PHP2Shell Vulnerability: Affected Versions and Fixes

The PHP security update for CVE-2026-109618 and CVE-2026-109619, widely discussed as PHP2Shell, is available. PHP published the fixes on October 21, 2026. Prioritize PHP installations serving web requests and install the fixed release for your branch or your vendor’s confirmed security update. PHP’s security announcement.

Which PHP versions fix PHP2Shell?

These are the upstream versions containing both fixes:

Both PHP maintainer advisories list these fixed versions: CVE-2026-109618 and CVE-2026-109619.

Distribution packages need a separate check. Ubuntu and other vendors may backport the fixes while keeping an older upstream version number. For example, Ubuntu lists these fixed packages:

These examples apply to the matching Ubuntu packages and repositories. Check Ubuntu USN-8948-1 for your release and package. An older-looking php -v result alone cannot establish whether a distribution build is vulnerable.

What are CVE-2026-109618 and CVE-2026-109619?

Both are PHP runtime memory-safety vulnerabilities rated Critical, CVSS v4.0 9.2 by the PHP maintainers:

• CVE-2026-109618: out-of-memory corruption. An allocation failure can interrupt initialization and leave request data in a state that cleanup code handles incorrectly. The OOM advisory describes potential unauthenticated remote code execution.
• CVE-2026-109619: stale global state. Data surviving request cleanup can refer to freed memory when a worker handles a later request. The stale-state advisory documents use-after-free and remote code execution paths.

The PHP security announcement covers PHP-FPM, Apache mod_php, CGI, FrankenPHP, and LiteSpeed. Actual exploitability depends on the runtime and deployment; the PHP Foundation’s explanation discusses the risk to mod_php and FPM deployments.

How to patch the PHP vulnerability

1. Identify the PHP installation serving your site

Record each website, FPM pool, container, and server instance, including its PHP branch, package source, and owner. These commands inspect the CLI environment:

command -v php
php -v
php --ini
php -r 'echo PHP_VERSION, " ", PHP_SAPI, PHP_EOL;'

Verify the web runtime through your existing authenticated administration or internal diagnostics as well. A terminal can use a different PHP installation from the website. PHP exposes the executing interpreter through PHP_VERSION and PHP_SAPI. Keep diagnostic output internal; a public phpinfo() page exposes substantially more configuration than this check needs.

A small diagnostic check we reproduced

On October 22, 2026, we ran this read-only probe on macOS with Homebrew PHP 8.4.8 CLI:

php -r 'echo json_encode(["php" => PHP_VERSION, "sapi" => PHP_SAPI, "ini_loaded" => php_ini_loaded_file() !== false], JSON_PRETTY_PRINT), PHP_EOL;'

We repeated it with php -n -r instead of php -r. PHP documents -n as ignoring php.ini. These were the observed results:

The version stayed the same while configuration loading changed. Record both the executing runtime and its configuration when investigating a deployment. These CLI results do not identify the runtime or configuration handling an HTTP request; verify those through your existing internal web diagnostics.

Scope: this reproduces diagnostic behavior, not a security fix. The tested 8.4.8 build is below the upstream fixed version and is not presented as patched. We did not reproduce either vulnerability or test PHP-FPM, Docker rollouts, or distribution backports in this check.

2. Install the update from the correct source

For distribution-managed PHP, compare the complete installed package revision with the vendor’s fixed revision for your operating system and repository. Ubuntu tracks CVE-2026-109618 and CVE-2026-109619 separately; confirm both. Third-party PHP repositories need their own vendor confirmation.

For an existing Ubuntu 24.04 installation using official PHP 8.3 FPM packages, a targeted update sequence is:

sudo apt update
sudo apt install --only-upgrade php8.3-fpm php8.3-cli php8.3-common
sudo systemctl restart php8.3-fpm

Review the proposed package changes before confirming. Include your installed PHP extensions in the update plan, adapt package and service names to your deployment, and arrange for the worker restart to interrupt active requests safely. For mod_php, follow the package vendor’s Apache restart instructions instead.

Record the installed package revisions afterward:

dpkg-query -W 'php8.3*'

3. Replace affected containers and workers

For containers, select an image whose PHP build includes both fixes. Rebuild custom application images against the corrected base and roll out the resulting artifact to every instance. A successful image pull leaves existing containers running their previous image until you replace them.

For a Compose service actually named php that uses a vendor-published, fixed image, update its image reference if necessary, then use:

docker compose pull php
docker compose up -d --no-deps --force-recreate php
docker compose exec php php -v

Adapt the service name and deployment procedure to your application. The final command checks CLI PHP inside that container; confirm the HTTP-serving process separately. Docker documents the distinction between pulling an image and recreating a service.

4. Verify the deployed fix

Keep an acceptance record for each instance:

A package installed on disk and a patched worker serving requests are separate acceptance checks. Patching also does not resolve an intrusion that may already have happened.

What should WordPress, Laravel, and managed-hosting users do?

Ask the hosting provider which PHP package revision or runtime image now serves your specific site, whether it includes both CVEs, and whether the old workers have been replaced. Keep that confirmation with your maintenance record. A dashboard showing only a broad choice such as “PHP 8.3” provides too little detail to verify this update.

WordPress core, plugins, Laravel, and Composer dependencies run on the PHP interpreter. Their updates do not by themselves replace that interpreter. Arrange the runtime update with whoever controls the server or container.

Patch the supported branch you currently run where possible. You can address an 8.4 installation with the 8.4 security release and plan a subsequent PHP 8.5 migration separately.

What if PHP cannot be updated immediately?

Use the separate PHP2Shell mitigation guide for legacy PHP to evaluate Cloudflare WAF, response blocking, origin isolation, and PHP-FPM workarounds. It explains what to verify while arranging a compatible runtime fix. Installing the complete fixes remains the reliable remediation.

PHP 8.1 and older are outside upstream PHP support. PHP supplied minimal source backports for 7.4, 8.0, and 8.1 for this incident; these do not restore ongoing maintenance. Obtain your vendor’s explicit fixed package or plan a move to a supported branch. Check the official support schedule when choosing the target.

Reviewed on October 22, 2026 against PHP maintainer advisories and the linked vendor documentation. Package availability and hosting rollouts can change; use your vendor’s current notice when applying the update.