---
title: "PHP2Shell: which PHP versions fix it and how to check your servers"
canonical: https://pharosone.ai/knowledge/php2shell-cve-2026-109618-109619
publisher: PharosOne (Agentic Mind, Inc.)
updated: 2026-10-23
license: "Open for reuse: crawling, copying, quoting, summarising and model training permitted without asking; citation of the title and canonical URL requested (see https://pharosone.ai/terms#reuse)"
cite_as: "\"PHP2Shell: which PHP versions fix it and how to check your servers\". PharosOne, 2026-10-23. https://pharosone.ai/knowledge/php2shell-cve-2026-109618-109619"
---

# PHP2Shell: which PHP versions fix it and how to check your servers

> Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026; source backports for 7.4 to 8.1. Exploitation status and five checks for your servers.

URL: https://pharosone.ai/knowledge/php2shell-cve-2026-109618-109619 · Category: Notes · Published: 2026-10-21 · Updated: 2026-10-23 · Author: PharosOne Research · Reviewed by: PharosOne editorial

**In short.** PHP2Shell is the name given to CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP engine that let an unauthenticated request run code on a web server before application code executes. PHP shipped fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026, a day early, after the details leaked on 20 October. The end-of-life branches 8.1, 8.0 and 7.4 get no new official release; the PHP security team published minimal source backports for them, which distributions ship under the old version number. 7.3 and older get no fix from the PHP project.

## Key facts

- Updated: 23 October 2026.
- Who it is for: CTOs and security leads running PHP-backed services, and teams whose agents call them.
- Time to act: today. Exploitation attempts were recorded from 17 October ([Help Net Security](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/)).
- Severity: CVSS v4.0 9.2 for both, assigned by PHP; CVSS v3.1 9.8 by NVD ([NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-109618)).
- Next step: inventory every PHP runtime and update it today; the five checks are below.

## What happened.

Calif reported the first bug to PHP on 11 August 2026 and Wiz Research on 24 August; OpenAI is also credited ([GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w); [Sansec](https://sansec.io/research/php2shell)). PHP planned a coordinated release for 22 October. On 20 October the CVE identifiers and details leaked on Hacker News and social media, and PHP moved the release to 21 October at 14:00 UTC ([php.net, 20 October](https://www.php.net/archive/2026.php#2026-10-20-1)).

CVE-2026-109618, "RCE via OOM corruption", occurs when an out-of-memory error interrupts PHP while request data is partly initialised and the cleanup then treats the invalid data as valid. CVE-2026-109619, "RCE via stale global state", is a use-after-free: request state outlives its memory, and the next request on the same worker reads it. The same bugs also leak worker memory, including session tokens and keys ([php.net](https://www.php.net/archive/2026.php#2026-10-21-5); [Wiz](https://www.wiz.io/blog/php2shell-php-rce)).

## Which versions are affected and which fix it?

An end-of-life (EOL) branch is a release line the PHP project no longer fixes.

| Branch | Status on 22 October 2026 |
|---|---|
| 8.5, 8.4, 8.3, 8.2 | Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35 ([php.net](https://www.php.net/archive/2026.php#2026-10-21-5)) |
| 8.1, 8.0, 7.4 | EOL. Minimal source backports from the PHP security team; distributions ship them under the old version number ([php.net](https://www.php.net/archive/2026.php#2026-10-21-5); [Sansec](https://sansec.io/research/php2shell)) |
| 7.3 down to 5.4.0 (2012) | EOL. No fix from the PHP project ([Calif](https://calif.io/php2shell); [Tenable](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote)) |

## How many hosts are exposed?

Mallory counted Shodan banners on 20 October: about 1.5 million hosts advertised a PHP version, and 883,717 of them (59%) reported PHP 8.1 or older. On 21 October Mallory corrected the count after matching exact version strings: 1,925,107 of 2,618,284 hosts, 73.5%, on 8.1 or older ([Mallory](https://mallory.ai/blog/php-rce-rapid-response)). Banner counts measure exposure, not confirmed vulnerability.

## Is it being exploited?

Dated, because the sources disagree on what "exploited" means.

