PHP2Shell on Your Servers: Finding, Patching and Verifying Every PHP Runtime

Two critical PHP bugs fixed on 21 October 2026, CVE-2026-109618 and CVE-2026-109619 (together called PHP2Shell), can be chained for unauthenticated code execution on a web server. AlmaLinux scores both 9.2 on CVSS v4.0, and an exploitation attempt was recorded on 17 October, before public disclosure. If you run PHP anywhere, this is a runtime upgrade, not an application update.

What is affected

• Any PHP serving web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed
• mod_php is the most exposed setup; remote code execution was also confirmed on PHP-FPM for CVE-2026-109619
• CVE-2026-109618: memory corruption when a request hits the per-request memory limit (a crafted multipart upload can trigger it)
• CVE-2026-109619: stale state surviving between requests on the same worker, leading to a use-after-free
• Updating WordPress, Drupal, Laravel or plugin code does nothing here

A practical patch flow

• Build an inventory: prod sites, staging boxes, admin panels, old microsites and vendor appliances that bundle PHP
• Record the exact PHP version on each host or image, and get it in writing from managed hosting providers
• Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your distro's patched package (source backports exist for 7.4, 8.0 and 8.1)
• Restart PHP-FPM or the web server so workers load the new binary, then confirm the running version

If you cannot patch today

• Disable session upload progress
• Lower upload and memory size limits
• Remove per-directory settings that throw warnings
• Put updated WAF rules in front of the app
• For public systems that stay unpatched, follow FBI and UK NCSC advice and consider taking them offline

What to look for in logs

• PHP worker processes spawning command shells
• PHP processes downloading files
• Preserve logs before cleanup if anything looks off. In India, check whether the CERT-In six-hour incident reporting rule applies to you.

More detail: PHP2Shell patch guide for Indian website owners

Written by the team at Affix Center, an IT services company in Lower Parel, Mumbai.