On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix PHP2Shell, two critical flaws in the PHP runtime itself: CVE-2026-109618 and CVE-2026-109619 (php.net). Both can allow unauthenticated remote code execution with the privileges of the web server’s PHP worker. Amazon recorded an exploitation attempt on October 17, four days before disclosure, and CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog on October 26.
The bug is in PHP, not in one application. Every site and appliance that serves web requests through PHP is in scope until it is patched and its PHP workers have been restarted, including PHP you never installed yourself, inside firewall consoles, webmail and other appliances.
Finding all of those is usually the hard part. Our external network penetration test maps every internet-facing host, including appliances with PHP management interfaces, and flags each one for a version and configuration check, since a banner alone cannot confirm a backported fix. It starts from $4,200, with a free retest.
PHP2Shell at a glance
| Item | Detail |
|---|---|
| What happened | Two memory-safety flaws in the PHP runtime, disclosed and fixed on October 21, 2026 |
| CVEs | CVE-2026-109618 (out-of-memory corruption) and CVE-2026-109619 (stale request state, a use-after-free) |
| Severity | 9.2 Critical in CVSS 4.0 for both, scored by PHP. NVD’s CVSS 3.1 scores are 9.8 and 8.1 |
| Who is affected | Nearly every PHP version back to 5.4 (Calif, Wiz, Imperva), on every setup that serves web requests. Apache mod_php carries the highest risk |
| Fixed in | 8.5.12, 8.4.27, 8.3.36 and 8.2.35, plus source backports for 7.4, 8.0 and 8.1 |
| Exploited? | Yes. In the CISA KEV catalog since October 26, 2026, federal due date October 29 |
| What to do | Patch, restart every PHP worker and review settings. A WAF is a stopgap only |
What the PHP2Shell vulnerabilities are
PHP’s advisories describe the two flaws this way.
CVE-2026-109618, out-of-memory corruption. When PHP runs out of memory, it aborts the request part-way through. If that happens while request memory is reachable but not fully set up, request shutdown can treat the half-built data as valid. Several multipart (file upload) parsing paths can push a request out of memory within normal limits. The fix replaces the abort with a delayed soft stop at a safe point and an immediate exit at a higher threshold (GHSA-w8hw-w9fx-j79w).
CVE-2026-109619, stale request state. After a fatal error, such as running out of memory or a timeout, a worker’s global state (error, session or extension state) can still point at memory from a finished request that has been freed. A later request on the same worker can then use it. PHP lists memory disclosure and remote code execution as impacts (GHSA-6wmf-4rv5-p3rp).
Two researcher findings matter for planning. Wiz says the memory disclosure can expose passwords, tokens, API keys and certificates without any code execution. Imperva rates full exploitation as high complexity, while triggering the bug is much easier. Wiz documents four exploitable bugs and Imperva five exploitation techniques under the two CVEs, so treat the pair as one patch.
Calif’s write-up credits Calif, OpenAI and Wiz Research with the discovery, and says it used LLM assistance and agent tooling, with no non-public models. PHP2Shell is unrelated to “plex2shell”, a Plex Media Server chain (CVE-2026-96652 and related CVEs) that also joined KEV in October.
Who is affected
PHP versions
| Branch | Fixed version |
|---|---|
| 8.5, 8.4, 8.3 | 8.5.12, 8.4.27, 8.3.36 |
| 8.2 (end of life December 31, 2026) | 8.2.35 |
| 8.1, 8.0, 7.4 (end of life) | No upstream release. PHP’s minimal source backports, or a vendor long-term-support build |
| 7.3 and older | No upstream fix or PHP source backport. Some long-term-support vendors ship patched builds (Ubuntu Pro covers PHP 7.2, 7.0 and 5.5); otherwise upgrade |
| 8.6 pre-release | 8.6.0 RC4 includes the fixes |
Server setups
CISA’s alert puts every installation that serves web requests in scope: Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed.
