php2shell (CVE-2026-109618 / CVE-2026-109619)
By PHP Patch Assurance · Last updated: 2026-10-25 · Plain-text version
php2shell is the name given to two critical flaws in PHP core, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), disclosed on October 21, 2026. They allow unauthenticated remote code execution: anyone on the internet can run code on an affected server, with no password and no login. Fixed PHP releases shipped the same day.
What is php2shell?
Two flaws in PHP itself — not in a plugin, theme or application — that let an unauthenticated attacker execute arbitrary code on a server running a vulnerable PHP version. Details leaked on October 20, 2026, attacks began on October 21, and PHP shipped emergency releases the same day, ahead of its scheduled slot.
Who is affected?
Any site running PHP below the fixed releases. The flaw is in PHP core, so it is not limited to one web server or application.
| PHP branch | Vulnerable | Fixed release |
|---|---|---|
| 8.5 | below 8.5.12 | 8.5.12 |
| 8.4 | below 8.4.27 | 8.4.27 |
| 8.3 | below 8.3.36 | 8.3.36 |
| 8.2 | below 8.2.35 | 8.2.35 |
| Below 8.2 | all versions | none — end-of-life, upgrade required |
How do I know if my PHP version is vulnerable to php2shell?
Check the version your server actually runs — php -v on the server, or the version your host reports. If it is below 8.2.35 on branch 8.2, below 8.3.36 on 8.3, below 8.4.27 on 8.4, or below 8.5.12 on 8.5, it is vulnerable. If your site hides its version, an external check honestly says INDETERMINATE; the read-only deep check gives a definitive verdict.
How to check and patch
- Run the free scan — paste your site address and in seconds you know if it is exposed.
- If the version is hidden, the scan says INDETERMINATE. That is not a clean bill of health: run the read-only deep check, which runs on your server after you prove ownership.
- If you are vulnerable, order the patch: snapshot and restore-test first, then patch, live verification, and a work report. A failed health check reverts the change automatically.
- If your PHP is below 8.2, upgrade the branch — one-click for Docker hosts, with the same snapshot, verify and rollback gates — or take the site offline until it can be upgraded.
Check your site free Patch service
Fixed releases
PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, shipped October 21, 2026. Branches below 8.2 have no upstream fix.
Timeline
- October 20, 2026 — details leak; PHP announces emergency releases (19:33 UTC); CERT-EU advisory 2026-018 first issued.
- October 21, 2026, 08:55 EDT (21:55 JST) — Japan's prime minister Sanae Takaichi posts urging action that night, or temporarily stopping the site.
- October 21, 2026, 09:30 EDT (13:30 UTC) — PHP emergency releases ship, ahead of the scheduled 14:00 UTC slot.
- October 21, 2026 — CISA, UK NCSC and NSA Cyber alerts; Cloudflare confirms early attacks; services in the Netherlands and Japan go into emergency maintenance or offline.
- October 21, 2026, evening EDT — mitbbs.ai patched from 8.3.35 to 8.3.36 with about 10 seconds of downtime and no signs of compromise.
- October 22, 2026, 00:00 EDT (04:00 UTC) — Prime Minister Takaichi posts that her own official site was deliberately suspended, measures completed, and restored.
- October 22, 2026, 00:35 EDT — phpatch.com launches.
- October 22, 2026 — JPCERT/CC advisory JPCERT-AT-2026-0033 and IPA advisories publish, listing three compromise signs: malformed PHPSESSID values, suspicious multipart requests with HTTP 500 responses, and PHP worker crash loops.
What PHP Patch Assurance does — and does not do
| Does | Does not |
|---|---|
| Free external scan, no exploit probes | Label an end-of-life branch “patched” |
| Read-only deep check after ownership proof | Run exploit probes against your site |
| Verified patch for Docker hosts: $49, or $99 with rollback | Offer paid patching for non-Docker hosts |
| Snapshot and restore-test before any change; automatic rollback on a failed health check | Ask for your root, hosting-panel or CMS password |
| Work report with a SHA-256 integrity hash; full refund if the patch cannot be completed and verified, or the pre-patch state cannot be restored | Guarantee a site is secure — findings are as observed in documented checks |
Frequently asked questions
How do I know if my PHP version is vulnerable to php2shell?
Check the version your server actually runs — php -v on the server, or the version your host reports. If it is below 8.2.35 on branch 8.2, below 8.3.36 on 8.3, below 8.4.27 on 8.4, or below 8.5.12 on 8.5, it is vulnerable. If your site hides its version, an external check honestly says INDETERMINATE; the read-only deep check gives a definitive verdict.
What if my PHP is older than 8.2?
Branches below 8.2 are end-of-life and have no upstream fix, so they cannot be patched in place. The options are a branch upgrade — one-click for Docker hosts, with the same snapshot, verify and rollback gates — or, as Japan's prime minister advised on October 21, 2026, temporarily taking the site offline until it can be upgraded.
Is my site safe if the scan cannot tell?
Not necessarily. Most well-run sites hide their PHP version, so the free external scan reports INDETERMINATE rather than guessing. That is the honest answer, not a clean bill of health. The read-only deep check runs on your server after you prove ownership and settles it.
How fast can I get patched?
The patch itself is a supervised job inside a window you pick: snapshot and restore-test first, patch, verify the fix live, then a work report. If verification fails, the change reverts automatically. If we cannot complete and verify the patch, or cannot restore the pre-patch state, the fee is refunded in full.
Primary sources
- PHP — emergency release announcement: php.net
- CISA — “Critical Vulnerabilities in PHP Require Immediate Patching” (October 21, 2026): cisa.gov
- CERT-EU — advisory 2026-018 (first issued October 20, 2026)
- JPCERT/CC — advisory JPCERT-AT-2026-0033: jpcert.or.jp
- IPA (Japan) — php2shell advisory, October 22, 2026
- UK NCSC — php2shell alert, October 21, 2026
- NSA Cyber — php2shell alert, October 21, 2026
If we get something wrong, we say so here: corrections & retractions.