PHP2Shell (CVE-2026-109618 & CVE-2026-109619): The Critical PHP RCE Flaws and How to Patch Every Panel

TL;DR: Two critical PHP vulnerabilities — nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2) — let an unauthenticated attacker run code on your server before your application even executes. Exploitation attempts began four days before the patches were released, and public exploits are now available. Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (plus source backports for 7.4–8.1). Update PHP today, then restart PHP-FPM or Apache — without a restart, the vulnerable code keeps running.

If you run a web server, drop everything and patch PHP. On October 21, 2026, the PHP project released an emergency update for two critical vulnerabilities that allow unauthenticated remote code execution (RCE) on any PHP installation serving web requests. Security researchers have already nicknamed the flaw pair PHP2Shell, exploitation attempts in the wild predate the official patches, and public exploit code is circulating. This article explains what the vulnerabilities do, which versions are affected, and exactly how to patch on cPanel/WHM, Plesk, DirectAdmin, CloudLinux and plain Linux servers.

What Happened on October 21

The PHP project shipped emergency fixes for CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale (an earlier score of 10.0 that circulated before release was incorrect, per the PHP Foundation). Unlike a typical application vulnerability, these flaws live in the PHP engine itself — so every hosted site, CMS, framework and script on a server inherits the exposure until the interpreter is patched.

The disclosure was bumpy by design: security firm watchTowr confirmed and reproduced CVE-2026-109618 ahead of the release, a screenshot of an exploit tool credited to Calif.IO leaked, and analysts at Sansec predicted mass exploitation would begin within minutes of the patch landing — on the logic that attackers can simply reverse-engineer the fix. The prediction was conservative: according to Amazon Threat Intelligence, exploitation attempts were already recorded on October 17 — four days before public disclosure — and multiple public exploits are now available.

The Two Vulnerabilities Explained

CVE-2026-109618: RCE via out-of-memory corruption

When PHP hits a memory limit mid-request, it aborts request processing. The flaw is in how that abort happens: under specific out-of-memory conditions, PHP can abandon a request while leaving exploitable memory corruption behind, which an attacker can steer toward code execution. PHP’s partial mitigation is to make memory_limit=-1 non-overridable — a hint at where the bug lives.

CVE-2026-109619: RCE via stale global state

The second flaw lets request data survive into a state where it should have been discarded — “stale global state” — and turn it into code execution. It involves PHP’s session upload-progress mechanism, which is why the interim mitigation is setting session.upload_progress.enabled=0 (and, on PHP 8.5, fatal_error_backtraces=0). Neither mitigation makes an installation safe; both only shrink the attack surface until you patch.

Are You Affected?

Almost certainly yes, if you serve PHP over the web. The affected code path dates back to PHP 5.4.0, and every server-side PHP execution mode is exposed:

Only the currently supported branches receive fixed releases: 8.2, 8.3, 8.4 and 8.5. The earliest affected code path found so far dates to PHP 5.4, which makes this one of the widest-reaching PHP disclosures ever.

Exploitation Started Before the Patches Did

This is what elevates PHP2Shell from “patch this week” to “patch today”:

• October 17, 2026 — Amazon Threat Intelligence records exploitation attempts, four days before public disclosure.
• Pre-release — watchTowr independently reproduces CVE-2026-109618 and confirms the flaws are real; a screenshot of an exploit tool credited to Calif.IO leaks.
• October 21, 2026, 14:00 UTC — PHP releases the fixes. Sansec had predicted mass exploitation within 15 minutes of the patch, on the expectation attackers would diff the source.
• Now — Rapid7 and CERT-EU confirm multiple public exploits; Tenable reports the flaws are being “broadly exploited in the wild.”

The practical conclusion: treat every unpatched, internet-facing PHP server as a target that is actively being probed, and review your logs for signs of compromise (checklist below) after you patch.

Fixed PHP Versions

The PHP security team published minimal source-code backports for PHP 7.4, 8.0 and 8.1 — but only for building from source. If you run EOL branches through your control panel or OS packages, your vendor decides how the fix reaches you (cPanel backports it into EasyApache; CloudLinux sells extended support for old PHP; plain distros generally do not backport security fixes to EOL PHP). Plan an upgrade to a supported branch regardless — 8.2 reaches end of life on December 31, 2026.

How to Patch: Every Panel and Platform

cPanel/WHM (EasyApache 4)

The fix ships in EasyApache 4 25.91 — cPanel released it the same day, with the PHP backports for every packaged branch (7.4 through 8.5). Run the cPanel update now:

sudo /scripts/upcp --force
# then restart PHP-FPM / Apache and verify versions (see below)

Full details are in our advisory: EasyApache 4 25.91 — the PHP2Shell fix plus 14 curl CVEs. Release notes live at docs.cpanel.net. If you run cPanel/WHM licenses through us, the update path is unchanged — upcp delivers everything.

Plesk

Updates for Plesk Obsidian are already available — apply them from the Plesk panel (Tools & Settings → Update), then restart PHP handling. Plesk manages multiple PHP versions per server, so verify each registered PHP version afterwards.

