PHP2Shell October 2026 Security Advisory and Fixes

Updated 21 October 2026. Emergency patches are available.

PHP has released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution. If you operate PHP websites, identify their actual runtime, install a fixed release or a vendor-confirmed backport, and verify the running services after deployment. PHP security announcement

What happened

Details of both vulnerabilities leaked online on 20 October 2026, ahead of coordinated disclosure and before patches were available. Cloudflare reports that it observed attack traffic before the official release. Servers may have been targeted before they could be patched, so a compromise check is an essential part of the response. Cloudflare report

Both vulnerabilities are rated CVSS v4.0 9.2. The advisories rate attack complexity as high, but the leak and early attacks mean this should not be treated as low-risk. The UK's National Cyber Security Centre has published guidance urging organisations to update systems using PHP. NCSC guidance

Is every PHP version affected

Treat unpatched PHP installations serving web requests as requiring urgent attention, including PHP-FPM, Apache mod_php, CGI, FrankenPHP and LiteSpeed. Running Linux or using Nginx does not exempt a server. The first fixed upstream releases published on 21 October 2026 are:

PHP 8.2 — 8.2.35
PHP 8.3 — 8.3.36
PHP 8.4 — 8.4.27
PHP 8.5 — 8.5.12

PHP 8.1 and older need a supported upgrade or a vendor or distribution backport. PHP 8.2 security support ends on 31 December 2026, so plan its replacement even after applying this fix. Distribution package revisions may include backports without matching the upstream version numbers. Check both CVEs against your package publisher's advisory.

What are the vulnerabilities

CVE-2026-109618 concerns memory corruption during out-of-memory handling. CVE-2026-109619 concerns stale internal state surviving between requests handled by a worker. These are PHP runtime defects, so updating application dependencies alone is insufficient. Read the maintainers' OOM advisory and stale-state advisory for technical scope and limitations.

Which setups are most exposed

Apache mod_php is the highest-risk case: the OOM RCE was demonstrated over HTTP with default limits before application code runs. PHP-FPM is still affected; the session-lifecycle RCE path was validated against both mod_php and FPM. FrankenPHP, which can be used by Laravel Octane, is likely susceptible to application-independent attacks like mod_php. It embeds PHP, so update or rebuild the FrankenPHP binary or image; updating system PHP packages does not fix that embedded runtime.

Find the PHP that actually serves your website

Start with an inventory of public websites, internal services, workers, containers and vendor appliances. Record the owner, host, operating system, PHP package source and runtime for each application.

On a Linux server, these inspection commands provide a starting point:

php -v 
php --ini 
command -v php 
systemctl list-units --type=service --all 'php*-fpm.service'

The first three inspect the default command-line PHP. They do not prove which PHP serves a website. Check the site's configured FPM socket or upstream, Apache module, container image, or hosting runtime setting. Inspect every active branch. Where necessary, use an authenticated internal diagnostic that returns only the runtime version; remove it afterward. Avoid publishing a full phpinfo() page.

Follow the guide for your platform

Keep the response focused on the environment you actually run. Each guide starts with brief context and then walks through the platform-specific update and verification process.

What if you cannot update PHP immediately

Updating is the only complete fix. The controls below reduce specific attack paths while you arrange deployment. If you cannot establish adequate protection, restrict access or serve a static maintenance response before requests reach PHP. A maintenance page implemented inside PHP still runs the vulnerable engine.

Temporary mitigations for CVE 2026 109618

Set memory_limit = -1 administratively, for example through an FPM pool php_admin_value, and check that no application or directory restores a finite limit. Removing PHP's memory limit increases resource-exhaustion risk and does not eliminate underlying allocation failure. Use container or cgroup memory controls with an appropriate worker termination policy. Do not use RLIMIT_AS or RLIMIT_DATA as memory caps; these can make mmap fail and trigger the vulnerable path.

Keep post_max_size conservative and upload_max_filesize below it. Enforce decoded request-size limits at the frontend, including requests without a usable Content-Length. Reduce max_input_nesting_level and bound input variables, multipart parts, headers per part and uploads according to application needs. If the application does not use multipart forms, block multipart requests at the frontend. Test these limits against legitimate requests.

Temporary mitigations for CVE 2026 109619

On PHP 8.5 only, set fatal_error_backtraces = 0. This removes the producer involved in the confirmed fatal-backtrace RCE case; it is not an OOM mitigation.

Set session.upload_progress.enabled = 0. This blocks one of the two confirmed exploitation paths for CVE-2026-109619. Apply it before request parsing in php.ini or server or pool configuration, not through application ini_set calls. Keep upload progress disabled after patching if the application does not need it.

For PHP-FPM, consider pm.max_requests = 1 if capacity and performance allow it; this reduces worker reuse but is not a complete mitigation. Restart every worker after configuration changes. Also remove invalid per-request settings that emit early diagnostics and address reachable fatal errors and timeouts. Hiding error messages does not remove the underlying bug.

Consult the OOM advisory and stale-state advisory before applying temporary controls.

Check for compromise before closing the incident

Preserve access, error, application and security logs, then review activity from 20 October 2026 onward. Look for unexpected PHP files, new administrator accounts, changed scheduled tasks, unusual outbound connections and web workers launching shell commands. Correlate findings with deployments and legitimate administrative work.

For a Linux webroot, this is a starting point, not a malware scanner:

sudo find /var/www -type f -newermt "2026-10-20" -ls

The date is pinned to the leak date rather than a moving two-day window. Replace /var/www with the actual application paths and account for the server timezone. Attackers can alter timestamps, so a clean result does not prove the server is clean. Compare with trusted deployment artifacts and review logs as well.

If you find suspicious activity, isolate the affected workload, preserve evidence and involve your incident responder. Restore or rebuild from trusted material and rotate exposed secrets from a clean environment. Patching alone does not remove a backdoor.

Verify the running application

Record the installed package revision or image digest and the advisory that confirms it is fixed. Check the web runtime through an authenticated internal diagnostic or the hosting control panel; do not expose a public phpinfo page. The default command-line PHP may be different.

Confirm that old workers have stopped. Test login, sessions, uploads, important transactions and background jobs. Check error rates and service health. Update the images and deployment templates used for new instances so the next deployment cannot restore vulnerable PHP. Keep a tested recovery plan, but do not return a vulnerable runtime to public service as a rollback.

Get your PHP update completed

Send this guide to the person responsible for your server and ask for confirmation of the fixed runtime, completed worker restart and compromise review. If you need help, contact your hosting provider or development team with the package version, hosting platform and affected sites so they can act quickly.

Sources and further reading

START YOUR PROJECT

OUR SERVICES