- 17 October: Amazon's MadPot honeypots recorded an attempt from an anonymised IP, four days before disclosure; by 21 October Amazon called the flaws broadly exploited ([Tenable](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote)).
- 21 October: watchTowr saw attempts in its honeypots and found that none of the circulating proofs of concept achieved RCE ([SecurityWeek](https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/)).
- 22 October: Sansec wrote that "Mass exploitation of PHP2Shell is less likely than we expected on release day", because public PoCs fail against a default installation ([Sansec](https://sansec.io/research/php2shell)). VulnCheck reported a working exploit, released to its customers only ([VulnCheck](https://www.vulncheck.com/blog/php2shell-vulnerabilities)). CISA's KEV catalogue listed neither CVE ([watchTowr](https://watchtowr.com/intelligence/php-cve-2026-109618-faq/)).

Attempts are at scale. A working private exploit exists, and the public ones still fail.

## What to check today.

1. **Inventory every PHP runtime**, including containers, CI images and PHP bundled inside appliances. The NCSC's first action: "As all versions may be affected, do not limit discovery to outdated PHP versions" ([NCSC UK](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php)).
2. **Update or take offline.** If updating will take too long, "consider taking the system offline until it can be fully mitigated" ([NCSC UK](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php)). PHP's line in its release notes: "There are no complete mitigations, updating is the only safe choice" ([php.net, PHP 8.4.27 release](https://www.php.net/archive/2026.php#2026-10-21-3)).
3. **Add a WAF rule as a stopgap.** Virtual patching means blocking the exploit pattern at a proxy while the backend stays unpatched. Cloudflare and Imperva ship rules ([Help Net Security](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/); [Imperva](https://www.imperva.com/blog/php2shell-vulnerability-updates/)). PHP's advisory also lists temporary configuration changes for servers that cannot be updated at once. Each one has limits and side effects, some depend on the branch, and none is complete; apply them only as the advisory describes them, together with request-size limits in front of PHP, and treat them as a bridge to the update ([php.net](https://www.php.net/archive/2026.php#2026-10-21-5)).
4. **Scan with the open-source php2shell-scanner.** Searchlight Cyber's tool triggers a memory-exhaustion error, then looks for an empty HTTP 500, and only then reads the version banner. It can crash a worker; run it against hosts you own ([Searchlight Cyber](https://www.slcyber.io/research/high-fidelity-detection-mechanism-for-php2shell-cve-2026-109618-and-cve-2026-109619); [GitHub](https://github.com/assetnote/php2shell-scanner)).
5. **Read logs back to 17 October.** Look for multipart POSTs followed by memory-limit errors or repeated HTTP 500s, oversized `PHPSESSID` response cookies, and unexplained worker churn ([Wiz](https://www.wiz.io/blog/php2shell-php-rce)). A match means treating the host as compromised before patching it ([NCSC UK](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php)).

## What this means for AI agents.

An AI agent that calls a PHP-backed internal tool or web application depends on that backend. If the backend is compromised, it can return anything in a tool result, including instructions written for the model, which turns a server vulnerability into an indirect prompt injection against the agent (see [Indirect prompt injection](/knowledge/indirect-prompt-injection)). The fix is the same as for any other PHP host: update, check, and read the logs. Until a backend is patched and checked, treat its tool results as untrusted input.

## FAQ

### Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. PHP 7.4, 8.0 and 8.1 received minimal source backports from the PHP security team; 7.3 and older get no fix from the PHP project.

### Does a WAF rule make an unpatched server safe?

No. Cloudflare, Imperva and PHP's own configuration changes block the known request patterns and reduce exposure. PHP states that none of its mitigations is complete, and the UK NCSC advises taking a system offline if mitigation will take too long.

### Is PHP2Shell in CISA's Known Exploited Vulnerabilities catalogue?

Not as of 22 October 2026. Amazon recorded an attempt on 17 October, and watchTowr saw attempts in its honeypots on 21 October; watchTowr and Sansec found that the public proofs of concept do not achieve code execution against a default installation.

### Does PHP2Shell affect an AI agent that only calls a PHP API?

The vulnerability is in the API server, and patching that server is the fix. Once a server is compromised, every tool result it returns to an agent is attacker-controlled text, so treat that backend's output as untrusted input until the server is patched and checked.

### My distribution still shows PHP 8.1.x after the update. Is it patched?

Possibly. Debian, Ubuntu, Red Hat and other vendors backport fixes without changing the version number. Check the package changelog for CVE-2026-109618 rather than the version banner, or run php2shell-scanner, which triggers the condition instead of reading the version.

