How to Fix PHP2Shell (CVE-2026-109618 & 109619) PHP Sites

A critical flaw in PHP, the language behind WordPress, WooCommerce, Drupal and Joomla, lets attackers take over a web server without logging in. It is called PHP2Shell and covers two bugs, CVE-2026-109618 and CVE-2026-109619. This guide explains it in plain English and walks you through protecting your site, from zero to done.

What is PHP2Shell, in plain English?

Every web page on a PHP site is built by PHP on the server. The researchers found that when PHP runs out of memory in a certain way while handling a request, it can leave its internal state damaged. A skilled attacker can abuse that damage to run their own commands. Because this happens before any login, passwords do not protect you.

The bugs sat in PHP for more than a decade. Researchers at OpenAI, Wiz and Calif used advanced AI to find them and show a working exploit against fresh WordPress, Drupal and Joomla installs. That matters: AI makes old, hard-to-exploit bugs practical to attack.

What has already happened (real-world timeline)

• August 2026Researchers at Wiz, OpenAI and Calif find the flaws with AI tools and report them privately to the PHP team.
• October 17Amazon’s honeypots log the earliest known exploit attempt, four days before disclosure. Amazon described it as largely a one-off probe.
• October 20Details leak online ahead of the planned disclosure. PHP announces an emergency release for the next day, and CERT-EU publishes an advisory.
• October 21, 14:00 UTCPHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35, plus source-only fixes for retired 7.4, 8.0 and 8.1. CISA urges immediate patching, and Cloudflare reports attack attempts within hours.
• October 21, same dayHosts announce firewall protection while they roll out patches. Some government sites in Finland, the Netherlands and France went offline temporarily. A separate Node.js remote-code-execution flaw is announced.
• October 22More hosts finish. Trackers list Cloudways, Kinsta and GoDaddy Web Hosting as patched, while Bluehost and DreamHost were still rolling out.
• October 23Security firms keep publishing scanning and detection guidance, and Qualys updates its exposure numbers.

Latest news: October 23, 2026

Which PHP versions are fixed?

PHP’s security team also published minimal source backports for 7.4, 8.0 and 8.1, and some Linux vendors ship patched packages even for retired branches. One scan counted roughly 884,000 internet-facing servers advertising PHP 8.1 or older, which is why old versions are the biggest worry.

Am I at risk? Pick your hosting type

Contact your hosting provider: what to ask

The fix lives on the server, so your host has to install it. Many hosts first added a firewall rule or switched off risky PHP features. That helps, but PHP says such measures block only some routes, so keep asking until you hear that PHP itself is updated.

Hi, my website (yourdomain.com) runs PHP [your version]. Has the PHP fix for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) been installed on my server? If yes, please tell me the PHP build or package version and when it was installed. If not, when will it be? Please reply in writing. Thank you!

Top hosting providers: PHP2Shell status

Reported by each host and by independent trackers on October 22–23, 2026. These change by the hour, so always confirm on the host’s own page or by ticket. Local or smaller hosts are not listed: use the message above.

Step-by-step: protect your site

Follow the steps in order. Total time is roughly one hour, and most of it is waiting on backups.

php -v
php-fpm8.3 -v

# Debian / Ubuntu
sudo apt update && sudo apt upgrade

# AlmaLinux / RHEL / Rocky
sudo dnf upgrade 'php*'

# Docker Compose
docker compose pull && docker compose up -d --build

sudo systemctl restart php8.3-fpm
# Apache with mod_php:
sudo systemctl restart apache2

php -v
apt changelog php8.3-fpm | grep -i 109618
rpm -q --changelog php | grep -i 109618

wp core update
wp plugin update --all
wp theme update --all

<FilesMatch "\.php$">
  Require all denied
</FilesMatch>

wp core verify-checksums
wp user list --role=administrator
find wp-content/uploads -name "*.php"

Can’t patch today? Temporary protection

PHP is clear that only an update is a complete fix. If you must wait for your host, these stopgaps reduce risk for a short time. Keep them until PHP is updated, restarted and verified.

memory_limit = -1
post_max_size = 8M        ; 32M if you need uploads
upload_max_filesize = 2M  ; keep below post_max_size
session.upload_progress.enabled = 0
; PHP 8.5 only:
fatal_error_backtraces = 0

Let an AI assistant audit your server (copy-paste prompt)

If you use a coding agent such as Claude Code or Codex that can read your repo or reach your server, this prompt tells it to inventory every PHP install, classify each as patched, vulnerable or unknown, and report back. It is built from PHP’s advisory, works read-only and must ask before changing anything.

TASK: Audit my PHP setups for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and help me fix them.

SOURCE OF TRUTH: re-read the official advisory first, it may have been updated:
https://www.php.net/archive/2026.php#2026-10-21-5
Fixed releases: 8.5.12, 8.4.27, 8.3.36, 8.2.35. PHP 8.1 and older get no official release (PHP also published source backports for 7.4, 8.0 and 8.1).

