PHP2Shell: is your website exposed?
Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) let attackers run their own code on web servers without logging in. PHP released fixes on October 21, 2026, and attacks have already been seen in the wild.
Free website check
Passive check: we make one normal request to your homepage and read what it publicly reveals (headers, cookies, platform). We never attempt an exploit.
PHP2Shell at a glance
- CVEs
- CVE-2026-109618 (memory corruption during out-of-memory handling) and CVE-2026-109619 (use-after-free of state kept between requests)
- Severity
- CVSS v4.0 9.2 (critical) for each, per the PHP project
- Impact
- Unauthenticated remote code execution with the web server's privileges
- Affected
- PHP 5.4 through 8.5 before the fixed releases, on PHP-FPM, Apache mod_php (highest risk), php-cgi, FrankenPHP and LiteSpeed
- Fixed in
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (released October 21, 2026)
- Status
- Exploitation attempts were seen from October 17. CISA, the UK NCSC and CERT-EU urge immediate patching
Which PHP versions are affected?
| PHP branch | Status | What to do |
|---|---|---|
| PHP 8.5 | Affected before 8.5.12 | Update to 8.5.12 or later |
| PHP 8.4 | Affected before 8.4.27 | Update to 8.4.27 or later |
| PHP 8.3 | Affected before 8.3.36 | Update to 8.3.36 or later |
| PHP 8.2 | Affected before 8.2.35 | Update to 8.2.35 (8.2 reaches end of life on Dec 31, 2026) |
| PHP 7.4 – 8.1 | Affected, end-of-life | No official release; source backports only. Upgrade the branch |
| PHP 5.4 – 7.3 | Affected, end-of-life | No fix from the PHP project. Upgrade or retire the site |
What to do right now
- 1
Update PHP and restart every worker
Install 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your Linux distribution's patched package), then restart PHP-FPM, Apache or LiteSpeed so no old worker keeps running. On shared hosting, ask your host to confirm the update.
- 2
Can't update today? Apply the partial mitigations
PHP's advisory lists settings that reduce exposure but explicitly do not make a server safe. Apply them in php.ini or the FPM/Apache config (not .user.ini or ini_set) and restart all workers. CISA and the UK NCSC advise taking unpatchable sites offline.
- 3
Running PHP 8.1 or older? Plan an exit
These branches get no official release. Upgrading an old WordPress, Joomla or custom PHP site across major PHP versions often breaks plugins and themes, so moving the site to a managed platform can be faster and safer.
- 4
Check for signs of compromise since October 17
Look for unknown .php files in upload folders, new admin users, changed .htaccess files, and PHP worker processes launching shells or downloading tools. If you find any, assume the server is compromised and rebuild it.
Partial mitigations from PHP's advisory (not a fix)
; CVE-2026-109618: set where applications can't override it
; (php_admin_value in PHP-FPM pools or Apache)
memory_limit = -1
post_max_size = 8M ; 32M if file uploads are required
; keep upload_max_filesize below post_max_size
; CVE-2026-109619: php.ini or pool config, then restart all workers
session.upload_progress.enabled = 0
; PHP 8.5 only
fatal_error_backtraces = 0Patch today. Then leave PHP maintenance behind.
Updating PHP is the immediate fix. For the longer term, Zotview sites don't run on a PHP server you have to maintain: paste your website address and our AI model rebuilds it, with a preview and a migration report before you switch anything.
AI migration in minutes
Our AI model reads your existing pages, services, products and contact details and rebuilds them with a modern design.
Nothing to patch
Hosting, SSL certificates and security updates are handled for you. No PHP, no plugins, no FTP.
Free address, your own domain
Go live on a free yourname.zotview.com address right away, then connect your own domain whenever you're ready.
More than a website
Online booking, forms, products and services come built in, managed from one dashboard.
Free to try · No credit card · Your old site stays online until you switch
Migration guides: WordPress · Joomla · Drupal · custom PHP
PHP2Shell FAQ
What is PHP2Shell?
PHP2Shell is the name given to two critical vulnerabilities in the PHP interpreter, CVE-2026-109618 and CVE-2026-109619, disclosed and patched on October 21, 2026. Both can let an unauthenticated attacker run code on a web server with the privileges of the PHP worker.
Which PHP versions are affected?
Every PHP version from 5.4 up to the fixed releases: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are end-of-life and get no official release; the PHP team published minimal source backports for 7.4, 8.0 and 8.1 only.
Is WordPress affected?
WordPress runs on PHP, so a WordPress site is exposed if its server runs an unpatched PHP version. Calif, one of the research teams behind the discovery, reports confirmed pre-authentication code execution against specific versions of WordPress, Drupal, Joomla and Magento. Updating WordPress plugins does not fix PHP itself; the server's PHP must be updated.
My server says PHP 8.1.2-ubuntu. Am I vulnerable?
Possibly not. Linux distributions such as Ubuntu, Debian and RHEL backport security fixes without changing the PHP version number. Check your distribution's security notice and make sure the patched php package is installed and every PHP worker was restarted.
Does Cloudflare or a WAF protect me?
It helps. Cloudflare deployed WAF rules for known exploit patterns, including on the free plan. But the PHP project and Cloudflare both describe this as a stopgap: only traffic that goes through the WAF is filtered, and new variants may slip through. Updating PHP is the only complete fix.
How does the free check work?
We send one ordinary request to your homepage, the same as a browser visit, and read what the response publicly reveals: the X-Powered-By header, session cookies, links to .php pages and platform fingerprints. We never send exploit payloads, and we can't see versions your server hides.
Can Zotview move my site for me?
Yes. Patch PHP first if your site is exposed, then enter your website address on the migration page and our AI model rebuilds your content on Zotview: pages, services, products, contact details and images. You get a free zotview.com address immediately, a report of what was migrated, and you can connect your own domain at any time.
Sources
- PHP: Security advisory – Critical remote code execution vulnerabilities, update now
- GitHub advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
- GitHub advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
- CISA: Critical Vulnerabilities in PHP Require Immediate Patching
- Tenable: PHP2Shell frequently asked questions
- Rapid7: CVE-2026-109618 and CVE-2026-109619 analysis
Last updated October 22, 2026. We update this page as the PHP project and security agencies publish new information.