Is your website vulnerable to
PHP2Shell?

What is PHP2Shell: the critical 2026 PHP vulnerability, explained clearly

PHP is the invisible engine behind most websites: WordPress, online shops, intranets. Two serious flaws have been found in that engine.

PHP2Shell is the name given to two critical vulnerabilities in the PHP core, disclosed and fixed on October 21, 2026, and rated 9.2 out of 10 on the CVSS 4.0 scale. The flaws allow someone, without any access or password, to send your website a crafted request and run their own commands on the server. If that happened, they could modify the website, access the data it stores or use it to attack others. They affect practically every PHP version that hasn’t been updated, and the risk is higher on servers that use mod_php.

Does it affect my website? Affected and fixed PHP versions

If your website uses PHP and hasn’t been updated since October 21, 2026, it could be exposed. You don’t need to know which version you have: the checker above gives you a first clue and, if it can’t be seen from the outside, below you’ll find what to ask.

As a visitor to other websites, you can browse as usual. These flaws affect the server, not your computer or phone.

What to do if someone else runs your website

You don’t have to touch anything. You just have to ask. Copy this email and send it to your hosting provider or whoever built your website:

If you don’t get a clear answer within 48 hours, that’s a sign in itself. A website needs someone to look after it.

How to update PHP against PHP2Shell, step by step

The real fix is to update PHP. Mitigations only reduce exposure in the meantime.

1. Step 1 · Check your version and your SAPI

   On the server, check which version is running and how (mod_php, PHP-FPM or CGI):

   php -v
   php -i | grep -i "Server API"

   If you use your system’s packages, also check your distro’s changelog: the fix may have been applied without the version number changing.

2. Step 2 · Update to the fixed version

   8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 depending on your branch. Examples:

   # Debian / Ubuntu
   sudo apt update && sudo apt upgrade php*
   
   # RHEL / AlmaLinux / Rocky
   sudo dnf update php\*

   With Docker, switch to the fixed image tag and rebuild.

3. Step 3 · Restart all PHP workers

   The update doesn’t take effect until the processes are restarted. Several mitigations don’t work through ini_set() or .user.ini either: you have to restart.

   sudo systemctl restart php8.3-fpm   # or your version
   sudo systemctl restart apache2      # if you use mod_php

4. Step 4 · If you can’t update yet: temporary mitigations

   Apply them in the effective configuration (the web SAPI’s php.ini or the FPM pool), so the application can’t override them, and restart the workers. They are not a substitute for updating.

   ; php.ini (against CVE-2026-109619)
   session.upload_progress.enabled = 0
   
   ; (against CVE-2026-109618)
   memory_limit = -1

   On the web server or proxy: block multipart/form-data if you don’t need it and lower post_max_size. On PHP 8.5, disable backtraces on fatal errors.

5. Step 5 · Start with what’s most exposed

   First, public-facing systems and those using mod_php. Then control panels like cPanel/Plesk and applications such as WordPress, Drupal, Magento or Laravel, which are exposed through the PHP core.

6. Step 6 · Check everything is fine and look for signs of earlier access

   After updating, check whether anyone could have exploited the flaw beforehand: spikes in multipart requests followed by memory errors or repeated 500s, unusual PHPSESSID cookies, unexpected worker restarts, modified PHP files or webshells, new admin users or odd outbound connections. If in doubt, rotate passwords, API keys and tokens on the exposed PHP systems.

A reliable check is done on the server

What this website reads from the outside is a clue, not proof. This is what’s reliable:

# Which version is actually running?
php -v

# Does the system package include the fix? (look for the CVEs in the changelog)
# Debian/Ubuntu:
zcat /usr/share/doc/php*/changelog.Debian.gz 2>/dev/null | grep -i "109618\|109619"
# RHEL-like:
rpm -q --changelog php | grep -i "109618\|109619"

Frequently asked questions about PHP2Shell