RULES
- Read-only discovery is fine. ASK ME before changing anything, restarting services, or touching production or shared hosting.
- Do not guess. If you cannot confirm a version, mark it UNKNOWN.
- Do not stop at the first finding. Inventory everything, then report.

STEP 1 - INVENTORY every place PHP runs
- Repo files: composer.json / composer.lock (require.php, config.platform.php), Dockerfile*, docker-compose*, .php-version, .tool-versions, .devcontainer, CI files (setup-php, image: lines), Terraform / Ansible / Helm / k8s, PaaS config.
- Base images: every FROM php:*, wordpress:*, bitnami/*, serversideup/*, dunglas/frankenphp* with its tag.
- Machines and containers I can reach: php -v, php-fpm -v, php -i | grep -i "server api", apachectl -M | grep -i php, docker ps and docker exec <container> php -v.
- Note the SAPI of each (FPM, mod_php, CGI, FrankenPHP, LiteSpeed, CLI-only) and any long-running workers (Octane, RoadRunner, Swoole, FrankenPHP worker mode).
- If no PHP exists anywhere, tell me and stop.

STEP 2 - CLASSIFY each instance as PATCHED, VULNERABLE or UNKNOWN
- Upstream builds are vulnerable below 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35.
- 8.1 and older: vulnerable unless a vendor backport is confirmed.
- Distro packages often backport fixes without changing the version, so check the changelog for the CVE IDs:
  apt changelog <pkg> | grep -E "CVE-2026-10961[89]"
  rpm -q --changelog <pkg> | grep -E "CVE-2026-10961[89]"
- rpms.remirepo.net: PHP says it will not have same-day updates. Recommend distro packages or building from source.
- Managed or shared hosting, or PaaS: mark UNKNOWN and tell me to ask the provider.

STEP 3 - FIX (only after I approve the plan)
- Upgrade to a fixed version or vendor-patched package: bump Docker tags and rebuild, update CI pins, run apt / dnf / apk upgrades.
- Restart EVERY PHP worker (FPM pools, Apache, FrankenPHP, LiteSpeed, Octane / RoadRunner / Swoole). Old processes keep running vulnerable code.
- Re-verify each instance (version and changelog) and show me the evidence.

STEP 4 - TEMPORARY MITIGATIONS, only if patching must wait (they reduce exposure but do NOT make anything safe)
- Set them in php.ini / the FPM pool / server config, never ini_set() or .user.ini, then restart all workers.
- CVE-2026-109618: memory_limit=-1 set so apps cannot override it; post_max_size 8M (no uploads) or 32M (uploads) with a lower upload_max_filesize; request-size, field-count, multipart-part and header limits at the web server or proxy; container/cgroup memory limits (do NOT use RLIMIT_AS or RLIMIT_DATA).
- CVE-2026-109619: session.upload_progress.enabled=0; on PHP 8.5 fatal_error_backtraces=0; remove invalid or deprecated per-request settings that emit early diagnostics; fix attacker-reachable fatal errors and timeouts.
- If the site is behind Cloudflare, confirm the WAF Managed Ruleset is in block mode. This is an extra layer, not a fix.

STEP 5 - LOOK FOR SIGNS OF COMPROMISE (read-only; keep evidence, delete nothing)
- Error logs: segfaults, "Allowed memory size exhausted", worker crashes, especially near very large POST or multipart requests.
- New or modified files in web roots (possible webshells), new cron jobs, unexpected processes or outbound connections from PHP users.

FINAL REPORT
Give me a table: location | how PHP is provided | SAPI | version | status | action taken or needed.
Then list: what you changed, what still needs my approval, what needs my hosting provider, any stopgap mitigations and when to remove them, and any compromise indicators.

Update WordPress and old plugins (login and database)

Updating plugins does not fix PHP2Shell, because the bug is in PHP. You still need to do it for two reasons. First, the PHP upgrade is where outdated plugins break, and that is the main reason sites stay on old PHP: one monitoring firm found 22.7% of the WordPress and Joomla sites it watches on PHP 8.1 or older the day before the release. WordPress recommends PHP 8.3 but still lists 7.4 as compatible. Second, plugins that handle login and the database hold the keys to your site, so they decide how bad a break-in gets.

wp plugin list --update=available
wp plugin list --fields=name,status,version,update_version
wp db export before-update.sql

The 6 layers of protection

Patching comes first. Every other layer reduces damage if something slips through.

Running a store? Extra tips for WooCommerce

Warning signs you may have been hacked

6 common beginner mistakes

The A to Z of PHP2Shell protection

Bookmark this glossary. Each letter is one idea you can act on.

Your 12-point checklist

More bugs are coming: how to be ready

OpenAI says PHP2Shell is one of several major issues its models have found and expects findings to rise sharply. Reports also note that powerful open AI models are now freely downloadable, so attackers get the same speed-up. Nobody has published a list of the next bugs, so ignore anyone who claims to know exactly what is coming. What you can do is make patch day routine:

Frequently asked questions

Trusted sources and live trackers

Every claim above comes from these pages. Bookmark the official ones and re-check, because the story is still changing.

This guide is general information, not a security audit. For business-critical or breached sites, involve your host or a security professional.