What PHP2Shell actually is
This refers to two core PHP flaws disclosed in October 2026 (CVE-2026-109618 and CVE-2026-109619). Each is rated CVSS 9.2 out of 10. An attacker needs no account: a crafted request may be enough to run their own program on the server. Official patched releases were issued on 21 October 2026.
Many people assume a small site will be passed over. This wave is mostly automated scanning across the whole internet, selected by PHP version rather than company size.
Why login checks and firewalls do not stop it
Picture the site as a building and login checks as access control on each floor. The problem sits at the mail desk: trouble starts as soon as a parcel arrives, before it reaches any floor.
That gives this flaw two main traits:
- No login required: a member system or a complex admin password does not change the risk.
- Solid application code cannot fully fix it: the defect is in PHP itself, so only a PHP upgrade closes it completely.
How to tell if your site is affected
Only one fact matters: the PHP version the host is actually running. Use the table below to decide whether action is needed:
| Current PHP branch | Release that includes the fix | Official fix | Suggested action |
|---|---|---|---|
| 8.5 | 8.5.12 or later | Available | Confirm it is updated to 8.5.12 |
| 8.4 | 8.4.27 or later | Available | Confirm it is updated to 8.4.27 |
| 8.3 | 8.3.36 or later | Available | Confirm the update, and plan a move to 8.4 next year |
| 8.2 | 8.2.35 or later | A fix exists, but support ends on 2026-12-31 | Update first, then move to 8.4 or newer before year-end |
| 8.1, 8.0, 7.4 | No official release | Source-level patch only | Apply temporary protection and upgrade soon |
A common mix-up is trusting a host who says PHP is already current. One machine often has several versions installed, and the panel may not show the one the site uses. Ask them to confirm the version the site is running. For what to do after a version loses support, look up separate guidance.
Three things to do now
1. Confirm the version and upgrade if you can
If the version is below the patched line in the table, ask the host or maintainer to update it. From 8.2 upward this is usually a minor update with lower risk. Sites on 7.4 through 8.1 must cross a major version, so application code, plugins, and payment integrations may all need changes. The safer path is to upgrade on a test site, accept the result, then move it live.
2. If you cannot upgrade yet, add temporary protection
Ask the host to apply these settings. PHP must be restarted before they take effect:
- Turn off upload progress (session.upload_progress): it is on by default and can be abused even if the site never uses it.
- Cap the size of a single request: block unusually large requests at the front of the host.
- On PHP 8.5, also disable fatal-error trace output (fatal_error_backtraces).
Put plainly, these steps only narrow the receiving window. They do not close the flaw, so an upgrade still has to be scheduled.
3. Look for signs the site was attacked
Overseas cloud providers saw attack attempts four days before the advisory. Sites updated only after 21 October, or still not updated, should be reviewed. Ask the maintainer to check:
- Whether error logs show batches of out-of-memory errors that occur before site code starts
- Whether requests contain upload-progress fields that do not normally appear
- Whether the host has system-command processes started by the site itself
If any item looks suspicious, follow the incident-response process for a compromised site and do not rush to delete files.
Three questions for the host or maintainer
| Question to ask | A sound answer | An answer to watch |
|---|---|---|
| What full PHP version is the site actually running? | They can state a complete version, such as 8.4.27 | "It should already be a new version" |
| Has the PHP2Shell fix been applied? | Updated to a patched release, or temporary protection is on and an upgrade date is set | "The site is small, so it will not be hit" |
| Have the error logs been reviewed? | They can name the time window and whether anything unusual appeared | "If nothing broke, there is no need to look" |
Flaws will return; versions must keep up
PHP2Shell will not be the last severe flaw. Keep these three points in mind:
- Know which PHP version the site uses: without that, you cannot tell whether the next flaw applies to you.
- Temporary protection is not a fix: it buys time, but a patched release is the end state.
- Put PHP upgrades on the yearly maintenance plan: upgrade before support ends, instead of waiting for each advisory.
You can also review site protection against a security checklist on a regular basis.
