PHP2Shell (CVE-2026-109618 & CVE-2026-109619): How to Update PHP and Protect Your Website

Short answer: on 21 October 2026 the PHP project released emergency fixes for two critical vulnerabilities, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). They can allow an unauthenticated attacker to run code on a web server. Update PHP now to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your Linux distribution's patched package), restart PHP and your web server, and confirm the update. If you are still on PHP 8.1 or older, there is no official fix — upgrade to a supported version.

Last updated: 26 October 2026 — we will update this guide as new PHP and Linux security releases come out.

Most websites in India and worldwide — WordPress, WooCommerce, Laravel, OpenCart, Joomla, custom PHP portals — run on PHP, so this affects a huge number of sites.

PHP2Shell key facts

• What it is: two critical remote code execution flaws in PHP itself
• CVE IDs: CVE-2026-109618 and CVE-2026-109619
• Severity: 9.2 (CVSS v4.0) — critical
• Affected: PHP 5.4 up to 8.5.11 serving web requests
• Fixed in: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (released 21 October 2026)
• No official fix: PHP 8.1 and older — upgrade required
• What to do: update PHP, restart PHP-FPM and your web server, then verify

What happened

• What: two flaws in PHP itself (not in WordPress or a plugin), each rated 9.2 critical (CVSS v4.0)
• Impact: in vulnerable setups, a specially crafted web request can lead to remote code execution — an attacker taking over the server, uploading web shells, stealing data or injecting malware and spam
• Affected versions: reported as PHP 5.4 up to and including 8.5.11
• Affected setups: web-facing PHP in common configurations, including Apache with mod_php (reported as the highest risk), PHP-FPM, php-cgi, LiteSpeed and FrankenPHP
• Exploitation: security companies have reported exploit attempts. Treat this as urgent even if your site looks fine

A separate, lower-risk advisory (CVE-2026-115560) followed on 23 October for unusual configurations. The next PHP releases will cover it too, so keep updating.

Step 1: Check your PHP version

On a server with SSH:

php -v

Websites can use a different PHP than the command line. To see what your site actually uses, check your hosting panel (cPanel, Plesk, hPanel), or for WordPress go to Tools → Site Health → Info → Server.

Fixed versions: 8.5.12+, 8.4.27+, 8.3.36+, 8.2.35+.

Important for Ubuntu/Debian/RHEL: distribution packages often backport security fixes without changing the main version number. A version like 8.3.6 from Ubuntu can still be patched. Check the package changelog for the CVE numbers instead (see below).

Step 2: Update PHP

Ubuntu or Debian VPS (official packages)

sudo apt update
sudo apt list --upgradable | grep php
sudo apt upgrade

Then check the fix is included:

apt changelog php8.3-fpm | grep -i -E "CVE-2026-109618|CVE-2026-109619"

(Change php8.3-fpm to your package, e.g. libapache2-mod-php8.3 or php8.1-fpm.) If the CVEs are not listed yet, watch the Ubuntu/Debian security notices and apply the update as soon as it is published.

Ubuntu with the Ondřej Surý PPA (multiple PHP versions)

sudo apt update
sudo apt upgrade
php -v

Make sure each installed version (8.2, 8.3, 8.4…) shows the fixed release. Remove versions you no longer use.

AlmaLinux, Rocky Linux or RHEL (Remi or AppStream)

sudo dnf upgrade --refresh 'php*'

Restart PHP and the web server

sudo systemctl restart php8.3-fpm
sudo systemctl restart apache2   # or: nginx, httpd, lsws

Repeat for every PHP-FPM version you run.

cPanel / WHM (EasyApache 4)

• cPanel's EasyApache PHP packages (ea-php82, ea-php83…) are updated through normal system updates. From SSH as root:

dnf update 'ea-php*'      # CentOS 7 / older systems: yum update 'ea-php*'

• Or in WHM → EasyApache 4, apply available updates
• If you use CloudLinux alt-php (PHP Selector), update the alt-php packages too
• Check WHM → MultiPHP Manager for sites still set to PHP 8.1 or older and move them to a supported version
• If you are a cPanel user on shared hosting (not root), see the shared hosting section below

Plesk

Go to Tools & Settings → Updates, install the latest PHP component updates, and check PHP Settings for each domain. Move sites off unsupported PHP versions.

