PHP has released emergency security updates to address two critical vulnerabilities known as PHP2Shell. These vulnerabilities could allow attackers to execute malicious code on affected servers without authentication.
The vulnerabilities affect PHP’s internal memory management and request handling. They may put websites, web applications and server data at risk if the PHP runtime has not been patched.
The vulnerabilities are tracked under the following identifiers:
CVE-2026-109618: Remote code execution caused by memory corruption during an out-of-memory condition.
CVE-2026-109619: Remote code execution caused by a use-after-free vulnerability involving stale internal state.
Both vulnerabilities have a CVSS v4.0 severity score of 9.2 out of 10.
The PHP security team has released patched versions for supported PHP branches. Website owners and server administrators should identify affected installations and apply the appropriate security updates without delay.
Important: Updating PHP is the only complete remediation. Temporary security measures may reduce exposure, but they do not fully protect an affected installation.
PHP is a widely used programming language that powers websites, content management systems, online shops and web applications. Platforms such as WordPress rely on PHP to process requests and generate website content.
PHP2Shell refers to two vulnerabilities in PHP’s internal request-processing mechanisms. Under certain conditions, these weaknesses can allow an unauthenticated attacker to execute code on a vulnerable server.
Because the vulnerabilities exist within the PHP runtime, they are not limited to a particular content management system or website application.
Websites using WordPress, custom PHP applications or other PHP-based platforms may be affected if their underlying PHP installation is vulnerable.
Updating website plugins, themes or application code alone will not fix these runtime vulnerabilities.
CVE-2026-109618: Out-of-Memory Memory Corruption
This vulnerability involves how PHP handles an out-of-memory condition during request processing.
A specially crafted HTTP request can trigger a memory allocation failure while PHP is still initialising internal request data. During error handling and cleanup, PHP may incorrectly process partially initialised data.
Under vulnerable conditions, this can cause memory corruption and potentially allow an attacker to execute arbitrary code with the privileges of the affected PHP process.
CVE-2026-109619: Use-After-Free and Stale Global State
This vulnerability involves PHP retaining a reference to internal request data after the memory associated with that data has been released.
If the internal state is not reset correctly, a subsequent request handled by the same worker may access the stale reference.
This use-after-free condition can lead to invalid memory access and potentially allow an unauthenticated attacker to execute malicious code.
Why Are These Vulnerabilities Serious?
Both vulnerabilities can be exploited remotely without requiring an attacker to log in to the affected website.
Depending on the server configuration and the privileges available to the PHP process, successful exploitation could lead to website compromise, unauthorised access to accessible data, malicious file changes or further attacks against the affected environment.
The level of risk may vary across PHP builds and server configurations. However, all internet-facing PHP installations should be assessed and patched as a priority.
The PHP security advisory identifies affected installations across PHP versions dating back to PHP 5.4. The following patched releases are available for the currently supported branches.
PHP Branch
Vulnerable Versions
Fixed Version
PHP 8.5
Before 8.5.12
8.5.12
PHP 8.4
Before 8.4.27
8.4.27
PHP 8.3
Before 8.3.36
8.3.36
PHP 8.2
Before 8.2.35
8.2.35
PHP 8.1 and older
Affected
Upgrade or apply a verified vendor-provided security backport where available
What About Older PHP Versions?
PHP 8.1 and older versions no longer receive regular upstream security updates from the PHP project.
Some Linux distributions, long-term support providers and other vendors may provide security fixes for older branches. PHP has also published limited source-level backports for certain legacy versions.
If you use an older PHP version, contact your hosting provider or software vendor to confirm whether a verified fix is available. Where an appropriate fix cannot be applied, upgrading to a supported PHP branch is strongly recommended.
Note: The fixed version numbers above refer to upstream PHP releases. A Linux distribution may backport a security fix without changing the PHP version displayed by your application. Always check the security status of the installed package with the relevant vendor.
Official advisory: https://www.php.net/archive/2026.php#2026-10-21-5
The vulnerabilities affect PHP installations serving web requests, including:
PHP-FPM
Apache with mod_php
php-cgi
FrankenPHP
LiteSpeed
This means the risk is not limited to one web server or hosting control panel.
The PHP security team has identified mod_php as a particularly high-risk configuration because a demonstrated exploit can trigger the vulnerability before application code runs.
Other configurations must also be assessed and patched as appropriate.
If you use shared hosting, reseller hosting, a VPS or a dedicated server, your next steps will depend on who manages the PHP runtime.
If an attacker successfully exploits a vulnerable PHP installation, the consequences may include:
Remote code execution: An attacker may execute malicious code with the privileges of the affected PHP process.
Website compromise: Website files, application logic or website content may be altered.
Data exposure: Information accessible to the compromised process may be at risk.
Unauthorised file changes: Attackers may attempt to upload or modify files on the server.
Further malicious activity: A compromised server may be used to carry out additional attacks, depending on its permissions and configuration.
The actual impact depends on the server environment, process privileges, application configuration and other security controls.
Running an affected PHP version does not automatically mean that your website has been compromised. However, leaving the vulnerability unpatched creates an avoidable security risk.
If you manage your website through cPanel, you can check the PHP version assigned to your domain.
Follow these steps:
Log in to your cPanel account.
Locate MultiPHP Manager or Select PHP Version, depending on your hosting environment.
Find your domain in the list of websites.
Check the PHP version currently assigned to your domain.
Compare it with the patched versions listed in this article.
For example, PHP 8.4.26 is older than the patched PHP 8.4.27 release and requires the appropriate security fix unless your provider confirms that a verified backport has been applied.
What If You Cannot Find Your PHP Version?
