PHP2Shell: Two Critical PHP Vulnerabilities You Need to Patch Now

Two critical vulnerabilities in PHP have put production web servers at risk. Identified as CVE-2026-109618 and CVE-2026-109619, these flaws could allow an unauthenticated attacker to execute arbitrary code on a vulnerable server. Both vulnerabilities carry a severity score of 9.2, and PHP's release notes state that there is no complete workaround. Updating to a patched version is the required fix.

The threat is not merely theoretical. According to reports cited in the security coverage, Amazon's honeypots detected an exploitation attempt on 17 October 2026, four days before the fixes were publicly released. Researchers have collectively referred to the two vulnerabilities as PHP2Shell, highlighting the potential for a remote attacker to gain code execution through a single unauthenticated request.

For organisations running PHP in production, this calls for immediate attention. The priority is to identify every affected system, deploy the appropriate patches, verify that the vulnerable runtime has been replaced, and investigate whether exploitation has already occurred.

What Is PHP2Shell, and Why Is It a Serious Security Risk?

PHP2Shell refers to two critical vulnerabilities in PHP's core request-cleanup process. The problems arise when PHP encounters a severe failure, such as running out of memory or experiencing a fatal error.

Under these circumstances, PHP's cleanup routines may operate on memory that has not been fully initialised or has already been freed. An attacker who can trigger the vulnerable condition may be able to manipulate this behaviour to execute their own code on the server.

The impact is significant because the vulnerabilities exist in PHP itself rather than in a particular application or framework.

This means the risk extends across applications built with:

• Laravel

• WordPress

• Symfony

• Custom PHP applications

It also affects different ways of running PHP, including PHP-FPM, mod_php, FrankenPHP and other deployment configurations. According to the source draft, mod_php is particularly exposed.

All PHP versions are affected, but PHP 8.1 and older no longer receive official fixes. Organisations running these versions must determine whether their distribution or long-term support vendor has backported the security patches or whether an upgrade is required.

The critical takeaway is that application-level protections alone are not sufficient. The vulnerable PHP runtime itself must be addressed.

How to Protect Your PHP Applications Against PHP2Shell?

Responding effectively requires more than installing a patch on the main production server. PHP may be running across legacy infrastructure, containers, staging environments, internal tools and third-party products.

The following steps provide a practical remediation plan.

1. Identify Every System Running PHP

Start by building an inventory of all PHP deployments, prioritising systems that are accessible from the internet.

Include:

• Production web servers and applications

• Older or forgotten servers

• Docker containers and container images

• Continuous integration (CI) images

• Staging environments

• Internal applications and tools

• Third-party products and appliances that bundle PHP

Do not limit the investigation to systems your development team manages directly.

For example, the original security draft identifies Palo Alto Networks' PAN-OS and Panorama as affected products across their versions, noting that a fix had not yet been released as of Thursday, 22 October 2026. This illustrates why appliance and vendor dependencies must be included in the response. 

Record the PHP version, deployment method, exposure level and patch status for each identified system. This inventory will help determine which assets require immediate remediation and which need temporary containment measures.

2. Upgrade to a Patched PHP Version

The source draft identifies the following patched PHP releases:

• PHP 8.5.12

• PHP 8.4.27

• PHP 8.3.36

• PHP 8.2.35

Upgrade to the appropriate patched release or install the corresponding security-patched package provided by your operating system distribution.

However, installing an update is only part of the process. You must also restart the relevant services and confirm that the production runtime is using the patched version.

For deployments using PHP-FPM or Apache, restart the applicable service after updating. Then verify the version actually running in the web-serving environment.

This distinction matters because the PHP command-line executable may report a different version from the PHP-FPM service handling production requests.

On Debian and Ubuntu systems, PHP binaries are versioned. For example, use the following command to check PHP-FPM 8.3:

php-fpm8.3 -v

Adjust the command for the PHP version installed on the system.

If you deploy applications using Laravel Forge, consult its published guidance for the relevant security advisory and deployment steps.

3. Check Docker Images and Exact Version Pins

Updating the server does not automatically eliminate vulnerable PHP versions from container builds.

This is an easy issue to overlook. A Dockerfile that explicitly references an affected image, such as:

FROM php:8.4.26-apache

can continue building a vulnerable image even after a patched image becomes available.

By contrast, a moving tag such as php:8.4-apache may point to an updated image once the publisher refreshes it. The actual image and build configuration should still be verified rather than assumed to be secure.

Exact PHP version constraints in composer.json can create similar problems by keeping dependencies or deployment configurations tied to an affected version.

Search your repositories for pinned PHP images and version declarations:

grep -rn "FROM php" --include="Dockerfile*" . 
grep -n '"php"' composer.json

Review the results, update vulnerable version references, and rebuild the affected images without using the build cache.

For example:

docker build --no-cache -t your-application:patched .

Replace the example image name with your actual application image and follow your normal deployment process.

After rebuilding, verify that the resulting image contains a patched PHP runtime. Update deployed containers as well as the source files used to build them.

4. Address PHP 8.1 and Older Deployments

Systems running PHP 8.1 or older require special attention because these versions do not receive official fixes according to the source draft.

Where possible, upgrade to a supported PHP release that contains the required security patch.

If an immediate upgrade is not feasible, contact your operating system distribution or long-term support vendor to establish whether the vulnerability fix has been backported to your installed package.

Until the issue is resolved, restrict network access to the affected systems and reduce their exposure as much as possible.

