# PHP2Shell (CVE-2026-109618, CVE-2026-109619): How to Check and Patch Your Site

PHP2Shell is a pair of critical unauthenticated RCE flaws in PHP patched Oct 21, 2026. See who is affected, how to check your version with a free scan, and how to patch.

Canonical: https://robauto.ai/blog/php2shell-check-your-site

Robauto Team · Published Oct 22, 2026 · Last updated Oct 22, 2026

PHP2Shell is a pair of critical unauthenticated RCE flaws in PHP patched Oct 21, 2026. See who is affected, how to check your version with a free scan, and how to patch.

**Short answer:** "PHP2Shell" is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which PHP disclosed and patched on October 21, 2026. They can allow unauthenticated remote code execution on any PHP installation that serves web requests (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed). The fix is to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your vendor's patched package) now. You can run our free [Robauto PHP Security Scan](https://robauto.ai/php-scan) to see whether your site visibly runs PHP.

## **What PHP2Shell is**

The PHP security team describes two bugs that share one root cause: when a request ends abnormally, PHP can leave internal memory in a corrupted state. According to the [php.net security advisory](https://www.php.net/archive/2026.php):

- **CVE-2026-109618 (GHSA-w8hw-w9fx-j79w), RCE via OOM corruption:** out-of-memory handling can interrupt PHP while request data is only partly initialized, and cleanup may then treat invalid data as valid.

- **CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), RCE via stale global state:** request-owned state can survive after its memory is freed, and a later request on the same worker may use it.

Both are rated CVSS v4.0 9.2 (critical). PHP says risk is highest for mod_php, where it has a demonstrated exploit that triggers before any application code runs. Code executes with the web worker account's privileges. "PHP2Shell" isn't a Robauto label. Advisories and news coverage use the same nickname ([BleepingComputer](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/), [NHS England Digital](https://digital.nhs.uk/cyber-alerts/2026/cc-4875)).

## **Who is affected**

PHP branch / setupStatusFixed inSource

PHP 8.5.x before 8.5.12Vulnerable8.5.12[php.net](https://www.php.net/archive/2026.php)
PHP 8.4.x before 8.4.27Vulnerable8.4.27[php.net](https://www.php.net/archive/2026.php)
PHP 8.3.x before 8.3.36Vulnerable8.3.36[php.net](https://www.php.net/archive/2026.php)
PHP 8.2.x before 8.2.35Vulnerable (8.2 EOL Dec 31, 2026)8.2.35[php.net](https://www.php.net/archive/2026.php)
PHP 8.1, 8.0, 7.4 and olderVulnerable, end of lifeVendor/LTS backports, PHP source-only backports for 7.4–8.1, or upgrade[php.net](https://www.php.net/archive/2026.php)
mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeedAll web-serving SAPIs at risk; mod_php highestPatch PHP itself[BleepingComputer](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/)

PHP is often bundled inside other products (CMSs, appliances, containers), so you may be running it without knowing.

## **Timeline**

Date (2026)Event

Oct 20PHP pre-announces a critical security release for Oct 21 at 14:00 UTC, with two CVSS 9.2 issues ([php.net](https://www.php.net/archive/2026.php)).
Oct 20–21Before the release, Cloudflare said it was already seeing early attacks and had deployed temporary WAF rules ([BleepingComputer](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/)).
Oct 21PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are released with the full advisory. National cyber agencies issue alerts the same day ([NHS England Digital](https://digital.nhs.uk/cyber-alerts/2026/cc-4875)).
Oct 22This guide published.

## **How to check your exposure**

### **Step 1: Run the free Robauto PHP Security Scan**

Start from the outside with [robauto.ai/php-scan](https://robauto.ai/php-scan). Enter your site and click Scan. The scan loads your homepage once and reads public signals: the PHP version your server announces (if any), PHP session cookies, and platform markers like WordPress or Drupal. Many well-configured servers hide their version, and the scan tells you when that's the case instead of guessing. It isn't a penetration test and doesn't probe for the vulnerability itself. Use it as a quick inventory check, then confirm on the server.

