PHP2Shell is the name given to two critical flaws, CVE-2026-109618 and CVE-2026-109619, in the PHP engine itself. On October 21, 2026, the PHP project shipped emergency releases to fix them, and every serious source since has made the same point: the PHP2Shell vulnerability lives in the runtime. Updating WordPress, Laravel or your own code does not close it. If anything you operate serves web requests with PHP, the PHP version underneath is what decides whether you are exposed.

Below is what happened, where the sources agree and disagree, and the concrete steps to take this week.

What happened with PHP2Shell

The PHP team released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, describing them as a security release for two critical vulnerabilities that can allow unauthenticated remote code execution. As Qualys puts it, updating is the only complete fix.

PHP rates both issues 9.2 (Critical) under CVSS v4.0.

According to the PHP Foundation's write-up:

  • Apache with mod_php: an unauthenticated request can trigger the flaw before any application code runs. Full remote code execution was demonstrated with default settings.
  • PHP-FPM: remote code execution was confirmed through application-level code paths.
  • The second CVE is a memory-lifetime bug. Internal state can point to memory that belonged to a previous request, and a later request handled by the same worker can then use that freed memory.

Qualys adds that researchers have demonstrated unauthenticated disclosure of PHP worker memory, which can expose passwords, authentication tokens and API keys. That detail matters for the clean-up, not just the patch.

The disclosure itself was rough. The PHP Foundation says it got PHP into the Patch the Planet program, under which the security firm Calif began auditing PHP on July 30. According to Sansec's timeline, Calif reported the first bug on August 11 and Wiz Research reported the vulnerabilities on August 24; the Foundation adds that OpenAI reported further attack vectors on September 18. Technical details then leaked on October 20, the day before the fixed versions shipped. The Foundation has publicly described the delay as a structural failure.

Why the PHP2Shell vulnerability is a runtime problem, not an app problem

This is the part that gets lost in status meetings. "We're on the latest WordPress" or "we upgraded Laravel last month" is not an answer.

Per SECURITY.COM's analysis, any PHP installation that serves web requests is affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, going back to PHP 5.4.0. A patched application on an unpatched runtime remains vulnerable. Sansec cites Calif's report of unauthenticated code execution against current versions of Magento, WordPress, Drupal, Joomla, MediaWiki, Roundcube, phpMyAdmin, Nextcloud, Laravel, Symfony and WHMCS.

It also reaches systems nobody thinks of as "PHP servers." SECURITY.COM notes that third-party products, appliances, containers and hosting platforms that embed PHP may also be affected, and the Dutch NCSC maintains a repository of affected third-party products. Network appliances, hosting control panels and vendor boxes can carry PHP inside them.

How much real exploitation? The sources disagree

Read the headlines carefully, because the evidence doesn't line up neatly:

Source What it reports
Amazon Threat Intelligence An exploitation attempt in MadPot telemetry dated October 17, four days before disclosure; now reports broad exploitation attempts in the wild
CISA Had not observed successful exploitation in the wild at the time of its alert
Sansec (October 22 update) Mass exploitation less likely than expected; attacks need specific knowledge of and conditions on the target, and public exploits don't work against a default PHP install

Attempts are not confirmed breaches, and we have not seen a source confirm a successful compromise. Government guidance doesn't wait for that, though. CISA urges immediate patching and says organisations that cannot update immediately, or that still run PHP 8.1 or earlier, should take PHP-based systems offline until they are patched. The UK's NCSC and other national agencies have issued their own alerts.

Our read: Sansec's nuance helps you prioritise, but it is not a reason to wait. Proof-of-concept code has been reported publicly, and AWS's data shows someone was probing before the rest of us knew the bug existed.

What to do this week

1. Inventory runtimes, not apps

Your application list is the wrong starting point. Find every place a PHP binary runs:

  • Production and staging servers, including forgotten microsites and old campaign pages
  • Docker base images (FROM php:...) and everything built on them
  • Hosting-panel servers and shared hosting accounts
  • Vendor appliances and legacy ERP/CRM modules that bundle PHP
  • Preview or demo environments spun up by CI

A quick check:

# PHP version on a host (CLI)
php -r 'echo PHP_VERSION, PHP_EOL;'

# FPM binary (name varies by distro, e.g. php-fpm8.3)
php-fpm -v

# PHP version inside a container image
docker run --rm --entrypoint php your-image:tag -r 'echo PHP_VERSION, PHP_EOL;'

# Fixed minimums: 8.5.12, 8.4.27, 8.3.36, 8.2.35

The CLI and the web-facing SAPI can be different builds on the same machine, so confirm the version your web server actually loads.

2. Patch, then restart everything that loads PHP

Installing the package is only half the job. Running processes keep the vulnerable code in memory until they restart, so restart PHP-FPM pools, Apache (for mod_php), LiteSpeed and FrankenPHP. For containers, rebuild from a patched base image and redeploy. Pulling a new tag does nothing for a container that is already running.

3. Treat end-of-life runtimes as business risk

PHP 8.1 and older got no official release. The project published limited source backports for 7.4, 8.0 and 8.1, and your OS vendor may ship backported packages, so check with them. Sansec notes the official Docker php image gets no fix for 8.1 or older. If a legacy module is pinned to PHP 7.x, this is the week to put a real number on migrating it versus keeping it online.

4. Use WAF rules as a bridge

Cloudflare reported early attacks at 07:43 UTC on October 21, before the fixed versions were released, and Qualys notes that some attack traffic tried to evade Cloudflare's protections. Microsoft states its WAF mitigations complement patching rather than replace it. Use these to buy hours, not to close the ticket.

5. Assume exposure if you were late (Loop's recommendation)

This is our opinion, not official guidance from PHP, CISA or Microsoft: if an internet-facing PHP server stayed unpatched, review its access and error logs back to October 17 and consider rotating the database passwords, API keys and session secrets it held. The memory-disclosure flaw makes credential leakage a realistic concern even without a full takeover.

If you run PHP on Azure

Much of our client work sits on Azure App Service, so here are the specifics from Microsoft:

  • App Service on Linux: patched built-in PHP images have rolled out to both the Latest and Standard Platform Release Channels. EOL PHP versions get no patch, and changing the release channel does not upgrade an EOL runtime.
  • App Service on Windows: the built-in PHP runtimes are end-of-life and no patch is currently planned. Microsoft recommends moving to App Service on Linux. For most apps this is a deployment change, but test extensions, file paths and any IIS-specific config.
  • Custom containers: rebuild and redeploy on a patched base image; upgrade apps that target EOL versions.
  • Azure WAF: a managed rule for Azure Front Door WAF was rolling out with completion expected October 28. Microsoft's published custom rules reduce selected attack surfaces but don't fully protect against either flaw.

To see which PHP version a Linux web app targets:

az webapp config show \
  --name <app-name> \
  --resource-group <resource-group> \
  --query linuxFxVersion

If the result points to an EOL version, the platform patch will not reach you. Plan the upgrade now.

Key takeaways

  • PHP2Shell is a flaw in the PHP runtime; patched CMS or framework code on an unpatched runtime is still vulnerable.
  • Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart every PHP process and redeploy containers.
  • Inventory runtimes everywhere: images, staging, microsites, hosting panels and vendor appliances.
  • PHP 8.1 and older have no official release; treat them as business risk and check OS vendor backports.
  • On Azure, leave built-in PHP on Windows, verify Linux apps aren't on EOL versions, and treat WAF rules as a bridge only.
  • Exploitation evidence is mixed, but government agencies say patch now. If you were late, we recommend reviewing logs back to October 17 and rotating secrets.