The UK's National Cyber Security Centre (NCSC) advises considering taking a system offline if it cannot be fixed or adequately mitigated quickly.

This is particularly important for internet-facing systems where an attacker may be able to trigger the vulnerable behaviour without authenticating.

5. Investigate Possible Exploitation

Patching prevents future exploitation of the fixed vulnerability, but it does not establish whether a server was compromised before the update.

Because exploitation attempts were reportedly detected before public disclosure, organisations should investigate their existing systems as part of the response.

Look for suspicious activity, including:

• Unexpected .php files that were not deployed by your team

• Unfamiliar PHP files in upload directories

• Unexplained outbound network connections

• Other signs of unauthorised access or unexpected code execution

If you discover a web shell or other evidence of compromise, isolate the affected server and begin an incident-response investigation.

Also rotate credentials and secrets that the compromised system could access, including:

• Environment variables containing sensitive values

• Database passwords

• API keys

• Cloud credentials

Where cloud credentials or other secrets may have been exposed, revoke or replace them as appropriate and review relevant access logs.

If you cannot confidently establish the extent of a possible compromise, involve qualified security professionals. A successful patch alone is not a substitute for investigating suspicious activity.

What If You Cannot Apply the Patch Immediately?

Some organisations cannot update every system at once. Legacy applications, vendor-managed appliances, operational constraints and deployment dependencies can delay remediation.

In these cases, temporary mitigations can reduce exposure, but they should not be treated as permanent solutions.

Use Web Application Firewall Rules as Temporary Protection

Web application firewall (WAF) rules may help block known exploitation attempts.

According to the reporting referenced in the original draft, Cloudflare deployed rules covering known exploit paths for all customers, including those on free plans. Fastly also published protective rules.

These controls can provide an additional defensive layer while patches are being deployed.

However, WAF rules only block activity that matches the patterns they recognise. They cannot guarantee protection against every exploitation technique or variation.

Treat WAF protection as temporary coverage while you work towards installing the official fix.

Evaluate PHP Configuration-Based Mitigations Carefully

The original draft also references temporary configuration changes published by Sevalla to make exploitation more difficult.

The suggested changes include:

• Disabling session upload progress

• Setting memory_limit to -1

• Disabling fatal-error backtraces

These settings should not be applied blindly.

In particular, setting memory_limit to -1 removes PHP's memory limit. As the source draft notes, this can allow a single request to consume an instance's available memory, creating a separate availability risk.

Sevalla itself states that these measures do not completely fix the vulnerabilities.

The PHP Foundation also provides temporary mitigation guidance in its advisory. Review that guidance before choosing configuration-level measures, and evaluate the operational consequences of any change.

Ultimately, configuration adjustments and WAF rules are secondary safeguards. They do not replace the patched PHP runtime.

What Should You Do After the Immediate Threat Is Contained?

Once the vulnerable systems have been patched and any suspected compromise has been investigated, use the incident to strengthen your long-term security practices.

Maintain a Reliable PHP Asset Inventory

Your team should be able to answer two questions quickly:

1. Where is PHP running across our infrastructure?

2. Which PHP version is each system using?

If answering these questions requires days of investigation, future security incidents will take longer to contain.

Maintain an inventory covering production systems, containers, CI environments, staging deployments, internal tools and third-party products. Where possible, automate version discovery and patch-status reporting.

Reduce Dependence on Exact Image Versions

Exact version pins can make builds reproducible, but they can also preserve vulnerable software indefinitely if nobody updates them.

Review how your organisation manages base images and runtime dependencies. Establish a process for reviewing security advisories, updating approved image versions, rebuilding affected applications and deploying patched images.

Do not assume that a moving image tag alone solves the problem. Verify the image contents and use a controlled update process that balances security, reproducibility and deployment reliability.

Strengthen Runtime Permissions and Network Controls

Security does not end with patching.

Restrict web-server processes to low-privilege users and grant them only the permissions required to perform their jobs.

Where possible, use role-based access and short-lived credentials instead of long-lived AWS access keys. Tighten outbound network rules so that compromised applications cannot freely communicate with systems and destinations they do not need.

These measures help reduce the potential impact if an application is compromised through this or another vulnerability.

Review PHP Support Lifecycles

PHP 8.2 is approaching the end of its security-support period. According to the source draft, security fixes for PHP 8.2 are scheduled to end on 31 December 2026.

As of 23 October 2026, that leaves approximately two months.

Organisations still using PHP 8.2 should plan their next upgrade rather than treating the immediate PHP2Shell patch as the end of their maintenance responsibilities.

A predictable upgrade schedule helps prevent supported applications from becoming security liabilities simply because their runtime was never updated.

PHP2Shell: The Priority Is to Patch, Verify and Investigate

PHP2Shell is a reminder that vulnerabilities in core infrastructure can affect an entire portfolio of applications, regardless of the frameworks or business logic built on top of it.

The immediate response is straightforward in principle: identify every PHP deployment, install the appropriate security update, restart and verify the runtime, rebuild vulnerable container images, and investigate evidence of earlier exploitation.

Where patching is delayed, restrict access and use carefully evaluated temporary mitigations. Do not rely on a WAF rule or configuration change as a complete fix.

Once the immediate risk is contained, strengthen asset visibility, dependency management, access controls and upgrade planning so that the next critical advisory does not become an infrastructure-wide scramble.

Security is not just about applying patches. It is about knowing what you run, knowing where it runs, and being able to respond before a vulnerability becomes a breach.