PHP2Shell: What Website Owners Must Do Now (2026 Patch Guide)

If your website runs on PHP — and most WordPress sites do — there is one update you should not leave for next week. PHP2Shell, two critical flaws in PHP itself, was patched on 21 October 2026, but exploitation attempts kept climbing afterwards. This guide gives you the exact versions to move to, the order to patch in, and the one extra setting to switch off while a separate flaw stays unpatched. It is desk-researched from vendor and security reporting, not a hands-on test of a live server, and it does not replace your host’s advice for your specific setup.

Quick answer: PHP2Shell patched two critical PHP flaws on 21 October 2026. Update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, restart workers, and disable session upload progress.

What is PHP2Shell?

PHP2Shell is the name researchers gave to two critical remote-code-execution flaws in PHP core: CVE-2026-109618 and CVE-2026-109619. Each is rated 9.2 under CVSS v4.0. In plain terms, an unauthenticated attacker — someone with no login at all — could send a crafted web request and run their own code on the server, with the privileges of the PHP worker. Because the flaws sit in PHP itself rather than in WordPress, a theme or a plugin, a site with clean application code is still exposed if its PHP runtime is unpatched.

The two flaws work differently. CVE-2026-109618 abuses out-of-memory handling during request processing, such as parsing uploaded form data. CVE-2026-109619 is a use-after-free problem: state left over from one request can be reached by a later request on the same worker. Security researchers also reported a related memory-disclosure risk: an attacker might read PHP process memory, including passwords, tokens or certificates, even where code execution is blocked. That is why this is treated as an emergency patch, not a routine update.

Which PHP versions are affected, and which fix it?

The vulnerable code dates back to PHP 5.4, so the affected range is wide. The fixed releases, all shipped on 21 October 2026, are:

Your PHP branchMove to at least
PHP 8.58.5.12
PHP 8.48.4.27
PHP 8.38.3.36
PHP 8.28.2.35

PHP 8.1 and older have no official fixed release, because those branches are end of life. If you are on one of them, the fix is a migration to a supported branch, or a backport from your Linux distribution or long-term-support vendor — not a setting you can toggle in WordPress. Updating WordPress, your theme or your plugins does not patch PHP. You are updating the wrong layer if that is all you do.

Details leaked on 20 October 2026, ahead of a coordinated disclosure originally planned for 22 October, and PHP moved the release forward to 21 October. Cloudflare reported attack attempts before the patch shipped, and its chief executive later said attempts on Cloudflare’s network rose from thousands before disclosure to millions afterwards, according to Reuters and SecurityWeek coverage summarised on 24 October. Most of what researchers have seen so far is scanning — attackers knocking to find unpatched servers — rather than confirmed mass break-ins, but millions of knocks is still a warning to patch before your server is the one that answers.

Check your PHP version in 60 seconds

Do not guess your version, and do not publish a phpinfo page to find out — that page hands attackers exactly the detail they want. Use one of these safer routes instead:

  1. Hosting control panel: look for the PHP version selector (in cPanel, this is usually under Software, then Select PHP Version; other panels label it PHP Manager or PHP Settings). The number shown there is the one that matters.
  2. SSH or terminal, if your host gives you one: run php -v and note the full version number, for example 8.2.35.
  3. No panel and no terminal access: open a support ticket and ask your host, in one line, “What PHP version is my site running, and can you move it to the patched release for my branch?”

If the number is at or above the fixed release for your branch, you are past the PHP2Shell patch. If it is below, or on an end-of-life branch, you have work to do — and the next section is the order to do it in.

The patch checklist, in order

Patch internet-facing systems first, then work inward. If you must stage the rollout, that order is the one security advisories recommend.

  1. Back up first. Take a full site and database backup you can actually restore, and note your current PHP version so you can roll back if a plugin breaks.
  2. Update PHP itself, not just the application. Move to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, whichever matches your branch. On shared hosting this is usually the version selector in your panel; on a VPS or dedicated server it is your package manager or your host’s upgrade path.
  3. Restart every PHP worker after the update. Updating the files alone is not enough: workers running the old binary keep serving requests until they restart. Expel’s advisory makes this explicit — update and restart, because patching is the only complete fix for these two flaws.
  4. Test the site, then check the version again. Load the homepage, a post page and any form or checkout page, and confirm the panel or php -v now shows the fixed release.
  5. If a plugin or theme breaks on the newer PHP, do not roll back to a vulnerable version and stop there. Ask the plugin author or your host for a compatible version, and treat an unpatched, internet-facing server as the bigger risk while you fix it.

