Security advisory
PHP2Shell: two critical PHP flaws let attackers run code on your server
On 21 October 2026, the PHP project released emergency fixes for two critical flaws. An attacker on the internet can use them to run code on a PHP web server without signing in. Attack attempts have already been reported. Every organization that runs PHP should check its version today.
Published · Last updated
- Severity
- Critical (CVSS 9.2)
- Identifiers
- CVE-2026-109618, CVE-2026-109619
- Fixed in
- PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35
- Status
- Fixes available. Attack attempts reported.
Check a website now
Enter a website address. We read the PHP version that the server shows to every visitor, and compare it with the fixed versions.
We only read the response headers that any visitor can see. We do not test for the flaw, send attack traffic, or keep the address you enter.
Which PHP versions are affected
Every PHP version before the fixed releases below is affected. The flaws reach back to PHP 5.4.
| PHP branch | Affected | Fixed in | Security support ends |
|---|---|---|---|
| 8.5 | Before 8.5.12 | 8.5.12 | 31 December 2029 |
| 8.4 | Before 8.4.27 | 8.4.27 | 31 December 2028 |
| 8.3 | Before 8.3.36 | 8.3.36 | 31 December 2027 |
| 8.2 | Before 8.2.35 | 8.2.35 | 31 December 2026 |
| 8.1 and older | All versions | No fix | Ended |
PHP 8.2 stops getting security fixes on 31 December 2026. If you update an 8.2 server now, plan the move to 8.4 or 8.5 at the same time.
Which server setups are at risk
The risk depends on how PHP runs on your server.
- Apache with mod_php
- Highest riskAttacks that run code were confirmed. The attack works before any of your own code runs.
- PHP-FPM (nginx, Apache with FPM)
- At riskThe advisories rate it as susceptible under some conditions. Treat it as affected.
- LiteSpeed (LSAPI)
- Likely at riskNot confirmed, but likely affected. Treat it as affected.
- FrankenPHP
- Possibly at riskOne of the two flaws is likely to affect it. Update to be safe.
How to check your servers
Run these commands on each server, or ask your hosting provider.
1. Show the PHP version
php -v2. Show how PHP runs on the web server
php -i | grep "Server API"3. Check the web server version, not only the command line. Create a page with this code, open it once, and then delete it.
<?php echo PHP_VERSION; ?>
The command-line PHP and the web server PHP can be different versions. Always check both.
How to fix it
- Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or to a later version.
- Restart every PHP process: Apache, PHP-FPM, LiteSpeed, and all containers. A server that is not restarted still runs the old code.
- On shared hosting or cPanel, choose a fixed version in MultiPHP Manager, or ask your provider to confirm the update.
- In Docker, rebuild your images from an updated php base image, and redeploy them.
- If you run PHP 8.1 or older, move to PHP 8.4 or 8.5. No fix exists for old versions.
If you cannot update today
These settings reduce the risk until you can update. They do not fully fix the flaws.
Turn off upload progress tracking
session.upload_progress.enabled = 0This blocks the attack path that was demonstrated. The PHP project suggests keeping it off after you update, if you do not need it.
PHP 8.5 only: turn off fatal error backtraces
fatal_error_backtraces = 0This removes one confirmed way to trigger the flaw.
Block large or unusual uploads at the front end
post_max_size, max_input_nesting_levelKeep request size limits low. If your site does not accept file uploads, block multipart requests at the proxy or firewall.
Restart all PHP workers after you change these settings.
Sources
Need help?
If you are not sure whether your servers are safe, send us a question. We reply in plain language within two business days.
Ask a security question