What is PHP2Shell?
PHP2Shell is the name for two critical memory-safety vulnerabilities in the PHP runtime: CVE-2026-109618 and CVE-2026-109619. Each is rated 9.2 out of 10 under CVSS v4.0. On affected systems, an attacker may be able to execute code without signing in or expose sensitive process memory. The researchers’ overview explains the findings.
PHP is the server-side software used by many websites and business applications. The flaws sit in PHP itself, beneath your application. Updating a CMS, theme, plugin, or custom code does not by itself update that runtime.
Two ways PHP can mishandle memory.
CVE-2026-109618 concerns out-of-memory handling. An interrupted operation can leave internal request data in an invalid state. Later cleanup can use that invalid data. PHP’s advisory documents unauthenticated code execution as the web worker account.
CVE-2026-109619 concerns stale state between requests. A persistent worker can retain a reference to memory that a previous request has already released. A later operation may use that stale reference. Reachability depends on the PHP version, configuration, and application behavior.
For a business, the concern is access to records, credentials, and the workflows people need to do their jobs. An affected client portal or Ops CRM could put intake, inspection assignments, approvals, or renewal follow-up at risk. Those are potential consequences, not claims that a particular business has been compromised.
Check the server behind the website.
The PHP team identifies installations serving web requests as at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. It describes the highest risk for mod_php, where a demonstrated attack can run before application code starts. See the official PHP security advisory.
WordPress, Drupal, Joomla, and custom PHP applications belong in your inventory. An up-to-date application can still sit on an outdated runtime. Ask about every environment: production, staging, development, older portals, and container images.
A static HTML page does not execute PHP by itself. Still, a PHP contact handler, a separate application on the same server, or a forgotten subdomain may create exposure. The useful question is which reachable services actually run PHP.
Update PHP. Verify what is running.
The first upstream releases fixing the two original vulnerabilities are listed below. Use the latest appropriate security release for your supported branch and review subsequent advisories. The researchers’ upgrade guidance also calls for restarting the affected services and long-running workers.
| PHP branch | First fixed release |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
Linux vendors may backport a fix while keeping an older base version number. Verify the full installed package revision against your vendor’s notice. Ubuntu’s PHP2Shell notice lists its fixed package revisions and explains why services still need to restart after an update. A version number alone can give the wrong answer.
October 23 follow-up: session upload progress.
PHP also advised setting session.upload_progress.enabled=0 until the next regular bugfix release to address an additional, unusual configuration-dependent RCE path. Have your administrator review the session upload progress advisory and its applicability. The table above identifies the original fixes; it is not an all-clear for every later issue.
Sometimes the operating system needs to move forward, too.
An older operating system may not support the PHP release your application needs. Some of our clients required an OS upgrade as part of the PHP2Shell response. 417 Solutions handled that work securely and promptly, alongside the PHP updates.
That is a practical reason to have a technical partner who can coordinate the infrastructure and the application. A maintenance plan needs to account for the dependencies beneath the update, the work required to apply it, and the checks before people return to their daily workflows.
Ask for patch confirmation today.
If you run a PHP website or business application, send the request below to the person responsible for its server. Do not wait for a sales call to apply an available security update.
Please confirm whether every PHP environment supporting our website and applications has been updated for CVE-2026-109618 and CVE-2026-109619. Please include the running PHP version or vendor-patched package revision, completion time, and confirmation that affected services and workers were restarted. Please also review PHP’s October 23 session upload progress advisory and tell us what action applies to our setup.
- Name the owner. Identify who is responsible for the server, PHP runtime, operating system, and application. Confirm who can authorize the work.
- Confirm the full scope. Include all serving nodes, environments, containers, and older PHP applications. A command-line PHP version may differ from the runtime serving web requests.
- Coordinate the update. Have the administrator review vendor guidance, required OS changes, backups, compatibility, and the maintenance window. Install the fixes and restart the affected services.
- Check the application afterward. Verify login, forms, uploads, scheduled jobs, and the handoffs your team relies on. Record the installed revisions and any remaining work.
- Follow up on suspicious activity. Preserve relevant logs and escalate signs of compromise for investigation. Applying a patch does not establish whether earlier exposure was exploited.
These are our recommended operational steps. If you cannot patch immediately, ask your administrator to follow the official mitigations for your configuration. A firewall rule or configuration workaround should not be treated as a complete substitute for the PHP update.
Infrastructure. Security review. Ongoing care.
PHP2Shell makes a familiar operational gap visible: the software is important, but responsibility for keeping it current can be scattered. Our services give you a way to define that responsibility around the system your business runs on.
Managed Hosting Infrastructure Plans
Choose dedicated, single-tenant infrastructure with defined monitoring and nightly app-server snapshots. Higher tiers add separation and redundancy for the application your team uses every day.
Hosting fees cover the agreed infrastructure. Setup, routine maintenance and technical oversight, security assessments, recovery work, and other labor are scoped separately. Offsite backups and extended retention are also separate. We agree on who handles PHP and OS updates and the associated labor before work begins.
Explore Managed Hosting Infrastructure Plans →Managed Security Assessments
Give your developers a prioritized view of issues found in an agreed codebase. Our assessments combine AI-assisted analysis with human review at the level included in your selected package. Reviewed Assessment adds focused validation of significant findings; Assessment + Retest adds an agreed follow-up check.
Source-code access is required. These assessments review application code; they do not certify that a PHP runtime is patched, include live-site penetration testing, or replace incident investigation. Code fixes are scoped separately.
Explore Managed Security Assessments →Systems Care
For applications already built by 417 Solutions, Systems Care provides agreed routine maintenance, technical oversight, monitoring and backups within the agreed setup, and an hours bank for small improvements. Coverage and priority response windows are defined in the agreement.
Infrastructure fees are separate. Major features and larger changes require a change order or new phase. We define how maintenance work, including runtime or operating system upgrades, fits your agreement.
Explore the Systems Care package →Start with the system you have.
Book a free strategy call. Tell us what the application does, where it runs, and who maintains it. We will help identify the right service and scope. New builds and larger changes follow our paid Discovery, proposal, and build process. Scope and pricing are agreed before work begins.
Clear answers before the next step.
Our WordPress site is current. Do we still need to check PHP?
Yes. PHP2Shell affects the runtime beneath WordPress. Ask your hosting provider to confirm the PHP package actually serving requests and the completed service restarts. Updating WordPress alone does not establish that PHP is patched.
Does a patched server mean we were never compromised?
No. Patching addresses the vulnerability going forward. It does not establish what happened before the fix. Suspicious activity needs investigation, with relevant evidence preserved and credential changes considered as part of the response.
Will a security assessment fix PHP2Shell on our server?
The PHP runtime needs the vendor’s security update. Our Managed Security Assessments examine your application source code and provide findings and next steps. Server patching and application remediation are separate work with an agreed scope.
Can we buy Systems Care for an application someone else built?
Systems Care is for applications built by 417 Solutions. For an existing third-party application, start with a free strategy call so we can discuss its hosting, source-code access, and support needs before proposing any work.
Go straight to the advisories.
Technical guidance was reviewed on October 23, 2026. Check these primary sources for later revisions. The client-response statement above describes 417 Solutions’ work on the original PHP2Shell vulnerabilities.
- PHP: October 21 critical security advisory
- PHP: October 23 session upload progress advisory
- PHP advisory: CVE-2026-109618, out-of-memory corruption
- PHP advisory: CVE-2026-109619, stale global state
- PHP2Shell: researcher overview and upgrade guidance
- Ubuntu: fixed package revisions and update guidance