PHP2Shell is the public name for two critical defects in the PHP runtime, disclosed on 21 October 2026. They are CVE-2026-109618 and CVE-2026-109619. PHP rates both CVSS v4.0 9.2 and says both can allow unauthenticated remote code execution.
The component to update is PHP itself. Nginx, Apache, WordPress, Laravel, and a plugin update do not replace the runtime that parses the request.
Who is in scope
PHP’s advisory says every installation that serves web requests is at risk. The list includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. PHP considers the risk highest for mod_php, where a demonstrated exploit can run before application code.
PHP-FPM is not a safe exception. For CVE-2026-109619, PHP validated a session-lifecycle remote code execution path against FPM. For CVE-2026-109618, PHP’s source analysis treats FPM as susceptible, and the advisory says no complete FPM exploit was demonstrated.
The fixes PHP shipped
Install PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or a vendor package whose advisory names both CVEs. PHP 8.1 and older no longer receive updates from the PHP project. PHP also published minimal source backports for 7.4, 8.0, and 8.1. Those branches are not tagged releases.
CISA’s alert of the same day said organizations that cannot update, including those still on PHP 8.1 or earlier, should take PHP-based systems offline until they can be patched or updated. PHP’s own temporary settings reduce specific paths and are not a complete fix.
What to do first
Identify the PHP binary that answers HTTP, including every FPM pool and every Apache module. Compare it with the fixed upstream release or with your distribution’s errata. Restart the workers after the change and check the running service again.
Consulting on this site covers that work for current and legacy PHP, from 5.6 upward. Coverage of a legacy branch is a remediation engagement. It is not a claim that the PHP project shipped a patch for that branch.
Questions
Is PHP2Shell a WordPress vulnerability?
No. WordPress and other PHP applications run on the PHP runtime. The defects are in that runtime.
Which release should I install?
PHP named 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Distribution packages can carry the same fix under an older upstream version string.