Blog Details

• Written by: Develenza
• October 23, 2026
• Categories: Uncategorized
• Tags:

PHP2Shell: Critical PHP Security Vulnerabilities Put Websites at Risk in 2026

Published: October 23, 2026
Category: Cybersecurity, PHP, Web Development
Reading time: 6 minutes

Introduction

A major security incident has put PHP-based websites under the spotlight. On October 21, 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities that could allow attackers to execute malicious code on affected servers without authentication.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are associated with the name PHP2Shell. They affect PHP itself rather than a specific framework or content management system, which makes this issue particularly important for developers, hosting providers, and website administrators.

On October 23, the PHP team also published an advisory about another potential remote code execution issue, CVE-2026-115560, affecting applications with a specific combination of session settings.

For anyone managing a PHP application, WordPress website, Laravel project, or ecommerce platform, understanding these developments is essential.

What Is the PHP2Shell Vulnerability?

PHP is one of the most widely used programming languages for web development. It powers websites, APIs, ecommerce stores, content management systems, and many business applications.

PHP2Shell refers to two critical flaws discovered in PHP’s internal request and memory-handling mechanisms.

According to the PHP security advisory, both vulnerabilities received a CVSS v4.0 severity score of 9.2 out of 10.

The vulnerabilities are:

• CVE-2026-109618: Remote code execution associated with out-of-memory handling and memory corruption.
• CVE-2026-109619: Remote code execution associated with stale internal state that can persist after memory has been freed.

These flaws can create opportunities for attackers to manipulate server execution, potentially compromise a website, and access sensitive information.

The PHP team released security fixes on October 21, 2026. Website owners should treat these updates as a priority.

How Do These Vulnerabilities Work?

1. Memory corruption during out-of-memory handling

PHP enforces memory limits to prevent individual requests from consuming excessive resources. One vulnerability involves how PHP handles certain out-of-memory conditions.

Under specific circumstances, an error can interrupt request processing while internal data is only partially initialized. Subsequent cleanup operations may then handle invalid data incorrectly.

This behavior can potentially lead to memory corruption and remote code execution.

2. Stale internal state after a fatal error

The second vulnerability concerns internal request state that can remain accessible after its associated memory has been released.

If a subsequent request handled by the same worker encounters this stale state before it has been properly reset, an attacker may be able to exploit the condition.

The important point is that these vulnerabilities exist in PHP’s underlying implementation. Updating application code alone is not sufficient to fix a vulnerable PHP runtime.

Source: Official PHP security advisory — https://www.php.net/

Which PHP Versions Are Affected?

The October 21 emergency release identifies the following patched versions:

Earlier releases in these branches are affected by the PHP2Shell vulnerabilities. PHP 8.1 and older branches also require attention because they no longer receive standard upstream security updates; some vendors may provide backported fixes.

The PHP team has also published limited source backports for certain older branches. Check with your operating system or hosting provider to establish whether your installed build includes the relevant fixes.

Important: PHP 8.2 reaches end of life on December 31, 2026. If your application still uses PHP 8.2, plan a migration to a supported branch as well as applying the security update.

A New PHP Security Advisory on October 23

The PHP2Shell emergency patches are not the end of the story.

On October 23, the PHP team published an informational advisory for CVE-2026-115560, describing another potential remote code execution path.

This issue requires an unusual configuration: an application must change its session serialization handler at runtime before starting a session, while session upload progress remains enabled.

The PHP team recommends disabling session upload progress until a routine bug-fix release addresses the issue.

Set the following directive in the applicable PHP or server configuration:

session.upload_progress.enabled=0

Apply the setting at the appropriate server configuration level and restart the relevant PHP workers where necessary. Do not rely on changing the setting inside application code after request processing has already started.

This newer advisory is separate from the two PHP2Shell vulnerabilities, and the October 21 patches should not be assumed to resolve it.

The PHP team describes the required configuration as uncommon. Applications that never switch the session serialization handler at runtime are not exposed through this particular attack path.