There is no configuration workaround that closes PHP2Shell. Mitigations circulated before the patch were incomplete, and PHP’s own position, repeated by multiple advisories, is that patching is the only complete fix. A web-application firewall can reduce noise, and Cloudflare rolled out default protection to its customers before the public release, but a firewall rule is a filter in front of the flaw, not a fix for it.

The second flaw you still need to handle: session upload progress

Patching PHP2Shell does not finish the job. On 23 October, PHP warned of a separate, still-unpatched remote-code-execution flaw, CVE-2026-115560, tied to session upload progress, and recommended disabling that feature until the next release. Security reporting on 24 October repeated the same advice: set session.upload_progress.enabled to 0.

In practice, that means adding session.upload_progress.enabled=0 to your php.ini, or asking your host to set it, and then testing any feature that relies on upload progress bars. If a feature breaks, that is a conversation with your host about a safe alternative — not a reason to quietly re-enable an unpatched flaw. This setting is separate from the PHP2Shell patch, so check it even after your version number looks right.

Why the patch lag matters more than the patch itself

The 24 October fallout shows the message is not landing everywhere. Danish industry reporting counted more than 21,000 Danish websites still lacking PHP security updates, and Palo Alto Networks confirmed on 24 October that the flaws affect its PAN-OS and Panorama management interfaces, with hotfixes dated 26 to 30 October and advice to restrict management-interface access to trusted addresses until then. Security reports also linked Mirai-derived Potassium botnet operators to weaponisation attempts against the flaws, though no successful compromise was confirmed in that reporting.

The pattern is familiar: the patch exists, the scanning starts immediately, and the sites that stay unpatched longest become the inventory. Your site does not need to be large or famous to be scanned — automated attempts do not check your traffic before they knock. Patching promptly, restarting workers, and disabling session upload progress are three small actions that take your site out of that inventory.

Our take: patch the runtime, then fix the habit

Most website owners think in WordPress terms — core, theme, plugins — and PHP is invisible until it breaks. PHP2Shell is a reminder that the runtime underneath WordPress is its own layer with its own emergency patches, and that layer needs a named owner: either you, checking the version after every security announcement, or your host, under a plan that applies runtime patches promptly. The honest verdict for this run is simple. If your version is already at or above the fixed release and session upload progress is off, you are done. If it is not, the patch is the priority, and everything else on your to-do list waits behind it.

Frequently asked questions

Does updating WordPress fix PHP2Shell?

No. PHP2Shell is in PHP core, not in WordPress. You must update the PHP runtime itself to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, depending on your branch, and restart PHP workers afterwards.

I am on PHP 8.1 or older. What should I do?

There is no official fixed release for end-of-life branches. Migrate to a supported branch, or ask your host or distribution vendor about a backport. Staying on an unpatched, internet-facing version is the riskiest option.

Do I need to disable session upload progress even after patching?

Yes, for now. CVE-2026-115560 is a separate, still-unpatched flaw tied to session upload progress, and the reported advice is to set session.upload_progress.enabled to 0 until the next release.

Will a firewall or security plugin protect me instead?

A firewall can reduce attack noise, but it does not fix the flaws in PHP. Advisories are explicit that patching is the only complete fix for CVE-2026-109618 and CVE-2026-109619.

How do I know the patch actually took effect?

Check the version again after updating and restarting workers — in your hosting panel or with php -v — and confirm it shows the fixed release for your branch. Then load your homepage, a post page and a form or checkout page to confirm nothing broke.

Sources and methodology

Claims in this article rest on vendor and security reporting verified on 25 October 2026, not on hands-on testing of a live server: the PHP fixed releases and CVSS 9.2 ratings, the leak and release timeline, and the patch-only-fix position are summarised from Sysdig, Expel and Escape advisories; the 24 October fallout — Cloudflare’s thousands-to-millions attempt counts, the Danish unpatched count, Palo Alto’s PAN-OS impact and hotfix dates, and the Mirai-derived Potassium weaponisation reports — is summarised from the 24 October update and escalation reporting linked below; the session-upload-progress warning for CVE-2026-115560 is reported from PHP’s 23 October warning via that same reporting. Where reporting differs on whether any compromise was confirmed, this article reports the cautious position: most observed activity is scanning, not confirmed mass break-ins.

Outbound links (open in new tab):

Internal links: 1Password for Agents: safe AI agent logins and how we test AI tools.

Leave a Reply

Your email address will not be published. Required fields are marked *