The available settings may differ depending on your hosting package and control panel.
If you cannot find the PHP version assigned to your domain, contact the host.co.in support team for assistance.
Important: Checking the version selected for your website does not necessarily confirm the security status of the underlying server package. The hosting provider may need to verify the installed package and running PHP processes.
Update your PHP runtime to a supported version containing the security fixes.
For supported upstream releases, the relevant fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Before upgrading, check that your website, CMS, plugins, themes and application dependencies support the selected PHP version.
If you use managed hosting, contact your hosting provider to confirm that the required security updates have been applied.
If you manage your own VPS or dedicated server, install the appropriate update through your operating system, package manager or hosting control panel.
After updating, ensure that the affected PHP workers and services have been restarted or reloaded so the patched runtime is running.
Keep your CMS, plugins, themes and other application components updated to their latest supported versions.
These updates help protect against separate application-level vulnerabilities. However, they do not replace the PHP runtime security patch required for PHP2Shell.
Step 3: Maintain Secure Backups
Maintain recent backups of your website files and databases.
Where possible, keep a separate copy of your backups in a location that cannot be modified directly from your hosting account.
Regular backups can help you recover from data loss or website damage, but they do not prevent an attacker from exploiting a vulnerable PHP runtime.
If your website was publicly accessible while running a vulnerable PHP version, consider reviewing it for signs of compromise.
Look for:
Unexpected changes to website files.
Unfamiliar scripts or files in website directories.
Unusual processes running under the PHP or web server account.
Suspicious outbound network connections.
Unexpected changes to user accounts or application settings.
Unusual errors or activity in web server, PHP and application logs.
The absence of these signs does not prove that a system is clean. If you suspect a compromise, contact your hosting provider or a qualified security professional for further investigation.
If compromise is suspected, isolate the affected system where necessary and preserve relevant logs and evidence before carrying out recovery work.
Use strong passwords, multi-factor authentication where available, and appropriate file permissions.
A web application firewall, request-size limits and other server-level controls may provide additional protection against certain attack paths.
However, these measures must not be treated as a complete solution to PHP2Shell. The underlying PHP runtime must still be patched.
If you manage your own server and cannot apply the security update immediately, follow the official PHP security advisory and assess the exposure of the affected system.
PHP documents certain temporary configuration changes that can reduce exposure to specific attack paths. Their suitability depends on the PHP version, application requirements and server configuration.
These measures do not eliminate the vulnerabilities and must not be considered a substitute for patching.
If the affected system cannot be secured promptly, restrict public access or take it offline until the appropriate fix can be applied.
If you use shared hosting, do not attempt to modify server-wide PHP settings yourself. Contact your hosting provider for assistance.
The steps you need to take depend on the hosting service you use.
Shared Hosting and Reseller Hosting
The PHP runtime and underlying server packages are generally managed by the hosting provider.
Check the PHP version assigned to your domain, where this option is available.
Keep your website software, plugins and themes updated.
Contact host.co.in support if you need confirmation of the server’s patch status.
Do not attempt to make server-wide configuration changes unless instructed by the support team.
VPS and Dedicated Servers
Your responsibilities depend on whether your server is managed or self-managed.
If your service includes managed server administration, contact your provider to confirm the status of the PHP security update.
If you manage the server yourself, identify all PHP installations and apply the appropriate package updates.
Check all PHP handlers, applications and environments, including those running in containers.
Restart or reload the relevant services and verify that the patched runtime is active.
Legacy PHP Applications
If your website requires an older PHP version, check whether the application supports a newer, patched release.
If it does not, consult your developer or hosting provider about compatibility, application updates and available security backports.
Do not assume that an unsupported PHP version is safe simply because the website continues to function normally.
PHP2Shell refers to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which could allow unauthenticated attackers to execute malicious code on vulnerable servers.
No. PHP2Shell affects the PHP runtime rather than WordPress itself. However, WordPress websites running vulnerable PHP installations may also be at risk.
No. Updating WordPress, plugins and themes helps protect against other security issues, but the PHP runtime must also receive the relevant security fix.
Yes. Successful exploitation may be possible without authentication. This is one of the reasons these vulnerabilities are rated critical.
Yes, if your PHP installation is affected and has not received the required security fix. A website may continue to work normally while running vulnerable software.
No. A web application firewall may help block some malicious requests, but it does not provide complete protection against these vulnerabilities. Updating PHP remains essential.
No. Using a vulnerable version does not prove that an attack has occurred. However, if your website was exposed while vulnerable, reviewing its logs and activity is advisable.
These versions no longer receive regular upstream security updates. You should upgrade to a supported, patched release or verify whether a suitable vendor-provided security backport is available.
This depends on your hosting package. Some control panels allow customers to select a PHP version, but this does not necessarily update the underlying server packages. Contact host.co.in support if you are unsure.
You can find the PHP security advisory and details of the patched releases on the official PHP website:
https://www.php.net/archive/2026.php#2026-10-21-5
PHP2Shell is a critical security issue that requires prompt attention from website owners and server administrators.
Identify the PHP version and hosting environment used by your website.
Apply the appropriate security update or confirm that a verified vendor backport is installed.
Keep your website software and application dependencies updated.
Review suspicious activity if your website was exposed while vulnerable.
Maintain secure backups and follow appropriate recovery procedures if a compromise is suspected.
Contact your hosting provider if you need assistance confirming your server’s security status.
For official technical details, refer to the PHP security advisory.
If you need help understanding your PHP version or hosting environment, please contact the host.co.in support team.
host.co.in recommends keeping your website software and hosting environment updated to help maintain the security, stability and reliability of your online presence.
Prathamesh Suryawanshi
