PHP2Shell: What the Critical PHP Vulnerabilities Mean for Your Website (and What to Do Today)

On 21 October 2026, the PHP project pushed out an emergency security release that every business running a PHP website needs to act on. Two critical flaws in the core PHP runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "php2shell", can let an attacker run their own code on a vulnerable web server without ever logging in.

That is about as serious as a web vulnerability gets. And because PHP sits underneath a huge part of the internet, including WordPress, Magento and Drupal, the number of sites exposed is enormous.

We went through the official advisories from the PHP team, Google Cloud, Cloudflare, the UK's NCSC, CERT-EU and ENISA, and pulled the important parts into one place: what happened, who is affected, and exactly what to do next.

The story moved fast over roughly 48 hours.

The flaws were found through coordinated research involving Wiz, OpenAI, Calif.io and Quarkslab, with AI models playing a notable role in discovery, exploit validation and patch testing.

Both bugs come down to one thing: how PHP tidies up memory when handling a web request goes wrong.

CVE-2026-109618 (code execution via out-of-memory corruption). If PHP runs out of memory while it is still setting up a request, it can stop halfway, leaving some internal data only partly built. When PHP then cleans up that request, it may treat the half-built data as if it were valid. An attacker who can push a server into that state, for example with oversized requests, can use it to corrupt memory.

CVE-2026-109619 (code execution via stale global state). When a request is cut short by a fatal error, PHP can hold on to references to memory that has already been released. The next request handled by the same worker process may then use that leftover state before PHP resets it. That opens the door to data leaks or attacker-controlled code.

In practical terms, a successful attack could crash your site, expose sensitive data, or hand an attacker a foothold on your server.

One point worth stressing: this is a flaw in PHP itself, not in your code. Updating your theme, plugins or application code will not fix it. The PHP software on the server has to be updated.

The short answer is almost everyone running PHP.

If you're on PHP 7.4, 8.0 or 8.1, there is no official update. Given the severity, the PHP security team did publish minimal source backports for those branches, and some Linux distributions and long-term support vendors offer their own backported fixes. Treat those as a bridge, not a destination; the real answer is moving to a supported version.

Here is the order we'd tackle it in, based on the official guidance.

The official PHP security advisory is clear that only updating fully solves the problem. The measures below reduce exposure to specific attack paths, but they do not make a server safe.

For CVE-2026-109618:

Set memory_limit=-1 at the server level (for example with php_admin_value in the FPM pool or Apache config) so applications can't override it.

Lower post_max_size: 8M for sites without file uploads, 32M if uploads are needed, with upload_max_filesize kept below it.

Enforce limits at your web server or proxy for request size, number of fields, multipart parts, headers and nesting depth, including requests without a usable Content-Length.

Use a container or cgroup memory limit, ideally one that kills only the affected worker. Avoid RLIMIT_AS and RLIMIT_DATA, which can actually trigger the bug.

For CVE-2026-109619:

Set session.upload_progress.enabled=0 in php.ini or the FPM pool config and restart every worker. Setting it with ini_set() or .user.ini won't work.

On PHP 8.5, also set fatal_error_backtraces=0.

Remove invalid or deprecated per-request settings that throw warnings early. Hiding errors with display_errors or @ doesn't help.

Fix fatal errors and timeouts that an outsider can trigger, such as failures in upload or import handling.

If you can't put these in place quickly, both the NCSC and CERT-EU recommend taking the system offline or isolating it from public networks until it is patched.

Major providers moved quickly to shield customers while patches roll out.

Cloudflare enabled php2shell protections by default on every plan with its WAF, including the Free plan. Customers on Pro, Business and Enterprise should confirm their Managed Ruleset is deployed in block mode. Cloudflare also introduced "full transaction detection", which looks at both the incoming request and the server's response to catch exploits with fewer false positives.

Google Cloud Armor applies protection automatically for customers using its managed rules. Google recommends enabling at least the File Upload and RFI rule categories, adding a rule to stop oversized request bodies that exceed inspection limits, and testing in preview mode first, since WordPress, Drupal and custom apps handle requests very differently.

Both companies say the same thing: a WAF buys you time, but it is not a substitute for updating PHP.

php2shell is a sharp reminder that running an unsupported PHP version is a real business risk. Under the PHP supported versions policy, each PHP branch gets two years of active support and two further years of security fixes, then it stops receiving official patches entirely.

That timeline matters right now. PHP 8.2 loses security support on 31 December 2026, roughly two months away. Updating to 8.2.35 closes this hole, but it is the right moment to plan a move to 8.4 or 8.5 rather than patching again in January.

There's a regulatory angle too. Since 11 September 2026, manufacturers of hardware and software products in the EU must report actively exploited vulnerabilities through the Cyber Resilience Act's Single Reporting Platform, and the CRA's wider security-by-design requirements apply from 11 December 2027.

If the server runs a PHP version older than the fixed releases above, yes. Plugin updates won't fix it, so check with your host or developer.

Safer, not safe. Keep the WAF rules on and patch PHP anyway.

Ideally PHP 8.4.27 or 8.5.12. They're fixed and supported for years, unlike 8.2.

At Kombee, we build and maintain PHP-powered websites, ecommerce stores and CMS platforms for businesses across the USA, UK, Singapore and Australia. If you're not sure where you stand, our team can:

Audit your sites, servers and containers to find every PHP installation and its version

Apply the patches, rebuild images and redeploy with minimal downtime

Put temporary hardening and WAF rules in place where an immediate update isn't possible

Check exposed systems for signs of compromise

Plan and deliver your upgrade from PHP 8.2 or older to a supported release

Don't wait for this one to land on your doorstep. Contact us today for a quick security check of your PHP stack, and we'll help you get patched, protected and future-ready.