your server lacks, so you hear about the next PHP2Shell from us before you hear about it from your customers. Single-site plans start at $19 a month, and a one-off full report is $9 if you just want to see everything on your site today.
Get alerted before the next PHP2Shell
Continuous monitoring, daily-updated PHP and WordPress vulnerability feeds, and a plain-English fix for every finding. Plans from $19/month.
Frequently asked questions
Is my WordPress site affected by PHP2Shell?
Yes, if it runs on PHP, which all WordPress sites do. PHP2Shell is a flaw in the PHP engine itself, not in WordPress, so updating WordPress, plugins or themes does not fix it. You need a patched PHP build: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a host build dated 21 October 2026 or later.
How do I know if my host has patched PHP2Shell?
Check the PHP info page in your hosting panel for a build date of 21 October 2026 or later, or ask support whether your build includes the fix for CVE-2026-109618. The version number alone is not reliable, because many hosts backport fixes without changing it. The EzyAudit server check reads the real build date from inside your server and gives a definitive answer in your scan report.
What is the fix for CVE-2026-109618 and CVE-2026-109619?
Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your vendor’s equivalent patched build) and restart PHP. If you are on PHP 8.1 or older, move to a supported branch. As a temporary mitigation, set session.upload_progress.enabled = 0 and put a web application firewall in front of the site.
Can a website security scanner detect PHP2Shell remotely?
Only partly. A remote scan can read the PHP version if the server announces it and compare it with the fixed releases, but most servers hide the version and a number alone cannot prove a backported patch is present. EzyAudit flags exposed old versions cautiously and, with its optional read-only server check file installed, reports the real version and build date for a certain answer.
Is PHP2Shell being exploited in the wild?
Yes. Amazon’s threat intelligence team recorded an exploitation attempt against its honeypots on 17 October 2026, four days before the public fix, and security researchers expect widespread attacks against unpatched servers. Treat it as actively exploited and patch immediately.
Not sure where your site stands? Run your free scan now, then read how to fix vulnerable WordPress plugins and add the security headers that make the next exploit harder to pull off.