PHP2Shell: CVE-2026-109618 & CVE-2026-109619 — Critical PHP Security Guide

What is PHP2Shell, and who discovered it?

On October 21, 2026, the PHP security team published emergency fixes for two critical PHP runtime vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively called PHP2Shell. Wiz Research worked with the PHP security team on the coordinated disclosure; Google Cloud described the research collaboration. Both vulnerabilities have a CVSS v4.0 severity score of 9.2 (Critical). The issues affect PHP's internal request-processing mechanisms, not merely a particular WordPress plugin or CMS theme. A current CMS can still be exposed if the PHP engine serving it is vulnerable. Security agencies have reported exploitation attempts, but a vulnerable server should not automatically be described as compromised.

How do the two vulnerabilities work?

CVE-2026-109618 — Out-of-memory corruption

During certain memory-exhaustion conditions, PHP can abort request handling while request data is only partially initialized. Cleanup may then use invalid state, creating memory-safety conditions that can potentially enable remote code execution.

CVE-2026-109619 — Stale global state

Internal global references can remain linked to request memory after it has been freed. A later request handled by the same worker may interact with that stale state before initialization. Under exploitable conditions, this can also lead to remote code execution.

These are PHP runtime vulnerabilities. In vulnerable deployments, a remote attacker may not need to log in to the application. The impact generally begins within the privileges of the affected PHP process; further damage depends on permissions and other weaknesses.

What is the potential impact on websites and servers?

Successful exploitation could lead to unauthorized code execution, reading process-accessible information, application tampering, website defacement, malware placement, denial of service and further compromise where privileges or isolation are weak. Hosting providers should review account boundaries, application permissions and the impact on customers sharing infrastructure. Online shops, customer portals, APIs and business-critical applications deserve urgent attention. These are possible outcomes, not a claim that every vulnerable website has been hacked.

Which PHP versions need patching?

The first fixed upstream versions published on October 21 are shown below. Check the actual runtime used to serve requests, and verify any vendor-specific backported patches.

Commercial extended-support vendors may provide documented backports. Verify that their advisory explicitly covers both CVEs. An older package number alone does not establish whether a vendor backport is present or absent.

Which hosting environments are affected?

Audit PHP-FPM, Apache mod_php, php-cgi, LiteSpeed, FrankenPHP, container images and application-specific PHP runtimes. cPanel/CloudLinux installations may use EasyApache PHP and Alt-PHP simultaneously. Plesk, Webuzo and Windows hosting can also expose multiple installed handlers. A command-line php -v check is not sufficient: different domains may run different PHP binaries. Confirm the web-serving runtime and vendor package release for every application.

What should administrators do immediately?

1. Inventory all PHP handlers: identify domains, pools, application containers and internet-facing installations.
2. Apply fixed PHP releases: install 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later, or a documented vendor-patched build.
3. Restart PHP workers safely: follow hosting-vendor instructions to ensure active processes load the corrected binaries.
4. Verify each website's runtime: inspect actual handlers, package revisions and loaded configuration.
5. Investigate possible compromise: examine suspicious requests, process crashes, unusual files, child processes and access logs; preserve evidence where warranted.
6. Harden and monitor: review least privilege, account isolation, WAF rules, malware monitoring, backups and credentials.
7. Plan legacy upgrades: migrate end-of-life applications to supported PHP with staging-based compatibility remediation.

What if your website breaks on newer PHP?

WordPress, Joomla, Drupal, e-commerce systems and custom PHP websites may rely on removed functions, obsolete database interfaces, outdated plugins or unsupported frameworks. Upgrading PHP without application testing can break checkout, forms, logins and integrations. HostGree's PHP Upgrade & Compatibility service uses an isolated staging copy to identify issues, update code and dependencies, test business workflows and coordinate deployment after approval. Some complex applications may require partial redevelopment.

How HostGree can help server and website owners

Server owners and hosting companies

HostGree offers PHP runtime inventory, security audits, vendor patch verification, server hardening, malware investigations and ongoing administration for supported cPanel, CloudLinux, Plesk, Webuzo and web-server stacks. See Security Audits & Hardening and Managed Server Administration.

Website owners and development teams

Our PHP developers and security specialists can assess custom PHP, WordPress, Joomla and framework applications, repair compatibility issues and test upgrades in isolated staging environments. See PHP Upgrade & Compatibility. Assessment and project prices are individually quoted.

Frequently asked questions

Is WordPress itself responsible for PHP2Shell?

No. These vulnerabilities affect the underlying PHP runtime, although WordPress websites can be exposed through it.

Does disabling session upload progress fully protect me?

No. It addresses a particular attack path and is not a substitute for fixed PHP releases.

Is PHP 8.2 safe?

PHP 8.2.35 or later contains the upstream fixes for these CVEs; earlier builds require verified vendor backports or updates. Plan ahead for PHP 8.2's approaching support end.

Does a patched server prove no compromise occurred?

No. Patching closes the known issue going forward; investigate any signs of earlier exploitation.

Do I need to move my hosting to HostGree?

No. We can assist on compatible third-party hosting environments where authorized access is available.

Official references and research

• PHP project security releases, October 21, 2026
• PHP project session upload progress notice, October 23
• Bangladesh e-GOV CIRT advisory
• AWS security bulletin with fixed version details
• Google Cloud research and response
• New Zealand NCSC security alert

Information reviewed October 29, 2026. Follow the latest PHP and vendor security advisories as guidance evolves.