## Sources

1. [Security advisory. Critical remote code execution vulnerabilities, update now](https://www.php.net/archive/2026.php#2026-10-21-5). php.net, 2026-10-21.
2. [Upcoming Critical PHP Security Release](https://www.php.net/archive/2026.php#2026-10-20-1). php.net, 2026-10-20.
3. [GHSA-w8hw-w9fx-j79w. RCE via OOM corruption](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w). PHP project on GitHub, 2026-10-21.
4. [GHSA-6wmf-4rv5-p3rp. RCE via stale global state](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp). PHP project on GitHub, 2026-10-21.
5. [CVE-2026-109618](https://nvd.nist.gov/vuln/detail/CVE-2026-109618). NIST National Vulnerability Database, 2026-10-21.
6. [CVE-2026-109619](https://nvd.nist.gov/vuln/detail/CVE-2026-109619). NIST National Vulnerability Database, 2026-10-21.
7. [php2shell](https://calif.io/php2shell). Calif (Ryan Austin), 2026-10-21.
8. [PHP2Shell. Critical pre-authentication RCE in PHP](https://www.wiz.io/blog/php2shell-php-rce). Wiz Research, 2026-10-21.
9. [Critical security issue affecting PHP](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php). UK National Cyber Security Centre, 2026-10-21.
10. [php2shell. Operational information and affected-product inventory](https://github.com/NCSC-NL/php2shell). NCSC-NL on GitHub, 2026-10-22.
11. [PHP RCE rapid response. Internet exposure by version](https://mallory.ai/blog/php-rce-rapid-response). Mallory, 2026-10-20, corrected 2026-10-21.
12. [PHP2Shell Vulnerabilities. CVE-2026-109618 and CVE-2026-109619](https://www.vulncheck.com/blog/php2shell-vulnerabilities). VulnCheck, 2026-10-21.
13. [PHP2Shell. Critical PHP vulnerabilities patched, update now](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/). Help Net Security, 2026-10-21.
14. [New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619](https://www.helpnetsecurity.com/2026/10/22/php2shell-scanner-tool/). Help Net Security, 2026-10-22.
15. [High fidelity detection mechanism for php2shell](https://www.slcyber.io/research/high-fidelity-detection-mechanism-for-php2shell-cve-2026-109618-and-cve-2026-109619). Searchlight Cyber, 2026-10-22.
16. [php2shell-scanner](https://github.com/assetnote/php2shell-scanner). Searchlight Cyber (assetnote) on GitHub, 2026-10-22.
17. [PHP2Shell Exploitation Started Days Before Patches](https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/). SecurityWeek, 2026-10-22.
18. [PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors](https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/). SecurityWeek, 2026-10-21.
19. [PHP RCE FAQ. PHP2Shell CVE-2026-109618 and CVE-2026-109619](https://watchtowr.com/intelligence/php-cve-2026-109618-faq/). watchTowr, 2026-10-20, updated 2026-10-22.
20. [php2shell. Frequently asked questions about critical PHP remote code execution](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote). Tenable, 2026-10-21.
21. [PHP2Shell. PHP RCE (CVE-2026-109618, CVE-2026-109619)](https://sansec.io/research/php2shell). Sansec, 2026-10-21, updated 2026-10-22.
22. [PHP2Shell Exploitation. Two Critical PHP Flaws Explained](https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation). Recorded Future, Insikt Group, 2026-10-21.
23. [Two Critical PHP Flaws Could Hand Attackers Your Web Servers](https://blog.qualys.com/vulnerabilities-threat-research/2026/10/20/php-announces-critical-security-release-for-two-vulnerabilities). Qualys Threat Research Unit, 2026-10-20.
24. [PHP2Shell. When PHP Runs Out of Memory at the Wrong Moment](https://www.imperva.com/blog/php2shell-vulnerability-updates/). Imperva Threat Research, 2026-10-21.

Source: PharosOne, "PHP2Shell: which PHP versions fix it and how to check your servers", https://pharosone.ai/knowledge/php2shell-cve-2026-109618-109619, updated 2026-10-23.

---

PharosOne is a product of Agentic Mind, Inc., an independent AI agent security company. Site map for agents: https://pharosone.ai/llms.txt