php2shell
Menu

PHP2Shell is fixed.
Is your PHP?

Two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, were fixed on 21 October 2026. Paste your php -v output to see where you stand.

Check your version
Version checkRuns in your browser
Example. Replace it with your own output

Affected. Upgrade to 8.3.36.

Then restart every PHP worker.

php -v shows the command-line build. Your web server may run a different one. Ask php-fpm8.3 -v, or open phpinfo() through the site.

Steps for PHP 8.3

Fixed releases21 Oct 2026

PHP 8.58.5.12
PHP 8.48.4.27
PHP 8.38.3.36
PHP 8.28.2.35
PHP 8.1source backport
PHP 8.0source backport
PHP 7.4source backport
PHP 7.3 and olderno fix

Where the flaws sit

Both flaws are in PHP, not your code. Upgrade it, restart the workers and every site on the server is fixed.

RequestGET /index.phpWeb serverApache · nginx · LiteSpeedBoth flaws are herePHPCVE-2026-109618CVE-2026-109619mod_php · PHP-FPM · php-cgiUpgrade + restart fixes every siteYour codeWordPress · Laravel · your ownGET /index.phpRequestGET /index.phpWeb serverApache · nginx · LiteSpeedPHPBoth flaws are heremod_php · PHP-FPM · php-cgiYour codeWordPress · Laravel · your ownUpgrade + restart fixes every site
Severity
Critical, CVSS v4.0 9.2, both
Reached through
Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed
Highest risk
mod_php: no login needed, triggered before your code runs
In the wild
Not reported in the official advisories as of 22 Oct 2026

Every branch, one row

Find your branch and read the version that fixes it. Anything older on that branch is affected.

  • Patched release
  • Source backport only
  • No official fix
  • Checked 22 October 2026

Bar ends where php.net support ends

Versions from the php.net announcement and both advisories. Lifecycle dates from php.net supported versions. The full table is on the status page.

20222023202420252026202720282029203022 October 2026

Until you can upgrade

These reduce exposure. They don’t make you safe, and the PHP project says upgrading is the only safe choice.

At the proxy, too

In front of PHP, cap request size, field count, multipart parts, header count and nesting depth. Include requests that arrive without Content-Length.

On PHP 8.5, also set fatal_error_backtraces = 0. Never use RLIMIT_AS or RLIMIT_DATA. Failed allocations are the path this flaw takes. Source: GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.

/etc/php/8.3/fpm/pool.d/www.confedited
[www]; existing pool settings stay as they are
; CVE-2026-109618, reduces exposurephp_admin_value[memory_limit] = -1

No memory ceiling

CVE-2026-109618 starts when a request runs out of memory. Lock it with php_admin_value so scripts can’t lower it again.

php_admin_value[post_max_size] = 8Mphp_admin_value[upload_max_filesize] = 4M

Small request bodies

8M without uploads, 32M with them. Keep upload_max_filesize below post_max_size.

php_admin_value[max_input_nesting_level] = 16

Shallow input

Lower the nesting limit for form and query arrays. 16 is an example, so test it against your app.

; CVE-2026-109619, reduces exposurephp_admin_flag[session.upload_progress.enabled] = off

Upload progress off

The switch for CVE-2026-109619. Set it here or in php.ini, never with ini_set() or .user.ini. Leave it off after patching.

php_admin_flag[log_errors] = onphp_admin_value[error_log] = /var/log/php8.3-fpm.www.log

Keep the evidence

Log every error to a file you actually read, and set error_reporting = E_ALL in php.ini. A clean log proves nothing.

; optional, costs throughputpm.max_requests = 1

One request per worker

Optional and slow. Each worker exits after one request, so no state carries over.

; then restart every worker$ sudo systemctl restart php8.3-fpm

The free fix

  1. First, read your version.

    php -v reports the command-line build. Ask the binary your web server runs, or open phpinfo() through the site.

  2. Then upgrade the package.

    Take your distribution’s patched package, or build the fixed release from php.net. Its changelog should name both CVEs.

  3. Finally, restart every worker.

    Running workers keep the old PHP in memory until they restart. With mod_php, restart Apache instead.

web-01bash

1 of 3 · your version

$ php-fpm8.3 -v
PHP 8.3.30 (fpm-fcgi) (built: Oct  2 2026 09:14:52)
Copyright (c) The PHP Group
Zend Engine v4.3.30, Copyright (c) Zend Technologies

2 of 3 · the package

$ sudo apt update
$ sudo apt install --only-upgrade 'php8.3-*'
The following packages will be upgraded:
  php8.3-cli php8.3-common php8.3-fpm php8.3-opcache
4 upgraded, 0 newly installed, 0 to remove.
Setting up php8.3-fpm (8.3.36-1) ...

3 of 3 · every worker

$ sudo systemctl restart php8.3-fpm
$ php-fpm8.3 -v
PHP 8.3.36 (fpm-fcgi) (built: Oct 21 2026 18:40:07)

Where you run PHP
decides the next step

Ask a person

Own server

FreeUpgrade PHP 8.3Package, restart, verifyFreeUpgrade PHP 8.2Ends 31 Dec 2026FreeCheck the running buildAfter patchingPaidWe patch it with youScope in writing, then invoice

Shared hosting

FreeAsk your host three questionsWhich build, patched whenFreeSwitch to a fixed versionIf your panel offers oneFreeOld version stuck on the hostYour optionsPaidRead the host’s answer with youShort call, fixed price

WordPress

FreeCheck the PHP versionSite Health, two clicksFreeChange the PHP versionIn the host panelFreeNot a WordPress bugThe fix is in the PHP underneathPaidUpgrade with a personPlugins checked first

PHP 8.1 or older

FreePHP 8.1Source backport onlyFreePHP 7.4Ended 28 Nov 2022FreeExtended support, comparedVendors that patch old PHPPaidPlan the move to 8.3+Scoped migration help
php8.3-fpmpool wwwBefore restartAfter restart8.3.308.3.368.3.308.3.368.3.308.3.368.3.308.3.36$ systemctl restart php8.3-fpm
The new package does nothing until every worker restarts.

Read the sources

Every fact here links to where it came from and says when we last checked it. Where sources disagree, we say so. The ChangeLog dates 8.5.12 and 8.4.27 to 22 October, the announcement to 21 October. We last checked all of them on 22 October 2026.

php.netThe release announcement, with the fixed versionsGHSA-w8hwCVE-2026-109618: memory corruption after running out of memoryGHSA-6wmfCVE-2026-109619: stale state carried between requestsChangeLogWhat changed in each 8.x releaseLifecyclesWhich branches still get security fixes, and until whenOur logEvery change we make to these pages, dated

Need a person to do it?
Tell us what you run.

Don’t paste passwords, SSH keys or API keys. We usually reply during working hours (CET). Paid work is scoped in writing and invoiced. We don’t do incident response.

Hours
Monday to Friday, 9:00–18:00 CET
Billing
Written scope first, then an invoice