PHP2Shell: everything about the critical PHP vulnerability
Two critical vulnerabilities in PHP itself, CVSS 9.2, malicious code without login. Here is what is documented, which versions are safe and what you do now.
What Is PHP2Shell? The Vulnerability Explained Simply
PHP2Shell is a pair of critical vulnerabilities in PHP itself that let attackers execute code on web servers without logging in. The situation in plain words.
Read more →02CVE-2026-109618: RCE via Out-of-Memory Condition
CVE-2026-109618 is one of the two PHP2Shell vulnerabilities: an out-of-memory condition can interrupt PHP in the middle of request processing. Fixed from PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Read more →03CVE-2026-109619: RCE via Stale Global State
CVE-2026-109619 is the second PHP2Shell vulnerability: a request's internal state can persist after memory is freed and be used by the next request in the same worker.
Read more →04CVE-2026-115560: Session Upload Progress Advisory
CVE-2026-115560 is an advisory from php.net dated 23 October 2026: possible code execution only with an unusual session configuration. Remedy until the next release: session.upload_progress.enabled=0.
Read more →05Which PHP Versions Are Affected?
PHP2Shell is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. There are no official updates for PHP 8.1 and older. The table shows the state per branch.
Read more →06Checking the PHP Version and Patch Level Correctly
The displayed PHP version alone does not say whether PHP2Shell is closed. What matters are the package version, backports and whether the new processes are really running.
Read more →07Why mod_php Carries the Highest Risk
With Apache and mod_php, the PHP team rates the PHP2Shell risk highest: an exploit was demonstrated there before application code runs. How to check and act.
Read more →08After the Update: Restarting PHP-FPM and All Workers
A PHP update only takes effect once all PHP processes have been restarted. The commands for PHP-FPM, Apache, LiteSpeed and containers, and how to verify the restart.
Read more →09Immediate Measures If You Cannot Patch Yet
If the PHP update is not yet possible, the interim measures from php.net reduce the risk but do not protect completely. How to set them correctly.
Read more →10PHP 8.1 and Older: What Applies Now
There are no official updates against PHP2Shell for PHP 8.1, 8.0, 7.4 and older versions. What the source backports offer and what the path to a supported version looks like.
Read more →11Patching PHP in Docker Containers
Containers do not patch themselves. Against PHP2Shell you have to rebuild or re-pull the PHP image and recreate every container from the new image.
Read more →12Am I Already Compromised? Signs After PHP2Shell
There are no confirmed indicators of compromise for PHP2Shell. How you can still tell whether your server was hacked, and how to check without destroying evidence.
Read more →Every hour counts. Write to us now.
Briefly describe your system, PHP version and observation. We will get back to you, clarify the situation and work remotely until the incident is closed and documented.