Start free
← All posts

PHP2Shell: are you affected, and what to do now

StackClock team ·

On 21 October 2026 the PHP team shipped emergency fixes for two critical flaws in PHP itself. They are called PHP2Shell, and if you run PHP anywhere, you should check your version today.

Here is what is affected, what the risk is, and what to do. We wrote this on 24 October 2026, and we will keep it short.

What happened

The two flaws are CVE-2026-109618 and CVE-2026-109619. They are rated critical (CVSS 9.2). Attackers do not need an account to use them, and they are reported as remote code execution, which means running their own code on your server.

Details leaked before the patch came out, and exploit code is now public. Security firms have already seen attacks in the wild, and the US cyber agency CISA tells everyone to patch right away.

The flaws involve a PHP feature called session upload progress, which is on by default. That is why a normal PHP setup can be exposed, not just an unusual one.

Which versions are affected

Every PHP release from 5.4 up to 8.5.11. You are safe from these releases on:

  • PHP 8.5.12 or newer
  • PHP 8.4.27 or newer
  • PHP 8.3.36 or newer
  • PHP 8.2.35 or newer

If you run PHP 8.1 or older, there is no fix. Those versions are out of support, so the only way to be safe is to move to a supported release.

Check your version

Run php -v on the server. Or look at the FROM line of your Dockerfile, for example FROM php:8.3-apache.

Two things catch people out:

  • A series is not enough. php:8.3 could be 8.3.12 or 8.3.36. You need the full patch version. Rebuild the image with docker build --pull so you get the latest 8.3 release, then check again.
  • Linux packages can carry the fix without a new number. Ubuntu, Debian, Red Hat and Alpine often backport a fix and keep the old version. If your PHP came from a package, update it and read the changelog for the two CVE numbers, instead of trusting the version alone.

On shared hosting, you cannot update PHP yourself. Check your control panel for a newer PHP version, or ask your host.

What to do now

  1. Update PHP to one of the fixed releases above. This is the only complete fix.
  2. Restart PHP after you update. That means PHP-FPM or Apache, or redeploy your containers. An update that was never restarted still runs the old code.
  3. Move off PHP 8.1 and older. There is nothing to patch there.

If you cannot update today

Set this in your php.ini, then restart PHP:

session.upload_progress.enabled = Off

It turns off the feature the flaws involve. The PHP maintainers say no complete workaround exists, so treat it as a stopgap and update as soon as you can.

What it means for you

Anyone who can reach your PHP site could be able to run code on your server. That can mean stolen data, a backdoor left behind, or your server used to attack others.

If your site was online and unpatched since the details leaked, do two more things after updating:

  • Look for signs of a break-in. Check for PHP files you did not add, especially in upload folders, and for odd PHP-FPM crashes or traffic spikes in your logs.
  • Rotate secrets if you find anything. Database passwords, API keys and anything stored on that server.

One more flaw to watch

On 23 October PHP disclosed a separate flaw, CVE-2026-115560. The releases above do not fix it. It only affects an application that changes the session serialize handler at runtime before calling session_start(), which PHP says is unlikely in practice. Keep an eye on the PHP release notes for the fix.

What StackClock does and does not do here

We want to be straight about this. Our vulnerability scan covers packages, like the ones on npm, PyPI and Packagist. It does not check the PHP interpreter itself, so it does not flag PHP2Shell today.

What we do show: PHP's end-of-life dates, on our end-of-life page for PHP. Old versions of PHP are exactly the ones that never get a fix.

To see what else in your stack is out of date, paste a composer.json, package.json or Dockerfile into the free stack check. It takes a few seconds, with no sign-up. If you want us to watch it every day, start free and import your stack into a workspace.

Sources