PHP2Shell (CVE-2026-109618, CVE-2026-109619): How to Check and Patch Your Site

Robauto Team · Published Oct 22, 2026 · Last updated Oct 22, 2026

PHP2Shell is a pair of critical unauthenticated RCE flaws in PHP patched Oct 21, 2026. See who is affected, how to check your version with a free scan, and how to patch.

Short answer: "PHP2Shell" is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which PHP disclosed and patched on October 21, 2026. They can allow unauthenticated remote code execution on any PHP installation that serves web requests (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed). The fix is to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your vendor's patched package) now. You can run our free Robauto PHP Security Scan to see whether your site visibly runs PHP.

What PHP2Shell is

The PHP security team describes two bugs that share one root cause: when a request ends abnormally, PHP can leave internal memory in a corrupted state. According to the php.net security advisory:

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), RCE via OOM corruption: out-of-memory handling can interrupt PHP while request data is only partly initialized, and cleanup may then treat invalid data as valid.
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), RCE via stale global state: request-owned state can survive after its memory is freed, and a later request on the same worker may use it.

Both are rated CVSS v4.0 9.2 (critical). PHP says risk is highest for mod_php, where it has a demonstrated exploit that triggers before any application code runs. Code executes with the web worker account's privileges. "PHP2Shell" isn't a Robauto label. Advisories and news coverage use the same nickname (BleepingComputer, NHS England Digital).

Who is affected

PHP is often bundled inside other products (CMSs, appliances, containers), so you may be running it without knowing.

Timeline

How to check your exposure

Step 1: Run the free Robauto PHP Security Scan

Start from the outside with robauto.ai/php-scan. Enter your site and click Scan. The scan loads your homepage once and reads public signals: the PHP version your server announces (if any), PHP session cookies, and platform markers like WordPress or Drupal. Many well-configured servers hide their version, and the scan tells you when that's the case instead of guessing. It isn't a penetration test and doesn't probe for the vulnerability itself. Use it as a quick inventory check, then confirm on the server.

→ Scan your site free at robauto.ai/php-scan

Step 2: Check the version on the server

php -v
php-fpm -v            # or php-fpm8.3 -v, etc.
dpkg -l | grep php    # Debian/Ubuntu packages
rpm -qa | grep php    # RHEL/Alma/Rocky packages
docker run --rm your-image php -v

The CLI and web SAPIs can be different builds. To see what the web server actually runs, check your host's control panel or a temporary, access-restricted phpinfo() page, and delete it afterwards.

Step 3: Check the relevant settings

php -i | grep -E "memory_limit|post_max_size|upload_max_filesize|session.upload_progress.enabled|fatal_error_backtraces"

How to patch and mitigate

1. Update. Install 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's patched package (PHP says distros got the patches in advance). Restart every PHP worker after updating.
2. Internet-facing systems first. Start with public sites and any app that handles untrusted input.
3. Retire end-of-life PHP. On 8.1 or older, use an LTS vendor's backport or upgrade. If you rely on remirepo, PHP advises switching to distribution packages or building from source.
4. If you can't update today: PHP lists partial measures that reduce specific attack paths but don't make you safe. Examples are session.upload_progress.enabled=0 set in php.ini or the FPM pool, fatal_error_backtraces=0 on 8.5, a low post_max_size, and request-size limits at the proxy. A WAF may help temporarily. Several advisories recommend taking unpatched systems offline.
5. Watch your logs. Look for PHP workers launching shells, downloading tools, or making unexpected outbound connections.

FAQ

Is PHP2Shell being exploited?

Cloudflare reported seeing early attacks before the patches came out (BleepingComputer). You should assume attackers are scanning for it.

I use WordPress or Drupal. Am I affected?

Probably, if the server's PHP is unpatched. The flaw is in PHP itself, not in your CMS, so updating plugins won't fix it. Updating PHP will.

I'm on shared or managed hosting. What should I do?

Ask your host whether its PHP builds include the October 21 fixes, and check the PHP version in your control panel.

Does the Robauto scan prove I'm safe?

No. It reads public signals only and doesn't test for the vulnerability. A hidden version is good hygiene, but you still need to confirm the patch level on the server.

Is there a config-only fix?

No. PHP says there are no complete mitigations and updating is the only safe choice.

Do I need to restart after patching?

Yes. Restart PHP-FPM pools or Apache so every worker loads the patched binary.

Agent-ready summary

{
  "name": "PHP2Shell",
  "cves": ["CVE-2026-109618", "CVE-2026-109619"],
  "ghsa": ["GHSA-w8hw-w9fx-j79w", "GHSA-6wmf-4rv5-p3rp"],
  "severity": "CVSS v4.0 9.2 (critical), unauthenticated RCE",
  "disclosed": "2026-10-21",
  "affected": "All PHP serving web requests below 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; 8.1 and older (EOL)",
  "highest_risk": "Apache mod_php",
  "fixed_versions": ["8.5.12", "8.4.27", "8.3.36", "8.2.35"],
  "exploitation": "Early attacks reported by Cloudflare (via BleepingComputer)",
  "check": ["php -v", "https://robauto.ai/php-scan"],
  "advisory": "https://www.php.net/archive/2026.php"
}

Last updated: 2026-10-22 · Author: Robauto Team

Sources

• PHP.net security advisory, Oct 21 2026
• BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws
• NHS England Digital CC-4875
• Robauto PHP Security Scan

Where can an agent get this data live?

Robauto MCP — Agent Intelligence & Brand Discovery Infrastructure. A public, stateless Streamable HTTP endpoint at https://mcp.robauto.ai/mcp, callable with no key. Setup and the full tool list are in the Robauto MCP directory.

All blog posts