php2shell: The Critical PHP Flaw That Takes Over Servers With No Password (2026)

If you run a PHP site or system, update PHP today. On October 21, 2026, the PHP project disclosed two critical vulnerabilities — nicknamed php2shell (CVE-2026-109618 and CVE-2026-109619) — that let an attacker run code on the server without a password, with a single request. The fix is straightforward: update to a patched PHP version. This post explains what the flaw is, who is affected, how it’s exploited, and the step-by-step to protect yourself.

What php2shell is

These are two flaws in the core of PHP, tied to memory management while processing HTTP requests. The PHP team rated the severity 9.2 out of 10 on the CVSS 4.0 scale; the NVD (the US national vulnerability database) records 9.8 out of 10 on CVSS 3.1 — either way, top severity. The main impact is unauthenticated remote code execution (RCE): the attacker runs commands on the server with no account and no password. As a result, it can take the service down, leak data and take over the machine.

Cloudflare estimates PHP powers about 70% of websites — it’s the foundation of WordPress, online stores, portals and countless APIs. That’s why this matters so much: it isn’t a niche, it’s most of the web. On disclosure day, public services went offline to patch in a hurry — in Brazil, part of the telecom regulator’s (Anatel) services were temporarily unavailable.

Who is affected

Any PHP installation that serves web requests. The flaw is in PHP itself, not a specific framework, so it hits the main execution modes:

• PHP-FPM (the most common today, behind Nginx);
• Apache with mod_php — called out as the highest-risk setup;
• php-cgi, FrankenPHP and LiteSpeed.

In practice that includes WordPress (and its whole ecosystem of themes and plugins), Laravel apps, Magento/WooCommerce stores, internal panels and PHP APIs. According to the project, versions from PHP 5.4 onward are reported as affected — which includes a lot of old code still running in production.

How to tell in 1 minute if you’re exposed

It’s simple: if your site or system runs PHP and the version is not one of the patched ones (8.5.12, 8.4.27, 8.3.36 or 8.2.35, or an already-updated package from your distribution), consider yourself exposed. To check the version: on the server, php -v; on a website, the version sometimes shows in the X-Powered-By HTTP header (if not hidden) or in your hosting panel. When in doubt, ask your provider “which PHP version does my site use, and does it already include the php2shell fix?”.

How the flaw is exploited

The detail that makes php2shell so dangerous: a single HTTP request triggers the attack before your application code runs. It doesn’t matter which framework, security plugin or business rule you have — the problem happens in the PHP layer that assembles the request, before it reaches your code. The two CVEs have related causes, both in memory management:

CVE-2026-109618 — memory corruption during request cleanup

When the server runs out of memory (out-of-memory) mid-processing, PHP can be interrupted with the request’s internal data only partially initialized. The cleanup routine then treats that invalid data as valid — and that memory corruption is what an attacker uses to execute code.

CVE-2026-109619 — stale global state reused from a previous request

Internal state that belongs to one request can survive after its memory has been freed. A later request, handled by the same worker process, may end up using that “stale” state before normal initialization resets it. It’s a classic use-after-free across requests, leading to code execution and to data leaking from one request into another.

Researchers have already demonstrated a working exploit, and Cloudflare says it identified known attack vectors — which is why patching is urgent. (We won’t publish exploitation details here.)

How we got here

The flaws were found independently months ago — per reporting, by the security firm Calif and by OpenAI — and Wiz researchers published the technical explanation. The plan was a coordinated disclosure: Linux distributions and providers got the patch early, to ship packages on the same day. But information about the flaw leaked before the official disclosure, and the race began: sites went offline to update in a hurry, Cloudflare activated WAF rules about nine hours before the announcement, and PHP published the fixed versions on October 21, 2026. It’s a reminder that when the flaw is in the core of a technology as ubiquitous as PHP, the time between “a fix exists” and “I’m protected” is only as long as it takes you to update.

Why you can’t just “work around” it

The PHP team is blunt: there’s no definitive workaround; updating is the only safe option. Changing configuration or limiting memory may reduce exposure, but it doesn’t close the flaw. A WAF (web application firewall) helps as a temporary layer — Cloudflare enabled rules for the known vectors, including on the free plan, about nine hours before disclosure — but it’s there to buy time, not replace the patch. The UK’s NCSC even recommended taking offline any system that can’t be fixed right away.

How to fix it now

1. Check your PHP version. On the server: php -v. On managed hosting, the panel (cPanel, Plesk) shows the version in use.
2. Update to a patched version (released October 21, 2026):

   PHP 8.5.x  →  8.5.12
   PHP 8.4.x  →  8.4.27
   PHP 8.3.x  →  8.3.36
   PHP 8.2.x  →  8.2.35

3. Restart PHP after updating. PHP-FPM (systemctl restart php8.3-fpm, adjusting the version) or Apache with mod_php. Without a restart, the old (vulnerable) process keeps running.
4. Managed hosting or a Linux distribution? Ubuntu, Debian, AlmaLinux and Red Hat shipped patched packages (many before the public disclosure). Update via the system package manager and confirm with your provider.
5. On an old (end-of-life) version? PHP 8.1 and earlier get no official release, but the security team published minimal source backports for PHP 7.4, 8.0 and 8.1 (for those who build from source). PHP 5.x and 7.0–7.3 get no fix from the project — the path is to migrate to a supported version, urgently.
6. WAF as a temporary layer. If you use Cloudflare, confirm the protection is active. It’s a stopgap while you update, not the solution.
7. Check for signs of compromise. Since an exploit already exists, treat outdated servers as potentially hit: look at access logs for odd requests, new or modified files in the application root (webshells), scheduled tasks and users created without explanation.

I updated. What if they got in earlier?

Updating closes the door, but it doesn’t undo whatever might have been done while it was open. Because the flaw allows code execution without login and a public exploit already exists, a server that spent days unpatched deserves a check beyond the basics: hunt for a webshell, persistence (cron, services, added SSH keys), credentials that may have leaked and need rotating, and anomalous access in the logs. If your system stores personal data or processes payments, this check stops being optional.

This is exactly the kind of situation where an outside look helps: confirming the fix was applied everywhere and that nobody left anything behind. If you’d like help checking your case, talk to a researcher — and, more broadly, a periodic pentest finds this kind of gap before it makes the news.

Official sources and analysis: php.net (patched versions), NVD CVE-2026-109618, NVD CVE-2026-109619, NCSC-NL (operational info) and Help Net Security. This article is informational and doesn’t replace the official advisory from your provider and your distribution.