PHP2Shell is a pair of critical PHP flaws that can let an attacker run code on your web server without logging in. Here is who is affected, how to check, and how to fix it.
What our scanner can and can't see. Threat Watch compares the PHP version your server advertises with the fixed releases. It doesn't report anything if your server hides its version, and hiding it doesn't fix the flaw. Linux distributions can also backport fixes without changing the version number. Use the checks below to confirm on the server.
PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619. CISA says they allow unauthenticated remote code execution in PHP. PHP rates both as critical, with a CVSS v4.0 score of 9.2.
CVE-2026-109618 is a memory corruption flaw triggered by an out-of-memory condition. CVE-2026-109619 is stale internal state left over from one request and used by a later request on the same PHP worker.
CISA added both to its Known Exploited Vulnerabilities catalog on 26 October 2026. The UK NCSC encouraged organisations to take immediate action.
CISA says all PHP installations serving web requests are affected. That includes:
PHP is often part of other software, including appliances and products from third-party vendors, so you may be running it without realising. The NCSC advises finding every PHP installation, starting with internet-facing systems, and not limiting your search to outdated versions.
The command line can use a different PHP build from your web server, so check the version that actually serves your site. Package names and service names vary by system.
# Command-line PHP. This may differ from your web server's PHP. php -v # PHP-FPM. The name varies, for example php-fpm8.4. php-fpm -v # Installed packages on Debian or Ubuntu, then RHEL or similar. dpkg -l | grep -E '^ii +php' rpm -qa | grep -i php # Inside a container. docker exec <container> php -v # What your site advertises. No output doesn't mean you're safe. curl -sI https://example.com | grep -i x-powered-by
You're on a fixed release if you're running PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later on that branch. If your distribution backports fixes, check its security advisory instead of relying on the version number.
Upgrade to PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12 or later, or to your distribution's patched package. Then restart your web server and PHP services, so that every worker runs the new version. PHP 8.1 and older are out of support and need an upgrade to a supported release, or a patched package from your vendor. CISA advises taking those systems offline until they are patched or updated.
These settings reduce exposure while you plan the upgrade, but PHP says none of them make an installation safe.
memory_limit = -1 session.upload_progress.enabled = 0 post_max_size = <a low value that suits your app> # PHP 8.5 only fatal_error_backtraces = 0
An unlimited memory limit is itself a denial-of-service risk, so review these settings once you've upgraded. If you can't apply them or patch quickly, the NCSC says to consider taking the system offline.
Patching doesn't remove anything an attacker already left behind. Check for:
If anything looks wrong, change any secrets the web server user could read, and get incident response help if you need it.
PHP published a separate advisory on 23 October 2026 for a third flaw, which needs a narrow configuration: session.serialize_handler switched to php at runtime with session upload progress enabled. As of that advisory there was no emergency patch, and the recommended mitigation is session.upload_progress.enabled = 0. Check PHP's latest release notes for its current status.
Create a free account, prove you own your domain with a DNS record, and run Threat Watch. It also runs 490+ other known-exploited vulnerability checks, including 280+ for remote code execution. We review each new account and domain before the first scan.
Node2Shell check: is your Node.js affected?
Create a free account · PHP2Shell scanner · Node2Shell check