PHP Vulnerability 2026: What "PHP2Shell" Means for Your Website

In October 2026, PHP fixed two critical security holes nicknamed PHP2Shell. Here's what they are in plain words, how to check if your website is affected and exactly what to update to.

Info· 3 min read
Warning shield for the PHP2Shell PHP vulnerability of 2026
In this article (5 sections)Show
  1. What happened, in simple words
  2. Which versions are safe?
  3. Check your version
  4. What to do today
  5. Quick answers

If your website runs on PHP (WordPress, Laravel or most custom sites), this matters. On 21 October 2026, PHP released emergency updates for two critical security holes nicknamed "PHP2Shell". It's the biggest PHP vulnerability 2026 story so far, and the fix is a normal PHP update.

What happened, in simple words

Two bugs were found inside PHP itself, not in your own code:

  • CVE-2026-109618: running out of memory at the wrong moment can leave broken data that PHP later trusts.
  • CVE-2026-109619: a fatal error at the wrong moment can carry leftover data from one visitor's request into the next.

The result: a stranger could take control of your server with crafted requests, with no password needed. Both are rated 9.2 out of 10. The riskiest setup is Apache with mod_php, but PHP-FPM sites are affected too. Proof-of-concept code is already circulating, so treat this as urgent.

Which versions are safe?

Your PHP branch Update to at least Supported until
8.5 8.5.12 31 Dec 2029
8.4 8.4.27 31 Dec 2028
8.3 8.3.36 31 Dec 2027
8.2 8.2.35 31 Dec 2026 (ends soon)
8.1 or older no official fix already ended

On 8.1 or older, upgrade to 8.4 or 8.5. On 8.2, update now and plan your move, because its support ends this year.

Check your version

On the server: php -v. Or upload this as check.php, open it in your browser, then delete it right away:

PHP
<?php
$fixed = ['8.2' => '8.2.35', '8.3' => '8.3.36', '8.4' => '8.4.27', '8.5' => '8.5.12'];
$branch = PHP_MAJOR_VERSION . '.' . PHP_MINOR_VERSION;

if (!isset($fixed[$branch])) {
    echo "PHP $branch no longer gets security fixes. Upgrade to PHP 8.4 or 8.5.";
} elseif (version_compare(PHP_VERSION, $fixed[$branch], '<')) {
    echo 'Vulnerable! Update PHP ' . PHP_VERSION . ' to ' . $fixed[$branch] . ' or newer.';
} else {
    echo 'Good: PHP ' . PHP_VERSION . ' has the PHP2Shell fix.';
}

On cPanel, look for "Select PHP Version" or "MultiPHP Manager". If the patched version isn't offered yet, ask your host.

What to do today

  1. Update PHP and restart PHP-FPM or Apache. Old processes stay vulnerable until restarted.
  2. Check every site, including old test and staging copies.
  3. Keep updating: PHP is preparing a fix for a third related issue, CVE-2026-115560.

Can't update yet? As a temporary shield, set this in php.ini or your PHP-FPM pool (not with ini_set() or .user.ini), then restart:

INI
; Temporary protection until PHP is updated
session.upload_progress.enabled = 0

It reduces the risk but doesn't remove it. Very few sites use this feature, so it rarely breaks anything.

Quick answers

Is WordPress affected? Yes, any site on unpatched PHP is. Updating WordPress alone doesn't help; update PHP.

Will updating break my site? Updates within your branch (for example 8.3.26 to 8.3.36) only contain fixes and are very safe. Moving to a new branch may need small code changes, so test on a copy first.

XAMPP on my own computer? Lower risk if it's not reachable from the internet, but update it, and never expose it online.

For everyday protection, read our PHP security checklist. Need help updating your servers? Contact our team.

Sources: The PHP Foundation, CERT-EU advisory 2026-018, PHP supported versions.

#php#security#vulnerability#php2shell#cve-2026-109618#cve-2026-109619#web hosting

Keep reading