PHP2Shell: PHP Emergency Patches Fix Two Critical RCE Flaws

If your website runs on PHP, patch it today. The PHP security team has shipped emergency fixes for two critical remote code execution flaws that researchers are tracking under a single name: PHP2Shell. Both bugs can be exploited without a login, and Cloudflare says it is already seeing early attacks in the wild.

These are not edge-case bugs in a niche extension. They affect PHP installations that serve web requests, which includes the setup behind most WordPress, Joomla, and Drupal sites. Here is what the flaws are, which versions are fixed, and what to do if you cannot patch immediately.

What is PHP2Shell

PHP2Shell is the collective name for two unauthenticated remote code execution vulnerabilities in PHP itself:

• CVE-2026-109618, a chain of weaknesses that triggers memory corruption and gives an attacker code execution as the web worker account.
• CVE-2026-109619, a stale global state bug that enables a heap use-after-free, memory disclosure, and remote code execution with the web worker’s privileges.

The flaws were discovered by researchers at Calif, OpenAI, and Wiz. Both come from the same underlying problem: PHP can leave its memory in a corrupted state when a request ends abnormally. The PHP security team said the risk is highest for mod_php, where a demonstrated exploit shows an unauthenticated request triggering the attack before any application code even runs.

Which PHP setups are affected

Every PHP installation that serves web requests is in scope. That includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. PHP still powers a huge share of the web, and VirusTotal estimates put more than 5.1 million PHP hosts exposed online, with roughly 3.8 million having at least one port open.

The attack surface is the language runtime, not your theme or your plugins. That is why a clean WordPress install is not automatically safe here.

Which PHP versions are patched

Fixed releases are out for all supported branches. Upgrade to one of these now:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so check with yours. For people building from source or stuck without an LTS vendor, the PHP team published minimal source backports for PHP 7.4, PHP 8.0, and PHP 8.1.

Attacks may already be happening

Timeline matters here. PHP developers warned admins on Tuesday to prepare, holding back details until the patches were ready. Before the fixes were public, Cloudflare CTO Dane Knecht confirmed the company had already deployed WAF rules designed to block known exploitation methods and was observing early attacks targeting the two flaws.

PHP core developer Gina Peter Banyard was equally direct: no mitigation fully blocks potential attacks, and applying the official security patches is the only permanent defense. The UK National Cyber Security Centre has urged organisations to update immediately or take affected systems offline until they can be patched.

Temporary mitigations if you cannot patch yet

The PHP team shared measures that reduce exposure to some attack paths. Read the important caveat first: they do not fully protect against exploitation. Treat them as a bridge until the patched version is live.

For CVE-2026-109618:

• Set memory_limit=-1, ideally in a way applications cannot override, such as php_admin_value in the FPM pool or Apache configuration.
• Set a low post_max_size: 8M for applications that do not need file uploads, 32M if uploads are necessary.
• Use a container or cgroup limit as an availability boundary, ideally with a policy that kills only the affected worker.

For CVE-2026-109619:

• Set session.upload_progress.enabled=0 and restart every worker.
• On PHP 8.5, set fatal_error_backtraces=0 and restart every worker. This blocks only the confirmed fatal backtrace path.
• Remove invalid or deprecated settings applied per request that emit diagnostics before initialization. Hiding diagnostics with error_reporting, display_errors, or @ does not help.
• Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing, and cleanup.

What site owners should do this week

1. Find your PHP version. In a terminal, run php -v or check your hosting panel.
2. Update to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 depending on your branch.
3. If you are on PHP 7 or 8.0 or 8.1, plan a migration to a supported version and ask your host about backported fixes.
4. Shared hosting users: open a support ticket today and ask specifically whether the PHP2Shell patches are applied.
5. Check your host’s WAF status. Cloudflare and other providers have temporary rules deployed, but they are a stopgap.
6. Watch your logs for unusual requests that end in errors or timeouts, since the bugs live in abnormal request handling.

Why security researchers are treating this as an emergency

Two things make PHP2Shell stand out from the usual vulnerability cycle. First, the bugs live in the PHP runtime itself, not in an application or plugin. A fully updated WordPress or Laravel site is still exposed if the PHP binary underneath is unpatched.

Second, the mod_php case is genuinely ugly. The PHP team confirmed a demonstrated exploit where an unauthenticated request triggers the attack before any application code runs. That means your application’s authentication, validation, and WAF rules at the application layer are not in the path of the bug. The only real fix is the patched PHP release.

Both flaws share a root cause: abnormal request endings can leave PHP’s memory in a corrupted state. One bug chains that corruption into code execution, the other turns it into a use-after-free with memory disclosure. Memory corruption bugs in a language runtime are exactly the class of issue that botnet operators move on first, which is why Cloudflare saw attempts before the patches were public.

What hosting providers are doing

Cloudflare has deployed temporary WAF rules blocking known exploitation methods, and other managed hosts are rolling out similar protections. That is helpful, but the company itself stressed the rules are a stopgap. The UK NCSC went further, telling organisations to update immediately or take PHP systems offline until patched.

If you are on shared hosting, your provider’s response is the deciding factor. Ask them directly whether PHP2Shell patches are applied to your server and which PHP versions they have updated. Most hosts will have patched their supported branches within days, but “we are looking into it” is not the answer you want for a remote code execution bug.

Frequently Asked Questions

What is PHP2Shell?

PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution. They were found by Calif, OpenAI, and Wiz and affect PHP installations serving web requests.

Which PHP versions are affected?

All PHP setups that serve web requests are in scope, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Fixed releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older branches need vendor backports or a migration.

How do I protect my WordPress site from PHP2Shell?

PHP2Shell is a PHP runtime bug, so updating WordPress plugins does not fix it. You or your host must upgrade PHP itself to one of the patched versions, and until then apply the temporary configuration mitigations published by the PHP team.

Are there live attacks on these PHP flaws?

Cloudflare says it has already observed early attacks and deployed temporary WAF rules. That is why the PHP team, security researchers, and the UK NCSC are treating this as an emergency patch situation rather than a routine update.

How do I know which PHP version my website is running?

Most hosting control panels show the PHP version under the software or PHP settings section. If you have shell access, run php -v. WordPress users can also check Tools, then Site Health, then Info, where the PHP version is listed under the server section.

Does a CDN like Cloudflare protect me from PHP2Shell?

Cloudflare has deployed temporary WAF rules against known exploitation methods, but both the company and the PHP team describe them as a stopgap. Patching PHP is the only permanent fix, so treat a CDN as buying time rather than solving the problem.

Patch first, mitigate second, and treat every hour of delay as exposure. This is one of those rare cases where the fix is a version number away and the alternative is being part of someone else’s botnet statistics.