PHP2Shell Explained: Two Critical PHP Flaws, the Fixed Versions and What to Patch First PHP2Shell means two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. Affected versions, fixed releases, attempts since 17 Oct and what to patch first.
PHP2Shell Explained: Two Critical PHP Flaws, the Fixed Versions and What to Patch First
PHP2Shell is the name for two flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619 . The PHP team scores both 9.2 (Critical) on CVSS v4.0 and says an unauthenticated attacker may be able to run code on the server when the right conditions are met. The only complete fix is to update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 , released on 21 October 2026 (PHP's announcement ). PHP 8.1 and older get no official release: the PHP security team published minimal source backports for 7.4, 8.0 and 8.1, some vendors ship backported packages, and the other route is upgrading.
The urgency comes from timing. Amazon Threat Intelligence saw a PHP2Shell exploitation attempt on its own honeypot on 17 October , four days before the patches. Amazon says it is unclear whether any of these attempts would have succeeded against real systems, and none of the sources reviewed for this article reports a confirmed compromise.
The facts in one table
Name PHP2Shell CVEs CVE-2026-109618 (RCE via out-of-memory corruption) and CVE-2026-109619 (RCE via stale global state) Score CVSS v4.0 9.2 Critical for both (PR:N means no login needed; AC:H and AT:P mean high attack complexity and specific conditions on the target) What an attacker gets Code execution without logging in, with the privileges of the web worker running PHP Patches released 21 October 2026, 14:00 UTC Fixed versions 8.5.12, 8.4.27, 8.3.36, 8.2.35 (no official release for 8.1 and older) Affected setups Any PHP serving web requests: mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. PHP rates mod_php highest risk
Is this a WordPress or Laravel bug?
No, it sits in PHP itself. Sansec, which analysed it, says the bugs are in the PHP engine, so applications are affected even when their own code is clean. Updating WordPress, Laravel or an in-house app alone does not fix an unpatched PHP underneath.
What has to be true for an attack to land
Per AWS and the PHP project, the weak spot is how PHP parses multipart/form-data requests before your application code starts, so having an upload form or not is not the dividing line. The two CVEs need different conditions:
CVE-2026-109618 on mod_php is the confirmed worst case. PHP's advisory says an unauthenticated request can trigger it before application code runs, and code execution was validated on Apache mod_php with default limits and prefork workers. On PHP-FPM the statements about this CVE differ: the advisory calls FPM susceptible from source analysis with no complete exploit shown, while the PHP Foundation says code execution was confirmed on FPM through application-level code paths. Do not treat FPM as safe.CVE-2026-109619 needs two requests on the same worker: a producer that leaves stale state behind and a consumer that uses it before normal initialisation. Confirmed producer examples are session upload progress, enabled by default and triggered through the PHP_SESSION_UPLOAD_PROGRESS form field; and, on PHP 8.5, fatal_error_backtraces when enabled. These are examples, not a full trigger list.
How hard exploitation is remains disputed: Sansec reported on 22 October that the public proofs of concept it tried failed against a default PHP install. That is no reason to wait; PHP still says update.
Which versions are affected?
PHP branch Status What to do 8.5.x Fixed in 8.5.12 Update to 8.5.12 or later 8.4.x Fixed in 8.4.27 Update to 8.4.27 or later 8.3.x Fixed in 8.3.36 Update to 8.3.36 or later 8.2.x Fixed in 8.2.35; branch ends 31 December 2026 Update to 8.2.35, then plan a branch move 8.1 and older No official release A vendor-backported package, or PHP's minimal source backport (7.4, 8.0 and 8.1 only); for anything older, a verified vendor fix or a migration
After applying the fix, restart all PHP workers, as watchTowr advises. This is separate from the restart after the configuration changes further down.
Two things the table cannot show:
The CVE records list only 8.2 to 8.5 , which does not make 8.1 and older safe; they just have no official release. Tenable, citing the reporter's write-up, says the vulnerable code goes back to PHP 5.4.0 (third-party analysis, not a PHP statement).Check the package's patch status, not only the version number. Distributions and LTS vendors received the patches in advance, so a distro package can carry the fix under an older version number, while Sansec reports the official php Docker image has no fix for 8.1 or older.
Before any of that, you need to know where PHP runs. A host-by-package inventory with an end-of-life view shows which hosts carry PHP, which version, and which branches are past support (8.1 and older) or ending soon (8.2, on 31 December 2026). In zcrX , Agents on hosts report host and package findings matched to CVE advisories, with CISA KEV and EPSS context, and the product tracks lifecycle and end-of-life per software product. This article does not claim zcrX detects PHP2Shell or lists these two CVEs.
Is it being exploited yet?
The timeline as reported by Amazon, the PHP team and researchers (UTC):
17 Oct Amazon sees the first attempt in MadPot, its honeypot network, from a commercial anonymisation network.20 Oct The CVE IDs leak with a wrong score of 10.0, PHP brings the release forward a day, and the reporter accidentally publishes a video of a working proof of concept.21 Oct, 02:00 to 08:00 Amazon identifies the earliest of several proof-of-concept exploits.21 Oct, 14:00 Patches ship. The PHP team had found no functional exploits yet; more proofs of concept appear within hours.
