PHP2Shell Fix
Get Expert Help
CloudflareWAF & DDoS protection for PHP apps at the edge
AdvertiseOpen placement
SucuriWebsite firewall and malware cleanup for PHP sites
PatchstackWordPress vulnerability protection before attackers hit
AdvertiseOpen placement
AdvertiseOpen placement
AdvertiseOpen placement
AdvertiseOpen placement
AdvertiseOpen placement
AdvertiseOpen placement

Critical PHP security advisory

PHP2Shell Fix: Find the Right Fix for Your PHP Server

Protect PHP 5.6+ Infrastructure

Clear remediation guides for Nginx, Apache and legacy PHP environments. Identify your exposure and find the right solution.

Find Your FixGet Expert Help
CVEs
2 Critical
CVSS v4.0
9.2
Disclosed
October 21, 2026
Status
Fixes Available

Updating the PHP runtime is the only complete remediation.

WAF rules and configuration changes are temporary risk-reduction measures, not replacements for patching. Read the official PHP announcement.

Client-side only

Is Your PHP Version Affected?

Nothing you enter is uploaded. The result classifies the version string you supply. It does not scan a website and it does not declare a server fully secure.

Documented vendor backport

Fix by environment

Open the guide that matches the stack you actually run in production.

Nginx + PHP-FPMSocket, pool, and the binary that actually accepts requests.Apache + mod_phpThe SAPI PHP ranks as the highest demonstrated risk.Apache + PHP-FPMproxy:fcgi and SetHandler, including more than one pool.DebianSecurity-tracker package versions, not the upstream string alone.UbuntuFixed package revisions from USN-8948, including ESM releases.CentOS / RHELBackports keep older upstream version numbers.DockerThe image digest and the PHP inside the container.KubernetesThe running pods, not only the manifest you intended to roll.WordPressApplication updates do not replace the PHP runtime.Legacy PHPConsulting from PHP 5.6 upward, without inventing a patch.

Supported upstream branches and the legacy line

Upstream end-of-life dates come from php.net. A vendor can still ship a backport after that date. Open the guide before you treat a version string as a fix.

BranchUpstream lifecyclePHP2Shell status
PHP 5.6EOL 31 Dec 2018No upstream PHP2Shell release
PHP 7.4EOL 28 Nov 2022Source backport only
PHP 8.0EOL 26 Nov 2023Source backport only
PHP 8.1EOL 31 Dec 2025Source backport only
PHP 8.2Security fixes until 31 Dec 2026Fixed in 8.2.35
PHP 8.3Security fixes until 31 Dec 2027Fixed in 8.3.36
PHP 8.4Active supportFixed in 8.4.27
PHP 8.5Active supportFixed in 8.5.12

Legacy PHP consulting

Still Running PHP 5.6? We Can Help.

Legacy PHP environments require more than a standard update. Whether you are running PHP 5.6, PHP 7.x, or a newer release, our specialists can help you evaluate security risks, identify an appropriate remediation strategy, and protect business-critical applications.

Support for a version means we will work on a plan for it. It does not mean that version has a verified upstream patch. PHP 5.6, and every branch older than the 7.4, 8.0, and 8.1 source backports, needs a vendor fix, a migration, or another control that is honest about the gap.

Get Help With Legacy PHPExplore PHP Version Guides

How we work

A calm sequence from inventory to verification, without inventing a patch that does not exist.

  1. 01

    Assess your environment

    Identify the web SAPI, the package channel, and the versions that are actually loaded.

  2. 02

    Identify the safest supported fix

    Choose a fixed upstream release, a verified vendor backport, or a migration when neither exists.

  3. 03

    Implement with rollback planning

    Stage the change, keep the previous build recoverable, and restart the right workers.

  4. 04

    Validate the remediation

    Confirm the running binary and the application paths you depend on.

Documentation

Start with the most used remediation and verification guides.

RemediationHow to fix PHP2Shell on a server you operateChoose a fixed upstream release or a verified vendor package, restart the right workers, and validate the running SAPI.Verified 2026-10-22 · 3 minOperationsHow to check whether your PHP runtime is in the fixed rangeSeparate CLI PHP, PHP-FPM, Apache modules, and package metadata before you decide a server is patched.Verified 2026-10-22 · 3 minNginxRemediate PHP2Shell for Nginx with PHP-FPMMap each Nginx vhost to its PHP-FPM pool, patch that build, and restart the workers.Verified 2026-10-22 · 3 minApacheApache mod_php is the highest-risk PHP2Shell setupWhy PHP ranks mod_php highest, how to confirm it is loaded, and what to restart after the patch.Verified 2026-10-22 · 3 minPHP versionPHP 5.6 and PHP2ShellLifecycle, upstream PHP2Shell status, and vendor-package limits for PHP 5.6.Verified 2026-10-22 · 3 minPHP versionPHP 8.2 and PHP2ShellLifecycle, upstream PHP2Shell status, and vendor-package limits for PHP 8.2.Verified 2026-10-22 · 3 min

Frequently asked questions

Does updating WordPress or Laravel fix PHP2Shell?

No. The vulnerable component is the PHP runtime that executes the application. Update that runtime, or install a vendor build whose advisory names both CVEs.

Is PHP-FPM safe because the confirmed mod_php case is worse?

No. PHP says every web SAPI is in scope. A session-lifecycle remote code execution path was validated against PHP-FPM for CVE-2026-109619.

Can a WAF replace the patch?

PHP says the only complete fix is a release that contains the patch. A WAF or a tighter request limit can reduce exposure while you schedule that change.

Why does my package still show PHP 8.3.6?

Distributions backport fixes. Ubuntu 24.04 published a fixed php8.3 package that keeps an 8.3.6 upstream version string. Compare the package revision with USN-8948-1.

Do you support PHP 5.6?

The consulting scope includes PHP 5.6 and later. That is not the same as an upstream patch. PHP 5.6 has no tagged PHP2Shell release.

Need Help Securing a Critical PHP Server?

Get practical assistance with legacy PHP, production infrastructure, and complex remediation requirements.

Request a Remediation Consultation

Advertise on PHP2Shell Fix

Reach 200K+ security teams and PHP administrators every month

200K+Monthly security visitors
High-intentOperators, not browsers
20Rotating faces

How it works

Your security product appears in rotating sponsor slots on desktop sidebars and mobile banners across all PHP2Shell Fix pages. Sponsors flip every 20 seconds so each placement gets fair visibility among all advertisers.

Pricing

Monthly rate: $1,499/month

Placements available. Cancel anytime.

Get started ($1,499/mo)

What sponsors say

Maya Chen · Cloudflare

★★★★★

PHP2Shell Fix put our WAF in front of admins mid-incident. We saw 2,400+ qualified clicks in the first month and a clear lift in trial starts from PHP teams.

Jordan Blake · Sucuri

★★★★★

Best channel we have tested for malware cleanup demand. Sponsoring here turned out to be one of the best marketing decisions this quarter for reaching hosts still running exposed PHP.

Elena Voss · Patchstack

★★★★★

WordPress agencies found us while checking CVE guides. The sidebar placement drove 180+ demo requests and kept our brand next to the remediation workflow.