PHP2Shell: what website owners need to check
On October 21, 2026, PHP released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 under CVSS v4 and can allow someone without a login to run code on an affected, unpatched server. The PHP team recommends updating immediately.
The update belongs in the PHP runtime serving your website. Updating WordPress or another application alone does not install it.
What happened?
The issues are in core PHP. One involves memory handling when a request runs out of memory. The other involves internal state that can persist between requests. Researchers demonstrated remote code execution against WordPress, Drupal, and Joomla in controlled tests, as well as disclosure of PHP process memory. Those examples show possible impact; they do not establish that any particular site has been compromised.
PHP lists web-serving installations using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed as potentially affected. A public website scan or a response header cannot reliably tell you whether the serving PHP runtime has been patched, especially when a vendor has backported the fix.
Which versions contain the fix?
These are the first fixed upstream PHP releases. A newer release on the same branch also includes the fix.
| PHP branch | First fixed release |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
Linux distributions and long-term-support vendors may provide a patched package without changing the upstream version number. For PHP 8.1 or older, ask the vendor about a supported backport or plan an upgrade to a supported branch. The PHP team also published minimal source backports for 7.4, 8.0, and 8.1 for teams that build PHP themselves.
What to ask your hosting provider
- Which PHP runtime serves web requests? A command-line version or control panel setting may refer to a different installation. Ask for the version and package or build used by the website.
- Where did the fix come from? Confirm the fixed upstream release or a vendor advisory and package containing the backport.
- Were the workers restarted? Apache, PHP-FPM, and other long-running PHP workers need to use the updated build.
- Does the site still work? Test the paths your customers use, including forms, bookings, logins, payments, and uploads where relevant.
PHP describes temporary configuration measures for teams that cannot update immediately, but only the update fully addresses these vulnerabilities. The advisory explains the limits of those measures.
At Solarium, we patched our affected hosted sites within two hours of the release and notified customers. If you cannot get a clear answer from your host, send us your website address. We can help verify the serving runtime and coordinate a fix at no charge. Please do not send credentials or client data.