Shared hosting (Hostinger, GoDaddy, Bluehost and others)

You usually cannot update PHP yourself. Your host updates the PHP builds on the server. What you should do:

1. In your panel (Select PHP Version, PHP Configuration or MultiPHP Manager), switch to PHP 8.3 or 8.4
2. Contact your host's support and ask: "Have the PHP2Shell fixes (CVE-2026-109618 and CVE-2026-109619) been applied to my server?"
3. If your host cannot confirm, consider moving to a provider that patches quickly

Docker images

Rebuild your images from the latest official php base image tag and redeploy. An old image keeps the old PHP even after the host server is updated.

Step 3: If you are still on PHP 8.1, 7.x or older

These versions get no official security fixes any more (PHP 8.1 support ended on 31 December 2025, and PHP 8.2 security support ends on 31 December 2026). Plan an upgrade to PHP 8.3 or 8.4:

1. Take a full backup of files and database
2. Test the website on a staging copy with the new PHP version
3. Update WordPress, themes and plugins (or your framework) first
4. Fix errors, then switch the live site
5. Keep the old version available for a quick rollback

Step 4: Check whether your site was already attacked

Because exploit attempts were reported before many servers were patched, look for signs of compromise:

• New or unknown admin users in WordPress or your app
• Recently modified PHP files, especially in uploads folders:

find /var/www -name "*.php" -mtime -10 -print
find /var/www -path "*uploads*" -name "*.php" -print

• Unknown cron jobs (crontab -l for each user)
• Unusual outgoing traffic, spam emails or high CPU
• Strange requests in your web server and PHP error logs

If you find anything suspicious, restore a clean backup taken before the infection, change all passwords and keys, and update everything before going live again.

Step 5: Harden your website and server

Updating fixes this bug. These steps protect you from the next one:

1. Turn on automatic security updates on your VPS (unattended-upgrades on Ubuntu/Debian)
2. Use a web application firewall such as Cloudflare WAF, ModSecurity, or Imunify360 on cPanel servers
3. Block PHP execution in upload folders (for example wp-content/uploads) so uploaded files can never run
4. Hide your PHP version: set expose_php = Off in php.ini
5. Run each website as its own system user with separate PHP-FPM pools, so one hacked site cannot infect others
6. Lock down the server: firewall (ufw/firewalld), SSH keys instead of passwords, fail2ban, and close ports you do not use
7. Keep your CMS, themes and plugins updated and remove anything unused
8. Back up daily, off the server, and test restoring
9. Monitor uptime and file changes so you hear about problems quickly
10. Subscribe to security alerts for PHP, your Linux distribution and your control panel

Temporary configuration workarounds shared online (for example disabling session upload progress) may reduce some risk, but security researchers say only updating fully fixes PHP2Shell.

For a routine that keeps your site safe all year, use our website maintenance checklist.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. In vulnerable setups they can let an attacker run code on a web server without logging in.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer. Linux distribution packages may use older-looking version numbers with the fix backported — check the package changelog.

Is my WordPress site affected?

If it runs on an unpatched PHP version, yes — the flaws are in PHP itself, not in WordPress. Updating WordPress alone does not fix it.

My php -v shows an older-looking number. Am I still vulnerable?

Not necessarily. Linux distributions backport fixes without changing the main version number. Check the package changelog for CVE-2026-109618 and CVE-2026-109619, or ask your host.

Will updating PHP break my website?

Security updates within the same version (for example 8.3.x to 8.3.36) rarely break anything. Jumping to a new major version, such as 7.4 to 8.3, needs testing first.

I am on shared hosting. What can I do?

Switch to a supported PHP version in your panel and ask your host to confirm the patch is installed. If they cannot, consider managed hosting where updates are handled for you.

Can you update and secure our server?

Yes. We patch PHP on VPS, cloud, cPanel and Plesk servers, upgrade old PHP versions safely, scan for malware and harden security. See our website maintenance and hosting & server management services.

Not sure if your website is safe? Contact us for a free security check.

Sources and further reading

• PHP supported versions — php.net
• PHP2Shell analysis and remediation — Datadog Security Labs
• Threat brief: CVE-2026-109618 and CVE-2026-109619 — Unit 42
• PHP2Shell vulnerabilities patched — Help Net Security