PHP2Shell Vulnerability: What It Is and How to Fix It

On October 21, 2026, the PHP project shipped emergency releases for two critical flaws in PHP itself. Security researchers named them PHP2Shell (you will also see it written "PHP 2 Shell"). They are tracked as CVE-2026-109618 and CVE-2026-109619, and the PHP team's own advisory is blunt: they "can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately."

Unauthenticated remote code execution means a stranger on the internet can make your server run their commands, without a password, without an account, and without your website doing anything wrong. If your site, your shop or your customer portal runs on PHP, this is about you.

Both flaws are rated 9.2 out of 10 (critical), and security firm watchTowr reports seeing attackers try to exploit PHP2Shell on its honeypots since the day it was announced. This post explains the PHP2Shell vulnerability in plain English: who it affects, the fixed versions, and how to fix it.

What is the PHP2Shell vulnerability, and who is affected?

PHP runs a large share of the web: WordPress, WooCommerce, Laravel, Drupal, Magento, and countless custom sites and admin panels. The PHP team says the risk covers all PHP installations serving web requests, including:

• Apache with mod_php - the highest risk. The PHP team reports a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
• PHP-FPM (the usual setup behind Nginx)
• LiteSpeed (what many shared hosts use)
• php-cgi and FrankenPHP

The flaws affect almost every PHP version going back years. Researchers from Wiz, Calif and OpenAI found and reported them, and within a day of disclosure security firms were reporting exploit attempts.

The PHP2Shell patch: fixed versions

You don't have to jump to the newest major version to be safe. Each supported line received the same fix. What matters is that you are on the patched release of your line.

How to fix the PHP2Shell vulnerability

1. Find out which PHP actually serves your site

Not the version you think you picked. The version that answers web requests. On many servers the command-line php -v and the web server use different builds. Your host's control panel shows the PHP line (for example "8.5"), not whether their build of it is patched.

2. Update, based on where your site lives

• Shared hosting (Hostinger, GoDaddy, Bluehost, SiteGround and others): the host patches PHP, not you. Ask their support directly when the patched build is live on your server, and check again after they say yes.
• Your own server or VPS: update PHP through your system's package manager, then restart PHP-FPM or Apache. A patched package on disk does nothing until the running process is replaced.
• Docker: rebuild your images on the patched official PHP images (docker compose build --pull) and recreate the containers. Images you pull from vendors (CRMs, invoicing apps, help desks) only get fixed when the vendor republishes them, and a republished image is not automatically a patched one. Check the PHP version inside the new image before you rely on it.
• PHP 8.1 or older: there is no official patch. Plan the upgrade now.

3. If you can't patch right away

The PHP team states plainly that "there are no complete mitigations, updating is the only safe choice." Security researchers have published stop-gaps that reduce the risk while you wait:

• Set session.upload_progress.enabled = Off in your PHP settings, which blocks the known path for CVE-2026-109619.
• Limit how large a request can be at the web server.
• Take anything that doesn't need to be public off the open internet, or put it behind a VPN.

These buy time. They are not the fix.

4. Check whether someone already got in

Updating closes the door. It doesn't remove anyone who walked through it before you closed it. Look for:

• PHP processes starting shells or tools they never should: sh, bash, curl, wget, nc, python
• New or recently changed .php files in your website folders, especially in upload directories
• Odd requests in your web server logs around and after October 21

If you find something, assume credentials on that server are exposed: change database passwords, API keys and admin logins after you clean up.

PHP2Shell questions people are asking

What is PHP2Shell?

PHP2Shell is the name for two critical security flaws in the PHP language itself, CVE-2026-109618 and CVE-2026-109619, announced on October 21, 2026. They let an attacker run their own code on a web server that uses an unpatched PHP, without logging in.

Is PHP2Shell being exploited?

Yes. watchTowr reports exploitation attempts on its honeypot network since October 21, 2026, the day the fixes came out. Treat any unpatched PHP server that faces the internet as a target.

How do I fix PHP2Shell?

Update PHP to the patched release of your line (8.5.12, 8.4.27, 8.3.36 or 8.2.35), then restart PHP-FPM or Apache so the running process uses it. On shared hosting, ask your host to confirm the patched build is live on your server. The full steps are in the "How to fix" section above.

Is there a PHP shell patch for PHP 8.1 or older?

No. PHP 8.1 and older no longer receive security updates, so there is no official patch for them. The only fix is upgrading to a supported line.

Where is the official PHP2Shell advisory?

On php.net, in the PHP 8 changelog and the release notes for each fixed version. That is the source to trust for version numbers.

Does PHP2Shell affect WordPress, Laravel or WooCommerce?

Yes, if they run on an unpatched PHP. The flaw is in PHP, not in the app, so updating WordPress, Laravel or a plugin does not fix it. Updating PHP does.

Will a firewall or WAF stop PHP2Shell?

Some firewall and security vendors have added rules that block known attack patterns, and that helps. But the PHP team says "there are no complete mitigations, updating is the only safe choice." A firewall rule buys time; the PHP update is the fix.

Does PHP2Shell affect Ubiquiti UniFi or UISP?

Ubiquiti had not published a PHP2Shell advisory when we checked. Security write-ups report that UniFi consoles and the UniFi Network Application are not built on PHP. UISP itself runs on Node.js, but its CRM module runs PHP: a UISP hosting provider reports that UISP 3.1.70, released October 23, 2026, ships the CRM module with the patched PHP 8.3.36. If you run UISP, update it and confirm the version. For any appliance or vendor product, check whether it bundles PHP and wait for the vendor's own update.

What we did the same day

We run PHP across our own business, so we did exactly what this post describes. We listed every place PHP runs, checked the exact version inside each running container, and rebuilt them on patched images, confirming the new version inside each one rather than trusting the rebuild. One vendor image we use had been republished without the fix, which is precisely the trap described above.

For our public website on shared hosting, we checked the exact PHP that answers a real web request, not the one shown in the control panel, and confirmed the protective settings were already active. Our host then confirmed its servers were updated and not exposed. That is the order that matters: check for yourself first, then get it in writing from the people who run the server.

The bigger lesson

A website isn't finished when it launches. The software underneath it ages every day, and a flaw like this turns an ordinary site into an open door overnight. The businesses that come through events like PHP2Shell unharmed aren't the ones with the fanciest sites. They're the ones where somebody was watching, knew what was running, and could patch it the same day.

If you're not sure who is patching the servers your business depends on, read Who Is Patching the Software That Runs Your Business?.

If you want us to check your site and servers for PHP2Shell, patch them, and keep them patched, start with our security review and hardening or get a tech quote.

Sources: PHP security advisory and release notes, UK National Cyber Security Centre, Qualys, Huntress, The Hacker News, watchTowr PHP2Shell FAQ, Cloud UniFi - PHP2Shell and UISP.