DirectAdmin / CustomBuild

On DirectAdmin, PHP usually comes through CustomBuild: run cd /usr/local/directadmin/custombuild && ./build update_versions, then ./build php (or let update_versions handle it) and restart Apache/PHP-FPM. If you use the distribution’s PHP package instead, patch via the OS (below).

CloudLinux (Alt-PHP)

Follow the CloudLinux status page and blog for Alt-PHP rollout — CloudLinux also offers extended support for PHP versions that are past upstream EOL, which is the cleanest path for licensed legacy branches. See CloudLinux licensing if you are setting this up.

Plain Linux servers (Debian, Ubuntu, AlmaLinux, Rocky, RHEL)

Track your distribution’s security advisories and pull the patched package:

# RHEL-family
sudo dnf update php*
# Debian/Ubuntu
sudo apt update && sudo apt upgrade php*

Third-party repositories

The volunteer-maintained rpms.remirepo.net did not provide updates on release day — the PHP project recommends switching to distribution packages or building from source with the official backports if you depend on Remi.

Restart and Verify — the Step Everyone Skips

Updating the package does nothing on its own: running workers keep executing the old, vulnerable PHP code until they are restarted. After updating:

1. Restart PHP-FPM (systemctl restart php-fpm / the panel equivalent), Apache, or LiteSpeed.
2. Verify on the CLI: php -v should report a fixed version.
3. Verify what the web server actually runs — drop a phpinfo() page in each site or vhost, check it, then delete it.
4. Repeat for every PHP version installed on the server — multi-PHP panels happily run 8.2 for one site and 7.4 for another.

Interim Mitigations (Not a Substitute)

If you genuinely cannot update yet, the official advisory lists partial measures: enforce memory_limit=-1 in a way applications cannot override (CVE-2026-109618), set session.upload_progress.enabled=0 and on PHP 8.5 also fatal_error_backtraces=0 (CVE-2026-109619), consider container or cgroup memory caps — and restart every PHP worker after changing configuration. Be clear-eyed about this: these only reduce exposure. Updating is the only complete fix.

Signs Your Server Was Already Hit

With exploitation pre-dating the patch, review your servers for compromise indicators once patched:

• Unknown files in web directories — especially PHP files with obfuscated names or content.
• New or unexpected cron jobs (a classic webshell persistence pattern).
• Unusual processes, or spikes in load and outgoing traffic.
• Admin interfaces accessed from unfamiliar addresses — keep them restricted and behind a WAF where possible.

Frequently Asked Questions

What is PHP2Shell?

PHP2Shell is the security community’s nickname for CVE-2026-109618 and CVE-2026-109619 — two critical PHP engine vulnerabilities (CVSS v4.0 9.2), disclosed October 21, 2026, that allow an unauthenticated attacker to execute code on a server before any application code runs.

Is PHP2Shell being exploited?

Yes. Amazon Threat Intelligence recorded exploitation attempts from October 17, 2026 — before disclosure — and Rapid7 and CERT-EU confirm multiple public exploits are available. Broad in-the-wild exploitation is documented by Tenable and others.

Which PHP versions are affected?

The affected code path dates back to PHP 5.4.0. All web-serving SAPIs are affected (PHP-FPM, mod_php, php-cgi, FrankenPHP, LiteSpeed), with mod_php at the highest risk. Fixed releases exist for PHP 8.2–8.5; legacy branches need vendor backports or source patches.

Do I need to restart anything after updating PHP?

Yes — this step is mandatory. PHP-FPM workers, Apache with mod_php, and LiteSpeed workers keep running the old code until restarted. Restart the service, then verify the live version with php -v and a temporary phpinfo page.

I am on cPanel — which update fixes PHP2Shell?

EasyApache 4 25.91 or later, delivered by the standard cPanel update (/scripts/upcp). Run it, restart PHP-FPM/Apache, and verify the PHP versions in use across all sites.

Should I worry if I run WordPress specifically?

The flaw is in PHP, not WordPress — no WordPress update is required, and a patched PHP version protects every CMS equally. WordPress’s own advice: update PHP immediately and confirm your host has done the same. See our advisory summary of WordPress’s Critical PHP Security Release announcement.

Conclusion

PHP2Shell is as serious as hosting vulnerabilities get: unauthenticated RCE, in the engine that powers most of the web, exploited before the patches existed. The fix is unglamorous and urgent — update PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 (or your panel’s backport), restart the workers, verify every installed version, and then check for signs the server was hit during the exposure window. If you manage servers with cPanel/WHM, Plesk, DirectAdmin or LiteSpeed, keeping those panels current is exactly how fixes like this reach you the same day — and we track every advisory that matters in our security advisories feed.

Sources: PHP security advisory (GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp), Tenable PHP2Shell FAQ, Palo Alto Unit 42 threat brief, Orca Security research, Rapid7 analysis, CERT-EU advisory 2026-018, Amazon Threat Intelligence via Tenable, WordPress news.