What is the PHP Patch for php2shell from Oct 2026?

What is the PHP Patch for php2shell from Oct 2026?

In late October 2026, cybersecurity teams and web development agencies like Wirebox were informed about a critical PHP vulnerability. Dubbed php2shell and tracked as CVE-2026-109618 and CVE-2026-109619, these vulnerabilities carry a CVSS v4.0 rating of 9.2. They allow unauthenticated remote code execution across millions of web applications running on unpatched PHP environments. And because PHP powers over 70% of the web, platforms like WordPress, Magento, Laravel and custom web systems are all exposed at the engine level regardless of how secure their application code might be. 

What is the php2shell vulnerability?

The php2shell flaws stem from memory corruption issues within PHP core request handling mechanisms:

• CVE-2026-109618 triggers when an out-of-memory error interrupts PHP’s request parsing. When execution drops, incomplete internal request states are not properly cleaned up, causing memory corruption that lets an attacker execute arbitrary code or expose sessions.
• CVE-2026-109619 is a use-after-free vulnerability tied to PHP global state tracking during file upload parsing and session handling. Attackers can craft malicious request payloads to trigger stale memory access and gain unauthorised server access.

Both flaws operate below the application layer, and that means security plugins and application-level sanitisation can’t block these attacks because PHP parses incoming requests before user application code executes.

What’s the fix?

The PHP release engineering team released targeted security updates to address these gaps. So, to secure your environment fully, your server must be updated to one of the following official fixed releases:

For sites running end-of-life versions (PHP 8.1 and earlier), no official releases exist, but minimal source backport patches were made available. However, upgrading to a supported branch like PHP 8.2+ is the recommended solution.

Steps to patch your server

Applying this php2shell patch requires administrative access to your web server or hosting platform. (And, FYI, a software patch on disk doesn’t take effect until active memory pools are recycled.)

1. Update package repositories

On Linux environments, update your package manager and install the updated PHP engine binaries:

• Ubuntu/Debian – run apt update && apt upgrade php
• RHEL/CentOS – run dnf update php

Confirm the version by running php -v in the CLI to verify that your system is running version 8.2.35, 8.3.36, 8.4.27 or 8.5.12.

2. Restart execution workers

Installing the update replaces files on disk, but active web server processes still hold the vulnerable code in memory. You must reload your processing pool:

• PHP-FPM setups – run systemctl reload php8.3-fpm (substituting your PHP version)
• Apache setups – run systemctl reload apache2 or systemctl reload httpd

3. Rebuild container images

If your infrastructure runs on Docker or Kubernetes, pull updated base images containing the patched PHP versions and deploy fresh worker containers.

Fixes if you can’t patch immediately

If server updates must be delayed for compatibility testing, you can do these temp steps now:

• Disable session upload progress – in your php.ini or FPM pool configuration, set session.upload_progress.enabled = 0 and restart workers. This closes the main vector for CVE-2026-109619.
• Adjust memory limits – set memory_limit = -1 in your FPM pool via php_admin_value to reduce predictable out-of-memory triggers associated with CVE-2026-109618.
• Block unused multipart uploads – if your application does not require file uploads, configure your web server (Nginx/Apache) to return a 403 status on multipart/form-data content types.

But this is just a temporary measure, and you’ll want to get properly protected ASAP. Partnering with an experienced web support agency like Wirebox ensures your platform software, PHP execution environment and server dependencies are patched before the worst happens.