- Apache mod_php carries the highest risk. PHP has a demonstrated unauthenticated exploit, validated with default memory and input limits.
- PHP-FPM is affected too. Code execution through CVE-2026-109619 was validated against an ordinary dynamic FPM pool, though it depends on a suitable operation in the application, and a front end that passes
PHP_VALUEorPHP_ADMIN_VALUEadds exposure. For CVE-2026-109618, PHP says FPM looks susceptible on analysis, though no complete exploit was shown. - FrankenPHP and LiteSpeed are rated likely susceptible.
Applications
The application on top makes no difference. Calif confirmed pre-authentication code execution against WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, MediaWiki 1.46.2, Roundcube 1.7.4, Magento 2.4.9, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1 and WHMCS.
Online stores need particular attention: Magento and WooCommerce run on PHP, and our guide to e-commerce penetration testing covers the rest of that attack surface. A store that takes card payments has its web tier in PCI DSS scope, so an unpatched, KEV-listed code execution flaw there is a compliance problem as well as a security one.
Products that embed PHP
CISA warns that PHP often sits inside other software and has to be searched for. Vendor status in late October 2026:
- Palo Alto Networks: the PAN-OS and Panorama management web interface and XML API are affected on 10.2, 11.1, 11.2, 12.1 and 12.2. GlobalProtect and Captive Portal are not (advisory).
- Cisco: Duo Access Gateway is fixed in 3.2.0. Expressway and Ultra-Reliable Wireless Backhaul fixes were pending, with workarounds (Help Net Security).
- Fortinet: FortiDDoS, FortiSOAR and FortiClient Cloud Services were under investigation. FortiOS is not affected.
- AWS: EMR on EC2 clusters with Ganglia are affected. Elastic Beanstalk, Lightsail and Amazon Linux have updates, though Lightsail instances must be rebuilt from new blueprints. PHP on Lambda runs in your own custom runtime, so you update it (AWS bulletin 2026-143).
- Google Cloud: bulletin GCP-2026-070 says Cloud Run, Cloud Run functions and App Engine Standard have patched PHP 8.2 and later; redeploy to pick it up.
Check each advisory directly, because status changes. A management interface should not face the internet at all; our firewall penetration testing guide explains how testers check for that.
Distribution packages can keep old version numbers
Some distributions, Ubuntu among them, backport the fix without changing the upstream version, so a fixed server can report an older number. Check the package version instead:
| Distribution | Package | Fixed version |
|---|---|---|
| Debian 12 (bookworm) | php8.2 | 8.2.35-1~deb12u1 (DLA-4848-1) |
| Debian 13 (trixie) | php8.4 | 8.4.27-1~deb13u1 (DSA-6574-1) |
| Ubuntu 26.04 LTS | php8.5 | 8.5.4-0ubuntu1.5 |
| Ubuntu 24.04 LTS | php8.3 | 8.3.6-0ubuntu0.24.04.13 |
| Ubuntu 22.04 LTS | php8.1 | 8.1.2-1ubuntu2.28 |
Sources: the Debian tracker and Ubuntu (USN-8948-1 and USN-8948-2), which fixes older releases through Ubuntu Pro. CERT-EU notes that the volunteer-run remirepo repository had no release-day update.
On Windows, PHP rebuilt its downloads as 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 on October 26 for a separate Brotli flaw, CVE-2026-111497 (php.net). It is not PHP2Shell, but CISA added it to KEV on October 27, so take the -1 builds.
Exploitation so far
| Date (2026) | Event |
|---|---|
| October 17 | Amazon’s MadPot honeypots record an attempt from a commercial anonymization network |
| October 20 | PHP posts an advance notice. The CVE IDs and an incorrect CVSS 10.0 score circulate on Hacker News |
| October 21 | Fixes and CISA’s alert published. Cloudflare’s WAF rules deploy from 03:02 UTC. New proof-of-concept code is used against Amazon’s sensors within hours |
| October 26 | Both CVEs added to KEV, due October 29 |
| October 28 | Linux kernel CVE-2026-46300 added to KEV. CISA says it can be chained with PHP2Shell to plant web shells and run commands as root |
The early attempts come from Amazon Threat Intelligence. Delft University of Technology’s PHP2Shell tracker had counted 85,664 exploitation requests from 798 addresses by November 6. watchTowr has seen exploitation of both CVEs since October 21.
