What is PHP2Shell?
PHP2Shell is the name used for two critical vulnerabilities in the PHP runtime. Under suitable conditions, attackers may execute code on affected servers without authentication. The PHP Security Team released security updates on 21 October 2026.
This is not a flaw in a single WordPress plugin. The decisive component is the PHP runtime behind the website. Keeping a CMS current therefore does not replace checking the PHP package level.
RCE via OOM corruption
When handling an out-of-memory condition, PHP may interrupt a request while internal data is not yet fully initialised. If that data is later treated as valid during request cleanup, exploitable memory corruption may result. The advisory rates the vulnerability critical with CVSS v4.0 9.2.
RCE via stale global state
A PHP worker may retain internal state even though the memory for the associated request has already been freed. A later request handled by the same worker may access this stale state. This vulnerability is also rated critical with CVSS v4.0 9.2.
Which PHP versions contain the fixes?
The minimum versions below apply only to CVE-2026-109618 and CVE-2026-109619. Version numbers are not interchangeable between PHP branches.
| PHP branch | Investigate below this level | Upstream fix for the two CVEs |
|---|---|---|
| PHP 8.2 | < 8.2.35 | 8.2.35 |
| PHP 8.3 | < 8.3.36 | 8.3.36 |
| PHP 8.4 | < 8.4.27 | 8.4.27 |
| PHP 8.5 | < 8.5.12 | 8.5.12 |
| 8.1 and older | No regular upstream support | Upgrade / LTS evidence |
Distributions and hosting providers may backport fixes. An older-looking version string therefore does not prove vulnerability. Ask for confirmation of the patch for the specific package.
The additional advisory of 23 October concerning CVE-2026-115560 / Session Upload Progress must be assessed separately. The version comparison is not a general security clearance.
What should website operators do?
- Inventory PHP installations and hosting packages. Prioritise publicly reachable systems.
- Have the hosting provider apply the appropriate security level and restart running workers.
- Document the package version, provider advisory and update time.
- Review additional configuration advisories. If the system was exposed, have potential compromise investigated as well.
An update does not automatically remove backdoors that may already have been installed. If there is concrete suspicion, an incident response investigation is advisable.
Can a PHP security checker clear my website?
No. Our check reads publicly visible HTTP headers and compares any detectable PHP version indicator with the published minimum versions. It does not trigger the vulnerabilities and cannot reliably detect hidden versions, every backend or vendor backports.
A result of “not detectable” is therefore an honest finding. Evidence requires information from the hosting panel, package management or confirmation from the operator.
Open the PHP website check ↗Sources and context
- PHP Security Team: security release of 21 October 2026 ↗
- CVE-2026-109618 / GHSA-w8hw-w9fx-j79w ↗
- CVE-2026-109619 / GHSA-6wmf-4rv5-p3rp ↗
- PHP: additional advisory of 23 October 2026 ↗
- NCSC: recommendations for PHP2Shell ↗
Editorial first orientation by HANECS, not a penetration test or an assurance of security. No automatic updates: this briefing reflects information reviewed on 26 October 2026.