[→ Scan your site free at robauto.ai/php-scan](https://robauto.ai/php-scan)

### **Step 2: Check the version on the server**

```
`php -v
php-fpm -v # or php-fpm8.3 -v, etc.
dpkg -l | grep php # Debian/Ubuntu packages
rpm -qa | grep php # RHEL/Alma/Rocky packages
docker run --rm your-image php -v`
```

The CLI and web SAPIs can be different builds. To see what the web server actually runs, check your host's control panel or a temporary, access-restricted `phpinfo()` page, and delete it afterwards.

### **Step 3: Check the relevant settings**

```
`php -i | grep -E "memory_limit|post_max_size|upload_max_filesize|session.upload_progress.enabled|fatal_error_backtraces"`
```

## **How to patch and mitigate**

- **Update.** Install 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's patched package (PHP says distros got the patches in advance). Restart every PHP worker after updating.

- **Internet-facing systems first.** Start with public sites and any app that handles untrusted input.

- **Retire end-of-life PHP.** On 8.1 or older, use an LTS vendor's backport or upgrade. If you rely on remirepo, PHP advises switching to distribution packages or building from source.

- **If you can't update today:** PHP lists partial measures that reduce specific attack paths but don't make you safe. Examples are `session.upload_progress.enabled=0` set in php.ini or the FPM pool, `fatal_error_backtraces=0` on 8.5, a low `post_max_size`, and request-size limits at the proxy. A WAF may help temporarily. Several advisories recommend taking unpatched systems offline.

- **Watch your logs.** Look for PHP workers launching shells, downloading tools, or making unexpected outbound connections.

## **FAQ**

### **Is PHP2Shell being exploited?**

Cloudflare reported seeing early attacks before the patches came out ([BleepingComputer](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/)). You should assume attackers are scanning for it.

### **I use WordPress or Drupal. Am I affected?**

Probably, if the server's PHP is unpatched. The flaw is in PHP itself, not in your CMS, so updating plugins won't fix it. Updating PHP will.

### **I'm on shared or managed hosting. What should I do?**

Ask your host whether its PHP builds include the October 21 fixes, and check the PHP version in your control panel.

### **Does the Robauto scan prove I'm safe?**

No. It reads public signals only and doesn't test for the vulnerability. A hidden version is good hygiene, but you still need to confirm the patch level on the server.

### **Is there a config-only fix?**

No. PHP says there are no complete mitigations and updating is the only safe choice.

### **Do I need to restart after patching?**

Yes. Restart PHP-FPM pools or Apache so every worker loads the patched binary.

## **Agent-ready summary**

```
`{
"name": "PHP2Shell",
"cves": ["CVE-2026-109618", "CVE-2026-109619"],
"ghsa": ["GHSA-w8hw-w9fx-j79w", "GHSA-6wmf-4rv5-p3rp"],
"severity": "CVSS v4.0 9.2 (critical), unauthenticated RCE",
"disclosed": "2026-10-21",
"affected": "All PHP serving web requests below 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35; 8.1 and older (EOL)",
"highest_risk": "Apache mod_php",
"fixed_versions": ["8.5.12", "8.4.27", "8.3.36", "8.2.35"],
"exploitation": "Early attacks reported by Cloudflare (via BleepingComputer)",
"check": ["php -v", "https://robauto.ai/php-scan"],
"advisory": "https://www.php.net/archive/2026.php"
}`
```

Last updated: 2026-10-22 · Author: Robauto Team

## Sources

- [PHP.net security advisory, Oct 21 2026](https://www.php.net/archive/2026.php)
- [BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws](https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/)
- [NHS England Digital CC-4875](https://digital.nhs.uk/cyber-alerts/2026/cc-4875)
- [Robauto PHP Security Scan](https://robauto.ai/php-scan)

## Where can an agent get this data live?

**Robauto MCP — Agent Intelligence & Brand Discovery Infrastructure.** A public, stateless Streamable HTTP endpoint at `https://mcp.robauto.ai/mcp`, callable with no key. Setup and the full tool list are in the [Robauto MCP directory](https://robauto.ai/mcp-directory).

[All blog posts](/blog)

---

(c) 2026 Robauto, Inc. — support@robauto.ai
Machine surfaces: https://robauto.ai/llms.txt · https://robauto.ai/llms-full.txt · https://robauto.ai/.well-known/api-catalog