Not every request is a compromise. Arctic Wolf saw widespread scanning and attempts to validate command execution, with payload servers linked to the Mirai-derived Potassium botnet, but could not confirm that code ran, and judged early exploitation more limited than the attention suggested. Amazon also says it is unclear whether the attempts it saw would have succeeded.
How to check if you are exposed
Inventory every PHP install
List PHP packages and running PHP processes on every server, then add appliances, vendor consoles, webmail and bundled Windows stacks. Start with what faces the internet.
Check the version, then the restart
Compare each install against the fixed upstream or distribution build. Then confirm the running workers started after the package was installed. A PHP-FPM pool or Apache process that predates the update is still running the old code. Qualys also warns that php -v on the command line may report a different installation from the one serving web requests.
Check the effective settings
For each server setup and FPM pool, record memory_limit, post_max_size, upload_max_filesize, max_input_nesting_level, session.upload_progress.enabled, fatal_error_backtraces (PHP 8.5) and pm.max_requests. Note whether the application changes session.serialize_handler at runtime (see CVE-2026-115560 below).
Review logs from October 17 onward
- Multipart POST requests containing
PHP_SESSION_UPLOAD_PROGRESS, which Amazon recommends searching for. - “Allowed memory size exhausted” errors after large multipart requests, repeated empty HTTP 500 responses and PHP-FPM worker crashes.
- Unusually large or malformed
PHPSESSIDcookies (Wiz). - PHP or web server processes starting
sh,bash,wgetorcurl, new files in the web root and unexpected outbound connections.
CISA published a SIGMA rule for this activity. Two cautions: PHP says a clean log is not proof of safety, because failures can happen before anything is logged, and Amazon’s published IP addresses are shared anonymization services, so investigate matches rather than just blocking them.
Scanners and active probes
Start with vendor-published detection: Qualys and Wiz offer detections, and CISA’s SIGMA rule covers the log side. Active probes, including a public php2shell-scanner, deliberately push PHP out of memory and read the response, sending about 29 MiB per tested path, and Qualys calls one of its own checks intrusive enough to crash unpatched applications. Run them only with written authorization, ideally on staging or in a maintenance window. Never run public exploit code against production: Qualys advises treating any proof of concept as untrusted.
How to fix it
- Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the fixed distribution or vendor package. Internet-facing hosts and mod_php servers first.
- Restart every PHP worker, including PHP-FPM pools and Apache, and redeploy containers. Confirm the running workers are on the new build.
- End-of-life branches: upgrade, use a vendor long-term-support build, or build PHP’s source backport for 7.4, 8.0 or 8.1. CISA says to take PHP systems offline if they cannot be patched or run 8.1 or older.
- Patch the kernel on PHP hosts for CVE-2026-46300.
- Restrict appliance management interfaces to trusted internal addresses or a jump host, as Palo Alto Networks recommends.
- If you suspect compromise, rotate secrets that were in PHP worker memory, such as database passwords and API keys, and rebuild the host from a known-good image.
If you cannot patch today, PHP lists interim settings. They are partial and do not make a system safe:
| Setting | Interim value | Addresses |
|---|---|---|
memory_limit |
-1, set with php_admin_value |
CVE-2026-109618 |
post_max_size |
8M, or 32M with uploads, upload_max_filesize below it |
CVE-2026-109618 |
max_input_nesting_level |
Lowered | CVE-2026-109618 |
| Memory cap | A cgroup or container limit, not RLIMIT_AS or RLIMIT_DATA |
CVE-2026-109618 |
| Front-end limits | Enforce request size; block multipart if the app takes no uploads | CVE-2026-109618 |
session.upload_progress.enabled |
0 in php.ini or the pool config, not ini_set() or .user.ini |
CVE-2026-109619, CVE-2026-115560 |
fatal_error_backtraces |
0 on PHP 8.5 |
CVE-2026-109619 |
Restore a finite memory_limit once patched.