Amazon sees "broad exploitation attempts in the wild" but says it is unclear whether any would have succeeded against real systems. Canada's Cyber Centre (21 October) had not identified active exploitation, neither CVE was in CISA's Known Exploited Vulnerabilities catalog on 22 October (watchTowr), and Dataminr saw only scanning and non-working exploits. None of the sources reviewed reports a confirmed compromise.
Amazon also advises investigating from 17 October, not from the disclosure date, and logs deleted after a few days can prevent you from reviewing that period. Keeping logs long enough is the core job of zcrLog , with retention settable from 90 days to 2 years. Retention alone is not PHP2Shell evidence: a standard access log normally does not record request bodies, so what you can check depends on the fields you collected. This article does not claim zcrLog collects Apache or PHP-FPM logs.
What to patch first
Canada's Cyber Centre, the NCSC and watchTowr agree on starting with internet-facing systems. The order below builds on that and PHP's own risk ranking; it is not official.
Internet-facing servers running Apache with mod_php , which PHP rates highest risk.Other public sites that accept request bodies or uploads , on PHP-FPM, FrankenPHP or LiteSpeed.Products, appliances and containers that bundle PHP , which Canada's Cyber Centre and the NCSC both flag. Ask the vendor.Anything on PHP 8.1 or older. Use a vendor-backported package or PHP's source backport (7.4, 8.0 and 8.1 only); for anything older, a verified vendor fix or a migration. If neither lands in time, the NCSC says to consider taking the system offline.Internal systems with no internet exposure. Later, but not never.
If this checklist shows you have no host-by-version list yet, the pricing page covers software that helps with that, though patching itself does not wait for any purchase.
Amazon tells leadership to measure patch time in hours, not days, for critical flaws in internet-facing systems. If you cannot patch yet, PHP says no configuration makes you safe. Setting session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0 in php.ini, the FPM pool or server configuration (not ini_set() or .user.ini), then restarting every PHP worker, reduces risk only in part; fatal_error_backtraces=0 removes only the confirmed fatal-backtrace path.
"We have a WAF" is not "we are patched"
No. A WAF filters incoming requests while the vulnerable PHP stays where it was. AWS's own guidance is unusually clear about this. Its managed rule PHP2Shell_BODY (AWSManagedRulesPHPRuleSet version 2.3) targets CVE-2026-109619; for CVE-2026-109618 it recommends the SizeRestrictions_BODY rule from its Core rule set. The post also says some conditions live in server configuration, outside AWS WAF's scope, that AWS WAF does not parse inside multipart bodies, and that with file uploads it reduces risk without closing the vulnerability. AWS concludes that upgrading PHP is the only complete fix, and Sansec says the attack runs inside PHP before application code or its own Sansec Shield product sees anything. Requests that bypass a WAF are also not screened by it, a point Tenable makes about Cloudflare's rules.
zcrWAF screens website and API traffic before it reaches your origin, supports custom Allow, Block or Challenge rules and keeps security logs. This article does not claim zcrWAF detects or blocks PHP2Shell, and no WAF replaces a patch. If your public sites have nothing in front of the origin, it is worth weighing alongside patching: zcrWAF comes as Cloud/SaaS, Virtual Appliance or ICT Hardware Appliance, priced as a scoped quote, and product screens are on the demo page . For the basics, read What Is a WAF? and OWASP Top 10 and the WAF .
What this article cannot tell you
It cannot say whether your site is already compromised; that takes the logs, files and processes on the real server. It cannot say whether circulating proofs of concept work against your configuration. Separately, no source reviewed publishes a count of compromised sites. All of this is as of 23 October 2026; check php.net again before you decide.
The PHP2Shell series
This is the overview. The rest go deeper on each job:
Find out which PHP version every site, container and host really runs What a WAF can and cannot do before you patch PHP2Shell Hunting for signs of attack in web server and PHP-FPM logs A PHP site may already be compromised: webshells, containment and evidence
To talk to zcr about the software, or to ask for an introduction to a partner, contact us . Hands-on assessment, patching and incident response are delivered through partners.
Sources
PHP security release: 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — PHP project announcements of 20 and 21 October 2026, accessed 2026-10-23.GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) — php-src advisories, 21 October 2026, accessed 2026-10-23.Today's PHP Security Release — PHP Foundation, 21 October 2026, accessed 2026-10-23.Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot — CJ Moses, AWS Security Blog, 21 October 2026, accessed 2026-10-23.Using AWS WAF to apply mitigations for PHP2Shell — AWS Security Blog, 21 October 2026, updated 22 October, accessed 2026-10-23.PHP2Shell FAQ — Tenable, updated 22 October 2026, accessed 2026-10-23.PHP2Shell: PHP RCE — Sansec, updated 22 October 2026, accessed 2026-10-23.PHP CVE-2026-109618 FAQ — watchTowr, updated 22 October 2026, accessed 2026-10-23.AL26-026 Critical vulnerabilities impacting PHP — Canadian Centre for Cyber Security, 21 October 2026, accessed 2026-10-23.Critical security issue affecting PHP — UK NCSC, 21 October 2026, accessed 2026-10-23.Amazon says PHP2Shell exploitation began 4 days before patches — BleepingComputer, 22 October 2026 (Dataminr findings), accessed 2026-10-23.
Related articles
Continue with these related guides for background:
Related product
See zcrWAF , zcrX and zcrLog for the product scope, the pricing page for published prices, and the deployment requirements to confirm with your delivery partner.
Products | Pricing | Resources | Insights | Contact 