PHP2Shell: How to Check Whether Your Server Is Vulnerable and Patch It

Two critical PHP flaws known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619, let an unauthenticated attacker run code on a web server. PHP shipped fixes on 21 October, and Amazon Threat Intelligence has seen broad exploitation attempts since. How the flaws were found is covered in the PHP2Shell news report.

Step 1: find which PHP version you run

On a server you control, run:

php -v

This shows the command-line version, which can differ from the one serving web pages. For the web side, check the PHP-FPM binary, for example php-fpm -v or a versioned one such as php-fpm8.3 -v. If several PHP versions are installed, check each one that serves a site.

On shared hosting, look in the control panel under a setting such as PHP version or PHP selector.

Step 2: compare with the fixed versions

The fixed releases per branch, from PHP's security advisory:

Your branch	Fixed in	What to do
8.5	8.5.12	Update
8.4	8.4.27	Update
8.3	8.3.36	Update
8.2	8.2.35	Update, and plan a move: PHP 8.2 reaches end of life on 31 December 2026
8.1, 8.0, 7.4	No official release	Use your distribution's or LTS vendor's patched package, build from PHP's minimal source backports, or upgrade
7.3 and older, including PHP 5	No fix	Upgrade to a supported branch

Linux distributions and LTS vendors received the patches in advance, and some ship backported fixes in their own packages, so on those systems the upstream version number won't show if the fix is in.

To test a host from outside, run Searchlight Cyber's open-source php2shell-scanner, which checks whether it's still exposed to both flaws.

Step 3: update and restart

Install the update through your package manager or hosting panel, then restart every PHP worker: running workers keep the old code in memory until they're restarted. That means PHP-FPM, Apache if PHP runs as an Apache module, or the application server for setups such as FrankenPHP.

Servers running PHP as an Apache module (mod_php) go first: the advisory rates the risk highest there and describes a demonstrated exploit that fires before any application code runs.

PHP's informational advisory of 23 October adds a related flaw, CVE-2026-115560, that still reaches the fixed releases under an unusual session configuration. Until the next regular release, it suggests keeping session.upload_progress.enabled=0 on patched servers too, the same setting listed under the interim settings below.

Step 4: check whether you were hit

Amazon's honeypots caught the first exploitation attempt on 17 October, four days before disclosure, so investigate from that date, not the advisory's. Its write-up advises reviewing the web server logs and checking for unexpected process execution or file changes.

If you can't update yet

• Reduce exposure. Restrict internet access to servers that can't be patched. The UK's NCSC advises considering taking a system offline if it can be neither updated nor mitigated quickly.
• Put a web application firewall in front. Cloudflare's PHP2Shell rules are deployed automatically on every plan with its WAF, including Free.
• Apply PHP's interim settings. For CVE-2026-109619, set session.upload_progress.enabled=0 in php.ini, the FPM pool or server configuration (not through ini_set() or .user.ini), and on PHP 8.5 also set fatal_error_backtraces=0. For CVE-2026-109618, the main setting is memory_limit=-1, applied where applications can't override it (such as php_admin_value), together with a low post_max_size. PHP warns these settings block only the confirmed attack paths and don't make an installation safe.

Shared hosting and managed WordPress

Your host controls PHP and has to apply the fix; ask support whether it's done. The flaws are in PHP itself, so WordPress plugins and themes can't fix them.

Appliances that ship PHP

Palo Alto Networks lists PAN-OS on PA-Series and VM-Series firewalls and on Panorama as affected, with hotfixes out for some PAN-OS versions and the rest due by 30 October. For other products, NCSC-NL keeps an inventory of software that bundles PHP, tracking each one from under investigation to fixed.