A WAF is a stopgap. Cloudflare added rules to its Free and paid managed rulesets; paid plans should confirm block mode. AWS updated its WAF PHP rule group, so move off pinned versions, and note that behind an Application Load Balancer or AppSync, AWS WAF inspects only the first 8 KB of a body (AWS documentation). Imperva says its Cloud WAF protects by default. Make sure the origin cannot be reached around the WAF. Every vendor still says to patch.
Our guide to vulnerability remediation covers how to prioritize KEV-listed issues and prove each fix.
The follow-up bug: CVE-2026-115560
On October 23, PHP published an informational advisory about another code execution path in session upload progress, CVE-2026-115560 (php.net). It needs an unusual combination: the configuration sets session.serialize_handler to php_binary or php_serialize, the application switches it to php with ini_set() before session_start(), and upload progress is still on.
Cloudflare says it affects fully patched releases, including 8.5.12, with a fix due in the next regular release. The mitigation is session.upload_progress.enabled=0. Cloudflare’s rule does not cover sites that renamed session.upload_progress.name. It was not in KEV as of November 4, 2026.
How a penetration test finds and verifies PHP2Shell
- External discovery: PHP hosts identified from headers,
PHPSESSIDcookies, file extensions and CMS fingerprints, including appliances with PHP consoles. Banners are only hints, because of backports. - Credentialed configuration review: package version, worker restart and effective settings. The most reliable method, with no crash risk.
- WAF validation: block mode, unpinned rule versions, body limits that cover uploads and no direct route to the origin.
- Active probing only with written authorization, scheduled as a possible availability impact.
- Retest after patching to confirm the fix and the restart.
The PHP applications need testing too. Our web application penetration testing starts from $5,200, and our web application security testing guide explains the methods. For the rest of October’s KEV additions, including WordPress core CVE-2026-119977, added on November 3, see our October 2026 exploited vulnerabilities roundup.
An external network test is the quickest way to find every internet-facing PHP endpoint you own. See what an external network penetration test costs: from $4,200, fixed in writing before work begins, with a free retest after you patch.
Frequently asked questions
Is PHP2Shell the same as plex2shell? No. plex2shell is a chain of Plex Media Server flaws. PHP2Shell is CVE-2026-109618 and CVE-2026-109619 in the PHP runtime. Both joined CISA KEV in October 2026, which is the only link.
Does a WAF protect me from PHP2Shell? Partly. Cloudflare, AWS, Imperva and others shipped rules, but body inspection limits and direct routes to the origin leave gaps. Every vendor says to patch PHP.
Is PHP-FPM affected by PHP2Shell? Yes. PHP validated code execution through CVE-2026-109619 against a dynamic FPM pool (depending on the application), and says FPM looks susceptible to CVE-2026-109618, though no complete exploit was shown. mod_php carries the highest risk.
Do I need to restart after updating PHP? Yes. Running workers keep the old code in memory. Restart PHP-FPM and Apache, redeploy containers, then confirm the worker start times are later than the update.
Is WordPress affected by PHP2Shell? WordPress is not the bug, but any WordPress site on unpatched PHP is exposed. Calif confirmed pre-authentication code execution against WordPress 7.1.2. Updating WordPress alone does not fix it: update PHP and restart its workers.
Fixed price, fixed scope, free retest. Scope your external network test and get the price in writing.
Written by
Invadel Team
Senior penetration testers writing from real engagements, the same team that scopes, tests, and reports for our clients. About Invadel →
