PHP2Shell Explained: Two Critical PHP Bugs You Need to Patch Right Now

If you run anything on PHP — a Laravel app, a WordPress site, a plain PHP API — stop reading after this paragraph and check your PHP version. On October 21, 2026, the PHP team released emergency fixes for two critical security bugs, together called PHP2Shell. They let an attacker run code on your server with one web request, with no login and no special setup. Attackers were already trying them before the public even knew.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you are below these, you are exposed.

Now, here is what happened, in simple words.

What is PHP2Shell?

PHP2Shell is the name given to two bugs deep inside PHP itself — not in Laravel, not in WordPress, not in any package you installed. They are in the engine that runs every PHP request.

• CVE-2026-109618 is about memory. When PHP runs out of memory in the middle of handling a request, some internal data is left half-built. PHP’s cleanup step then trusts that broken data as if it were fine. An attacker can shape a request so that this “trust” turns into running their own code.
• CVE-2026-109619 is about leftovers. PHP workers handle many requests one after another. Some data that belonged to one request can outlive the memory it was stored in. The next request on the same worker can pick it up before it is reset. Again, a careful attacker can turn that into code execution.

Both are rated CVSS 9.2, which is close to the top of the scale. Both can be triggered by a single unauthenticated HTTP request. Your application code never gets a chance to stop it, because the attack happens before your code runs.

The researchers who analysed the bugs say they have been in PHP for many years. Nobody noticed until now.

Who is affected?

Almost everyone. The bugs affect every common way of serving PHP:

• PHP-FPM (what most Laravel servers, Forge, and Docker images use)
• Apache with mod_php (the highest risk, because of how it shares memory)
• php-cgi
• FrankenPHP
• LiteSpeed

It does not matter which framework you use. Laravel, Symfony, WordPress, CodeIgniter, plain PHP — if the PHP binary underneath is old, the server is vulnerable.

Is this already being exploited?

Yes. Amazon’s threat intelligence team reported that one of its honeypots saw a PHP2Shell attack attempt on October 17 — four days before the bugs were made public. The traffic came from an anonymised IP. Nobody knows yet how the attacker learned the details early.

Since disclosure, security vendors have confirmed working exploits exist. The UK’s National Cyber Security Centre went as far as saying that systems which cannot be patched should be taken offline.

Some products are also affected because they ship PHP inside them. Palo Alto Networks has said all versions of PAN-OS and Panorama are affected and had no fix at the time of writing. Fortinet and Cisco were still checking their products.

How to check your version

On your server, run:

bash

php -v

If you use PHP-FPM, also check the FPM binary, because it can be a different version from the CLI:

bash

php-fpm8.3 -v   # adjust to your version

Or create a file with <?php phpinfo(); and open it in the browser (delete it afterwards). You need to see 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or higher.

Which PHP version do you need?

Your PHP branch	Safe version (or higher)	What to do
8.5	8.5.12	Update PHP, restart FPM or web server
8.4	8.4.27	Update PHP, restart FPM or web server
8.3	8.3.36	Update PHP, restart FPM or web server
8.2	8.2.35	Update PHP, restart FPM or web server
8.1, 8.0, 7.4	No official release	Apply the source patch or upgrade to a supported branch

If php -v shows a lower number than the one in the middle column, your server is exposed.

How to fix it

Ubuntu / Debian (Ondřej Surý PPA):

bash

sudo apt update && sudo apt upgrade php8.3-*   # or your version
sudo systemctl restart php8.3-fpm

Docker: pull the latest official image and rebuild.

bash

docker pull php:8.3-fpm

Laravel Forge: go to your server, open the PHP tab, and use “Update PHP” for each installed version. Restart FPM afterwards.

Laravel Vapor / Herd / Sail: update to the latest runtime, Herd release, or Sail image respectively, then redeploy.

Shared hosting: you cannot patch PHP yourself. Open a ticket with your host today and ask when they are rolling out the PHP2Shell fixes. If they cannot answer, that tells you something.

Remi repository users (RHEL, Rocky, Alma): at disclosure time, Remi had not yet published updated packages. Use your distribution’s own packages if available, or build from source.

Note that composer update does nothing here. This is not a package problem. Only updating PHP itself fixes it.

What if you are on PHP 8.1 or older?

PHP 8.1, 8.0 and 7.4 are no longer supported upstream, so there are no official releases for them. The PHP team did publish minimal source patches for these versions, meant for people who build from source or who do not have a vendor providing long-term support. Realistically, this is the push you needed to upgrade to a supported version.

If you cannot patch today

A few things reduce risk while you arrange the update:

• Cloudflare has deployed WAF rules for the known attack patterns, available on all plans including free.
• Searchlight Cyber released a free scanner, php2shell-scanner, to test whether a host is exposed from the outside.
• If you are on mod_php, consider switching to PHP-FPM, which has long been the recommended setup anyway.

These are stopgaps, not fixes. Patch as soon as you can.

Is Laravel affected?

Laravel is affected only because it runs on PHP. There is nothing to change in your Laravel code, your .env, or your composer.json. Update PHP, restart FPM, and you are done.

Patched? Now check you were not already hit

Updating PHP closes the hole. It does not remove anything an attacker may have left behind if they got in first. Exploit attempts were seen before the bugs were public, so a quick check is worth the time.

• Look for PHP files you did not create, especially in upload, cache and public folders.
• Check crontabs for every user, including www-data.
• Review web server and PHP-FPM logs from mid-October onwards for unusual requests or crashes.
• Look for new SSH keys, new system users or unexpected outbound connections.
• Rotate secrets stored in .env, such as database passwords, API keys and APP_KEY, if anything looks wrong.

If you find something suspicious, treat the server as compromised. Rebuild it from a clean image rather than trying to clean it in place.

Key takeaways

• PHP2Shell is two critical remote code execution bugs in PHP itself.
• One unauthenticated request is enough; your app code cannot block it.
• Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• Exploitation was spotted before public disclosure.
• Upgrade PHP today, restart your PHP-FPM or web server, and confirm with php -v.

This post will be updated as vendors release fixes and more details become public.

01Sources

• PHP 8 ChangeLog (official release notes)
• PHP Supported Versions
• CISA Known Exploited Vulnerabilities Catalog
• FIRST CVSS specification
• UK National Cyber Security Centre