PHP2Shell: What the 2026 PHP Vulnerabilities Mean for Website Owners
Two critical vulnerabilities in PHP's core runtime, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed in October 2026. Together, they are commonly referred to as PHP2Shell. The PHP security advisories describe remote code execution risks arising from memory-safety problems in request handling and persistent worker state; both CVEs carry a CVSS 4.0 score of 9.2 (Critical).
For website owners, the key point is simple: these issues affect the PHP runtime beneath a site. Updating WordPress, a framework, or a plugin alone does not update the PHP binary serving requests.
What the vulnerabilities mean
CVE-2026-109618 concerns PHP request cleanup after an out-of-memory condition leaves internal request state invalid. CVE-2026-109619 concerns stale references to request memory that can persist in worker-level state and be used before a later request is fully initialized. The details differ, but both advisories identify potential remote code execution.
The affected component is the language runtime, not a particular content management system. A site can therefore use fully updated application code and still need a PHP runtime update. The CVE records list affected releases on the maintained PHP 8.2 through 8.5 branches; installations on older or vendor-maintained builds should be checked against their operating-system or hosting provider's own security notice.
Why AI-assisted discovery matters
Security researchers at Wiz and Calif reported the flaws, with OpenAI credited as a finder in the CVE records. Their disclosures describe how AI-assisted analysis helped researchers investigate complex memory-safety behavior in a widely used open-source runtime. The PHP team coordinated the fixes and published security releases.
This is a useful reminder for organizations that depend on foundational software: complex code can contain issues for years, and security responsibility is shared by maintainers, hosting providers, and the organizations running the software.
Upstream fixed releases
The PHP advisories list these fixed releases for the maintained branches:
- PHP 8.2: 8.2.35
- PHP 8.3: 8.3.36
- PHP 8.4: 8.4.27
- PHP 8.5: 8.5.12
These are the upstream fixed versions named in the advisories, not a substitute for checking your package vendor. Linux distributions and managed hosting providers may backport fixes while retaining their own package version numbering. Prefer the latest supported security update supplied for your platform.
A practical response checklist
- Identify the runtime that actually serves the site. Check the PHP handler configured for each application—such as PHP-FPM, Apache, a container image, or a managed hosting PHP selector. A command-line PHP version may not match the web-serving runtime.
- Apply the vendor's fixed package or image. Upgrade to a release containing the fixes. If you use an operating-system package, control panel, or hosting provider, confirm its security notice explicitly addresses both CVEs.
- Restart or replace workers. Updating files on disk does not replace already-running PHP processes. Follow your platform's procedure to restart PHP workers and, where required, the web server; rebuild and redeploy containers using updated base images.
- Verify after deployment. Confirm the active handler is using the patched build and that all pools, sites, and production instances were updated. Check that the fixed version is not overridden by an older container tag or alternate PHP selector.
- Plan upgrades for unsupported PHP versions. If your release is end-of-life, ask your distribution or hosting vendor whether it provides a backport and make a supported-version migration plan. Do not assume that an old version is protected because its version number differs from the listed branches.
If an immediate upgrade is not possible, consult the official PHP advisories for mitigations that apply to your exact server API, configuration, and application. The advisories warn that configuration workarounds are incomplete and do not replace installing a fixed runtime. Avoid copying generic settings from unverified posts: an incorrect memory or request configuration can create availability risks without resolving the underlying flaw.
After patching
Review server and application logs for unusual activity during the exposure window. If you have evidence of a compromise, treat the server as potentially breached: follow your incident-response process, investigate the host, and rotate credentials and secrets that may have been accessible to the PHP worker. A software update prevents future use of the known flaw; it does not reverse an intrusion that may already have occurred.