PHP2Shell: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two flaws that let attackers run code

PHP, the language many websites run on, has two flaws in its core that let an outsider run commands on a web server without logging in. PHP released fixes on 21 October 2026 ¹, four days after Amazon recorded the first attack attempt ⁶. Sansec credits the exploit (attack code) that combines both flaws, called PHP2Shell, to the research firm Calif ¹⁵.

A CVE (Common Vulnerabilities and Exposures) number is the public ID of one flaw. A SAPI (server API) is the way PHP connects to a web server. php-fpm is a pool of PHP worker processes that nginx or Apache sends requests to; mod_php runs PHP inside Apache's own processes.

Two CVEs, both rated 9.2 out of 10, let attackers run code on the server

CVE-2026-109618: a request that exhausts memory_limit makes PHP abort while it is starting up, and the cleanup that follows treats half-built data as valid ². CVE-2026-109619: state from one request keeps pointing at memory that request owned, and a later request on the same worker (the process that handles requests) uses the freed memory ³. Both lead to remote code execution (RCE: an outsider runs commands on the server) with the web worker's privileges ²³.

PHP scores each 9.2 on CVSS v4, a 0-to-10 severity scale, with attack complexity rated high ²³. NVD adds a CVSS 3.1 score of 9.8 for CVE-2026-109618 ⁴. The PHP Foundation states that a score of 10.0 that circulated before the release was wrong ⁵.

mod_php is the most exposed setup; php-fpm depends on the application

PHP's advisory lists five affected setups: Apache mod_php, php-fpm, php-cgi, FrankenPHP and LiteSpeed. It rates mod_php highest, because an unauthenticated request reaches the first flaw before any application code runs ¹, and the advisory demonstrated it with default memory and input limits ².

For php-fpm the sources differ:

• CVE-2026-109618: the advisory's source analysis calls FPM susceptible but shows no full exploit; FPM exits the worker when startup fails ².
• CVE-2026-109619: FPM is exposed through a frontend that passes PHP_VALUE settings, or through session upload progress, which was validated ³.
• Calif demonstrated FPM behind nginx where the application decodes data after startup (session_start(), unserialize()) and lists pre-login code execution on WordPress 7.1.2, Drupal 11.4.3 and Joomla 6.1.4 ¹⁶.
• Red Hat: reliable exploitation needs precise heap manipulation, and FPM workers exit on early failure ¹². Sansec: a researcher found public proofs of concept fail on default installs and mostly need a separate file-inclusion bug in the target ¹⁵.

The advisory does not cover servers without PHP or machines that run PHP only for command-line scripts; it covers PHP that serves web requests ¹. RHEL 7 is not affected by CVE-2026-109618, only by CVE-2026-109619 ¹².

Attacks began on 17 October, four days before the fix

Amazon's honeypot network (decoy servers that record attacks) logged the first attempt on 17 October from an anonymization network. On 21 October between 02:00 and 08:00 UTC more attempts arrived with varied payloads, which suggests several attackers; Amazon cannot say whether any would have worked on a real system ⁶. Cloudflare saw attack traffic against customers before the release and switched on managed WAF rules (web application firewall rules, which filter requests) for Free and paid plans at 03:02 UTC on 21 October ¹⁷.

The PHP team says the CVE ids leaked about 15:00 UTC on 20 October, a demonstration video followed that evening, and the release moved from 22 October to 21 October, 14:00 UTC. It found no working public exploit at release ⁵. The alert from CISA (the US government's cybersecurity agency), published 21 October and revised 23 October, reports no successful exploitation observed ⁷. The Known Exploited Vulnerabilities catalog, version 2026.10.23, lists neither CVE (read 24 October 2026) ⁸.

php -v shows the command-line PHP; the web server can run a different one

A small PHP file on the web server can print which PHP build serves web requests. PHP_VERSION holds the version string and PHP_SAPI the server API name ²²; fpm-fcgi is php-fpm, apache2handler is the Apache module, cgi-fcgi is FastCGI and litespeed is LiteSpeed ²³. Red Hat points to a temporary phpinfo() page for web settings, because php -i reports the command-line configuration ¹².

php -v                                              # command-line build only
echo '<?php echo PHP_VERSION, " ", PHP_SAPI, "\n";' | sudo tee /var/www/html/ver-check.php
curl -s https://example.com/ver-check.php           # e.g. 8.3.36 fpm-fcgi
sudo rm /var/www/html/ver-check.php

On the server itself:

ps -eo pid,lstart,user,args | grep -E 'php-fpm|apache2|httpd|lsphp|frankenphp|php-cgi' | grep -v grep
sudo apachectl -M | grep php            # mod_php loaded into Apache
grep -rn fastcgi_pass /etc/nginx/       # which php-fpm socket nginx uses

Distribution packages keep an older upstream number with a new suffix, so a printed version can read lower than the release table below while the package carries the fix; CloudLinux names alt-php85 8.5.11-5 and ea-php84 8.4.26-2.el8.cloudlinux.1 as fixed builds ¹⁴. Package versions decide.

apt list '?installed ?name(^php[0-9.]+$)'                                  # Debian, Ubuntu
zgrep CVE-2026-109618 /usr/share/doc/php8.3-common/changelog.Debian.gz    # Debian, Ubuntu
rpm -q --changelog php-common | grep CVE-2026-109618                       # RHEL family

The changelog checks come from Sansec ¹⁵. CloudLinux notes its native PHP 8.2 and 8.3 changelogs omit the CVE ids; there rpm -q php-cli reads 8.2.35 or 8.3.36 or later ¹⁴.

