PHP2Shell: what we know

Last checked: 2026-10-21 14:12 UTC

Status: fixed releases available, update now

This page lists only confirmed facts, each with its source and the time we checked it. We update it when a primary source changes. We do not repeat unconfirmed claims.

Confirmed facts

• On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to php.net these releases fix two critical vulnerabilities that can allow unauthenticated remote code execution, and all PHP users are strongly encouraged to update immediately.

  Source: php.net security advisory · checked 2026-10-21 14:07 UTC

• php.net names as at risk all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. php.net considers the risk highest for mod_php and mentions a demonstrated exploit (a proof that the attack works) in which an unauthenticated request triggers the attack before any application code runs. php.net and CISA have not reported exploitation in the wild.

  Source: php.net security advisory · checked 2026-10-21 14:07 UTC

• The PHP project published CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state) on cve.org at 13:48 and 13:54 UTC. Both records list as affected: 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12. The CVE records from the PHP Group give each CVSS v4.0 9.2 (network, high attack complexity, no privileges or user interaction needed). The NVD has not yet published its own record (checked 14:06 UTC).

  Source: cve.org (CNA: PHP Group) · checked 2026-10-21 14:06 UTC

• PHP 8.1 and older no longer receive updates from the PHP project. Older versions are not listed in the CVE records, but given the severity the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1, so treat those versions as affected. Some distributions and LTS vendors provide backported fixes. php.net also warns that the volunteer-run rpms.remirepo.net will not have updates today.

  Source: php.net security advisory · checked 2026-10-21 14:07 UTC

• The CISA Known Exploited Vulnerabilities catalog (version of 20 October 2026, 19:00 UTC) does not list these vulnerabilities. Exploitation in the wild is not confirmed by php.net or CISA at this time.

  Source: CISA KEV · checked 2026-10-21 14:06 UTC

Still unknown

• Whether the vulnerabilities are being exploited in the wild
• When the NVD publishes its analysis
• When your hosting provider or Linux distribution ships updated packages

What you can do now

1. Check which PHP version each of your sites runs. Your hosting panel or a phpinfo page shows it.
2. On PHP 8.2 to 8.5: update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or ask your hosting provider when they do.
3. On PHP 8.1 or older: the PHP project no longer ships updates. Ask your vendor for a backported fix, or plan an upgrade to a supported version.
4. If you cannot update today: php.net lists temporary settings that reduce exposure but do not make a site safe. Use them only as a stopgap.
5. Make a fresh backup of files and database before you update.

Frequently asked questions