Source: https://www.php.net/

How to Protect Your PHP Website

If you manage a production website, follow these steps.

Step 1: Identify your PHP version

From a terminal, run:

php -v

This displays the PHP version used by the command-line interface.

However, your website may use a different PHP version through PHP-FPM, Apache, LiteSpeed, or a hosting control panel. Verify the version serving actual web requests.

Step 2: Update PHP immediately

Upgrade to the appropriate security-fixed version through your hosting provider, operating system package manager, or PHP installation process.

For production environments, test application compatibility in staging first where feasible, then deploy the security update as quickly as possible.

If your provider has not yet made a suitable patched package available, contact its support team immediately and follow official security guidance.

Step 3: Disable session upload progress if appropriate

Configure the following directive as an interim precaution:

session.upload_progress.enabled=0

This addresses a recommended mitigation for the stale-state vulnerability and the additional October 23 advisory. It is not a substitute for installing the PHP2Shell security updates.

Step 4: Review server logs and security alerts

Check web server, PHP-FPM, application, firewall, and intrusion detection logs for unusual requests, unexpected errors, unexplained process activity, or suspicious changes to files.

Investigate indicators of compromise and preserve relevant logs. Do not assume that a website is safe simply because it remains online or shows no obvious symptoms.

Step 5: Check your dependencies

Review your Laravel, WordPress, WooCommerce, and other PHP application dependencies for available security updates.

Although the reported flaws are in PHP itself, keeping frameworks, plugins, themes, and libraries updated helps reduce additional attack paths.

Step 6: Review backups and recovery procedures

Ensure that backups are recent, stored securely, and restorable. If you discover evidence of a compromise, consider isolating the affected server, preserving forensic evidence, rotating exposed credentials, and rebuilding from a known-clean environment where necessary.

What About WordPress and Laravel Websites?

PHP2Shell is particularly relevant to developers who maintain popular PHP-based platforms.

WordPress: Update the server’s PHP runtime, then review WordPress core, plugins, and themes. Updating WordPress alone does not patch the underlying PHP engine.

WooCommerce: Ecommerce websites can contain customer details, order records, and other sensitive information. Prioritize the runtime update, review logs, and confirm that backups and recovery procedures are working.

Laravel: Check the PHP version used by the web server and PHP-FPM, not just your local development environment. Deploy the relevant runtime update and test application functionality after the change.

Custom PHP applications: Review server configuration, dependencies, request handling, and session-related settings. Remember that application-level input validation cannot independently eliminate a vulnerability in the PHP runtime.

Why This Incident Matters to Developers

This incident is a reminder that application security extends beyond the code developers write.

Even a carefully developed application can inherit significant risk from its runtime, operating system, dependencies, or hosting environment.

Developers and engineering teams should maintain an inventory of deployed PHP versions, establish a regular patching process, monitor official security advisories, and maintain tested recovery procedures.

For organizations operating multiple applications, automated asset discovery and dependency monitoring can help identify vulnerable environments before they become a larger incident.

Final Thoughts

The PHP2Shell vulnerabilities demonstrate how flaws in foundational software can affect a broad range of websites and applications.

The immediate priority is to install the appropriate PHP security updates, verify the runtime used by production traffic, and apply the additional session configuration precaution where relevant. Teams should also review their logs and investigate any signs of compromise.

Security is not a one-time task. Regular patching, careful configuration, monitoring, and tested backups remain essential parts of running a reliable web application.

If you maintain a PHP-based website, check your production PHP version today and confirm that the relevant security fixes have been applied.

Official References

1. PHP security advisories and release information: https://www.php.net/
2. CERT-EU advisory on critical PHP vulnerabilities: https://cert.europa.eu/publications/security-advisories/2026-018/
3. Wiz Research analysis of PHP2Shell: https://www.wiz.io/blog/php2shell-php-rce

Disclaimer: This article is for informational purposes. Verify affected versions, available patches, and mitigation instructions against the official PHP advisories and your hosting provider’s guidance before making production changes.