Patch PHP now: the “php2shell” flaws are under active attack

What happened

On 21 October 2026 the PHP project shipped emergency security releases for two bugs in the PHP engine. Both let an attacker who isn’t logged in run their own code on a web server. The security community has nicknamed them php2shell.

The PHP Foundation rates both at CVSS 9.2 (a score of 10.0 that leaked early was wrong). CISA published an alert the same day, and on 26 October added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog, which only lists bugs with evidence of real-world attacks. The NSA, the UK’s NCSC, Australia’s ACSC, New Zealand’s NCSC, the Netherlands’ NCSC and the Canadian Centre for Cyber Security have all issued their own warnings.

Because the bugs are in PHP itself, keeping WordPress, Laravel, Drupal or your own code up to date doesn’t protect you. The PHP runtime underneath has to be patched.

The two bugs in plain English

• CVE-2026-109618 (memory corruption after running out of memory). If a request hits PHP’s memory_limit at exactly the wrong moment, PHP can leave some internal data half set up and later treat it as valid. On Apache with mod_php, a request from anyone can trigger this before your application code even runs, and the researcher who reported it showed full code execution with default settings. Code execution was also confirmed on PHP-FPM through application code paths.
• CVE-2026-109619 (leftover state from a previous request). A fatal error at the wrong point can leave PHP pointing at memory from an earlier request. The next request handled by the same worker then uses memory that has already been freed. Code execution was demonstrated against a real-world application on Apache with mod_php.

Who is affected

According to CISA, every PHP installation that serves web requests:

• Apache with mod_php (the PHP project rates this setup as the highest risk)
• PHP-FPM behind Nginx, Apache or Caddy
• php-cgi
• FrankenPHP
• LiteSpeed

Don’t forget PHP that comes bundled inside other products, such as control panels, appliances, all-in-one stacks and container images. CISA specifically asks organisations to inventory “PHP embedded as a component of other software”.

How to check your PHP version

The PHP on your command line and the PHP serving your website can be different builds, so check both:

php -v
php-fpm8.4 -v      # the name varies: php-fpm, php-fpm8.3, php84-fpm …

If you’re not sure which PHP serves your site, put a phpinfo() page in a private location, open it once, read the version, then delete it. On shared hosting, check your control panel or ask your host which version and patch level you’re on.

How to update

The exact commands depend on how you installed PHP. Typical examples:

# Debian / Ubuntu (distribution or Sury packages)
sudo apt update && sudo apt upgrade
sudo systemctl restart php8.4-fpm   # and/or apache2

# Alpine
apk upgrade -U -a

# Docker: pull the patched base image, rebuild and redeploy
docker pull php:8.4-fpm
docker compose build --pull && docker compose up -d

Restarting matters. PHP-FPM workers and Apache keep the old code in memory until they restart.

Signs you may already have been hit

CISA suggests watching for PHP worker processes that start shells or download tools, such as php-fpm spawning sh, bash, curl or wget. Also look for:

• New or recently changed .php files, especially in upload, cache or temporary folders
• New cron jobs, users or SSH keys you didn’t add
• Outbound connections from your web server to addresses you don’t recognise

CISA has published SIGMA detection rules, and the Dutch NCSC keeps a php2shell repository with detection guidance (links below). If you find a web shell, patching alone isn’t enough. Treat the server as compromised, rebuild it from a known-good image and rotate every secret it held. Our guide to rotating leaked API keys walks through that part.

If you can’t patch today

CISA says a web application firewall may give some protection while you work on the update, but it’s a stopgap, not a fix. If a system can’t be updated, or runs an unsupported PHP version (8.1 or older), the advice is to take it offline until it’s patched.

Sources

• CISA: Critical Vulnerabilities in PHP Require Immediate Patching (opens in a new tab)
• The PHP Foundation: Today’s PHP security release (opens in a new tab)
• PHP news archive, 21 October 2026 (opens in a new tab)
• NCSC-NL php2shell repository (opens in a new tab)
• CISA Known Exploited Vulnerabilities catalog (opens in a new tab)