Four PHP versions (8.2 to 8.5) have a fixed release; 8.1 and older depend on the vendor

Sources: ¹²³²⁴. The patch replaces the way PHP jumped out of the code on an out-of-memory error with a soft stop at the next safe point and a hard process exit at a higher limit ².

Linux distributions (Ubuntu, Debian, Red Hat) use their own version numbers for the fix:

Sources: Ubuntu ⁹, Debian ¹¹, Red Hat ¹³. Red Hat's data, checked on 24 October 2026, lists the RHEL 9 php:8.4 stream as affected with no erratum ¹³. On cPanel hosts, ea-php82 to ea-php85 builds with the fix became stable on 21 October, and builds numbered 8.2.35-1, 8.3.36-1, 8.4.27-1 and 8.5.12-1 followed on 23 October ¹⁴.

The update is the fix; the restart is what makes it apply

PHP's advisory calls the update the only complete fix ¹; a running worker keeps the code it started with. Ubuntu states that updating the packages is not enough on its own; unattended-upgrades (on by default since Ubuntu 16.04) applies security updates within about 24 hours, and applications still need a restart or the system a reboot afterward ¹⁰. Red Hat states a reload is not enough and a container is replaced, not restarted in place ¹².

# Debian, Ubuntu
sudo apt update && sudo apt install --only-upgrade '?name(^php[0-9.]+$)'
sudo systemctl restart php8.3-fpm       # php-fpm; unit name follows the branch
sudo systemctl restart apache2          # mod_php
# RHEL family
sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm          # php-fpm
sudo systemctl restart httpd            # mod_php

The apt upgrade and the apache2 restart follow Ubuntu's notice ¹⁰; the Red Hat unit names follow Red Hat's bulletin ¹². On cPanel hosts CloudLinux names /scripts/restartsrv_httpd and /scripts/restartsrv_apache_php_fpm ¹⁴.

If you cannot update yet, PHP lists partial measures, which it says do not make an install safe: session.upload_progress.enabled=0 and, on 8.5, fatal_error_backtraces=0, set in php.ini or the pool config (not ini_set() or .user.ini) with a restart; memory_limit=-1 through php_admin_value; a lower post_max_size ¹.

Checking that no process still runs the old code

sudo needrestart -r l                   # Debian, Ubuntu: lists services on outdated code, changes nothing
sudo dnf needs-restarting -s            # RHEL family: services started before an updated package
for p in $(pgrep -f php-fpm); do sudo ls -l /proc/$p/exe; done
ps -o pid,lstart,args -C php-fpm8.3     # start times later than the upgrade

needrestart -r l reports services that need a restart and makes no change ¹⁹. needs-restarting -s limits its report to systemd services whose process predates an updated package ²⁰. A /proc/PID/exe link ending in (deleted) marks a process started from a binary that has since been replaced ²¹; php-fpm and php-cgi are their own binaries, while mod_php lives inside Apache, so the Apache service is the one that carries it.

CVE-2026-115560 affects updated builds in one configuration

PHP's 23 October notice names a third CVE, in session upload progress, that Cloudflare states affects patched versions including 8.5.12 ¹⁷. It needs session.serialize_handler set to php_binary or php_serialize, an application that switches it to php with ini_set() before session_start(), and upload progress turned on. The temporary fix is session.upload_progress.enabled=0 until the next regular release, which carries the full advisory ¹; Red Hat states the setting fully addresses it ¹².

Signs of a break-in: the sources list few

• PHP's advisories list no indicators of compromise, and state that clean logs do not prove safety ³.
• CISA names PHP worker processes launching shells or downloading tools, and points to its SIGMA detection rule ⁷.
• Amazon names the string PHP_SESSION_UPLOAD_PROGRESS in multipart POST bodies and lists six source addresses on shared anonymization networks ⁶.
• The advisory's log audit looks for repeated warnings before target scripts run, fatal errors, and "Maximum execution time exceeded" ³.
• Sansec reports a path that returns freed worker memory in a PHPSESSID cookie; that memory can hold passwords, session tokens, API keys and TLS private keys ¹⁵.

On hosted sites, the hosting company applies the fix

• The version: WordPress lists the server setup under Tools, Site Health, Info, Server ¹⁸; the ver-check.php file above works through a host's file manager; a hosting control panel's PHP setting shows the branch it serves.
• The fix is the host's build. CloudLinux's builds for cPanel hosts keep old numbers while carrying the fix, so a panel reading 8.4.26 can be patched ¹⁴. Cloudflare states that patching means the vendor's PHP update, not only site code or plugin updates, and that a host which manages PHP applies it ¹⁷.
• Versions: 8.2.35 is the oldest fixed upstream release, and 8.2 security support ends 31 December 2026 ¹²⁴. PHP 8.1 and older receive no upstream update; vendors backport the fix or the site moves to a newer version ¹. CISA lists taking a PHP system offline if it cannot be updated, or if it runs PHP 8.1 or earlier ⁷.
• Cloudflare's managed WAF rules for both CVEs run by default on Free and paid plans, as an added layer beside the update ¹⁷.