# PHP2Shell: everything about the critical PHP vulnerability

> PHP2Shell explained clearly: CVE-2026-109618 and CVE-2026-109619, affected versions, checking, restart and interim measures.

Source: https://phpsos.de/en/php2shell/  
As of: 25/10/2026  
Provider: PHP SOS, PHP emergency help and server security. Immediate help via WhatsApp: https://wa.me/491736494914?text=Hello%20PHP%20SOS%2C%20we%20need%20help%20with%20our%20PHP%20server.%20Company%3A%20%E2%80%A6%20Website%3A%20%E2%80%A6

Two critical vulnerabilities in PHP itself, CVSS 9.2, malicious code without login. Here is what is documented, which versions are safe and what you do now.

- [What Is PHP2Shell? The Vulnerability Explained Simply](https://phpsos.de/en/php2shell/was-ist-php2shell/): PHP2Shell is a pair of critical vulnerabilities in PHP itself that let attackers execute code on web servers without logging in. The situation in plain words.
- [CVE-2026-109618: RCE via Out-of-Memory Condition](https://phpsos.de/en/php2shell/cve-2026-109618/): CVE-2026-109618 is one of the two PHP2Shell vulnerabilities: an out-of-memory condition can interrupt PHP in the middle of request processing. Fixed from PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- [CVE-2026-109619: RCE via Stale Global State](https://phpsos.de/en/php2shell/cve-2026-109619/): CVE-2026-109619 is the second PHP2Shell vulnerability: a request's internal state can persist after memory is freed and be used by the next request in the same worker.
- [CVE-2026-115560: Session Upload Progress Advisory](https://phpsos.de/en/php2shell/cve-2026-115560/): CVE-2026-115560 is an advisory from php.net dated 23 October 2026: possible code execution only with an unusual session configuration. Remedy until the next release: session.upload_progress.enabled=0.
- [Which PHP Versions Are Affected?](https://phpsos.de/en/php2shell/betroffene-php-versionen/): PHP2Shell is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. There are no official updates for PHP 8.1 and older. The table shows the state per branch.
- [Checking the PHP Version and Patch Level Correctly](https://phpsos.de/en/php2shell/php-version-pruefen/): The displayed PHP version alone does not say whether PHP2Shell is closed. What matters are the package version, backports and whether the new processes are really running.
- [Why mod_php Carries the Highest Risk](https://phpsos.de/en/php2shell/mod-php-risiko/): With Apache and mod_php, the PHP team rates the PHP2Shell risk highest: an exploit was demonstrated there before application code runs. How to check and act.
- [After the Update: Restarting PHP-FPM and All Workers](https://phpsos.de/en/php2shell/php-fpm-neustart/): A PHP update only takes effect once all PHP processes have been restarted. The commands for PHP-FPM, Apache, LiteSpeed and containers, and how to verify the restart.
- [Immediate Measures If You Cannot Patch Yet](https://phpsos.de/en/php2shell/sofortmassnahmen-ohne-patch/): If the PHP update is not yet possible, the interim measures from php.net reduce the risk but do not protect completely. How to set them correctly.
- [PHP 8.1 and Older: What Applies Now](https://phpsos.de/en/php2shell/php-8-1-und-aelter/): There are no official updates against PHP2Shell for PHP 8.1, 8.0, 7.4 and older versions. What the source backports offer and what the path to a supported version looks like.
- [Patching PHP in Docker Containers](https://phpsos.de/en/php2shell/docker-container-patchen/): Containers do not patch themselves. Against PHP2Shell you have to rebuild or re-pull the PHP image and recreate every container from the new image.
- [Am I Already Compromised? Signs After PHP2Shell](https://phpsos.de/en/php2shell/bin-ich-gehackt-anzeichen/): There are no confirmed indicators of compromise for PHP2Shell. How you can still tell whether your server was hacked, and how to check without destroying evidence.