PHP2Shell is a pair of critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 4.0 score 9.2) disclosed on October 21, 2026: remote code execution with a single unauthenticated HTTP request, before any application code runs. Fixed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Fix: upgrade PHP itself and restart PHP-FPM or the web server. You can compare the PHP version a site exposes publicly at /php2shell.
What happened
On October 21, 2026 the PHP project published advisory GHSA-w8hw-w9fx-j79w covering two vulnerabilities, collectively named PHP2Shell:
- CVE-2026-109618 — remote code execution (RCE) via request data corruption under memory exhaustion (out-of-memory);
- CVE-2026-109619 — RCE via request state that is still used after its memory has been freed.
Both are rated 9.2 under CVSS 4.0. Details leaked before the embargo ended, and the release was moved up by roughly a day. According to Help Net Security, Amazon MadPot honeypots recorded exploitation attempts as early as October 17, 2026 — before public disclosure. Public exploits have appeared as well, so this is not an upgrade to postpone.
Why it is critical
- No authentication. One specially crafted HTTP request is enough.
- Before your code runs. The bug triggers while PHP parses a multipart request — before your application executes. Updating the CMS, framework or plugins does not fix it: the interpreter itself is vulnerable.
- Almost every way of running PHP. RCE is confirmed for Apache mod_php. Based on code analysis, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are affected too.
Fixed versions
| PHP branch | Fixed in | Note |
|---|---|---|
| 8.5 | 8.5.12 | official release |
| 8.4 | 8.4.27 | official release |
| 8.3 | 8.3.36 | official release |
| 8.2 | 8.2.35 | official release |
| 8.1, 8.0, 7.4 | — | no official release; PHP published minimal source backports, distributions and LTS vendors ship their own packages |
A note on distribution packages: Debian, Ubuntu, RHEL and LTS vendors often backport the fix into their build without changing the version number. In that case php -v shows a version below the fixed one even though the package is patched. For distribution builds, check the package changelog — commands below.
How to check on your server
The reliable check happens on the server itself. Start with the version and SAPI:
# Interpreter version
php -v
# Version and SAPI on one line
php -r 'echo PHP_VERSION, " ", PHP_SAPI;'
# → 8.3.36 cli
php on the command line is the CLI. Your site is served by PHP-FPM or mod_php, which may be a different package or even a different version. Check the binary that actually serves the site too, e.g. php-fpm8.3 -v.
# Debian / Ubuntu: is the fix in the package?
# (use your branch: php8.2-common, php8.3-common, php8.4-common)
apt changelog php8.3-common | grep CVE-2026-10961
# RHEL / AlmaLinux / Rocky Linux
rpm -q --changelog php | grep CVE-2026-10961
# if there is no php package, check php-common or php-fpm
The pattern CVE-2026-10961 matches both entries — CVE-2026-109618 and CVE-2026-109619. Empty output means the installed package does not mention the fix: update it and check again.
# Docker: refresh the base image and rebuild
docker compose build --pull
docker compose up -d
docker compose exec app php -v # app = your service name
If your Dockerfile pins an exact tag (for example FROM php:8.3.30-fpm), change it to a fixed version. A tag like php:8.3-fpm picks up the fix only after a rebuild with --pull — a running container does not update itself.
What to do
- Upgrade PHP to 8.2.35, 8.3.36, 8.4.27 or 8.5.12. For 7.4, 8.0 and 8.1, install your distribution or LTS vendor package with the backport and plan a move to a supported branch.
- Restart PHP-FPM and the web server. Old worker processes keep the old code in memory:
systemctl restart php8.3-fpm, thensystemctl restart apache2(orhttpd,nginx— whatever your setup uses). - Verify: version or changelog on the server, then an external check at /php2shell.
- Treat a WAF as a stopgap. It lowers the risk from known attack patterns but does not replace the upgrade.
expose_php = Offin php.ini removes the PHP version from the X-Powered-By header. That is hygiene — fewer hints for automated scanners — not protection: a vulnerable PHP with a hidden version is still vulnerable.
What you can check on enterno.io
PHP2Shell check — /php2shell
The tool sends one ordinary GET request to the site's home page (following at most three redirects) and reads only the response headers the site sends to every visitor: X-Powered-By, Server and the PHPSESSID cookie. The PHP version it finds is compared with the fixed releases. Nothing else: no attacks, no proof-of-concept exploits, no brute force, no load — effectively the same as opening the site in a browser.
Possible results:
- Vulnerable — the version is below the fix for its branch. If the headers show a distribution build, the result carries a “backport possible” note: check the package changelog on the server.
- Patched — the version is at or above the fixed release for its branch.
- Version hidden — PHP is visible (for example, through the PHPSESSID cookie) but the site does not disclose its version. That does not mean “protected”: check the version on the server.
- PHP not detected — the headers show no sign of PHP. That is not a guarantee either: PHP may sit behind a proxy that strips such headers.
Technologies and known CVEs — /tech-detect
Tech detection identifies the CMS, frameworks, servers and their versions and lists known CVEs for the detected version. The catalog tracks fixes per branch, and PHP2Shell is already in it. For a broader look at security headers and site configuration, use the security scanner.
Monitoring — /monitors
Monitoring watches your site's availability and alerts you when it stops responding — useful while a vulnerability is being mass-scanned. Monitoring does not check the PHP version: after upgrading, re-run the check at /php2shell.
Check only sites you own
Check your own sites, or sites whose owner has given you permission. enterno.io performs no offensive actions of any kind — it only reads headers the site itself sends to every visitor. Trying to exploit the vulnerability on someone else's system without permission is no longer a check: unauthorized access to computer systems is a criminal offence in most jurisdictions (in Russia — Article 272 of the Criminal Code, unauthorized access to computer information).
FAQ
We updated our CMS and plugins — is that enough?
No. PHP2Shell is a vulnerability in the PHP interpreter itself: it triggers while the request is parsed, before application code runs. Upgrade PHP, restart PHP-FPM or the web server, then compare the version at /php2shell.
Our site runs on PHP-FPM, not mod_php. Is it affected?
Assume yes. RCE is confirmed for Apache mod_php, but code analysis shows PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are affected as well. Upgrade PHP regardless of the SAPI.
We run PHP 7.4, 8.0 or 8.1. What should we do?
There is no official release for these branches. PHP published minimal source backports, and distributions and LTS vendors ship their own packages — the version number may stay the same. Check the package changelog for CVE-2026-109618 and CVE-2026-109619 and plan a move to a supported branch.
The check says “version hidden”. Does that mean the site is safe?
No. A hidden version (for example, after expose_php = Off) only prevents identifying it from outside; it does not fix the vulnerability. Check php -v and the package changelog on the server.
Can a WAF replace the upgrade?
No. A WAF lowers the risk from known attack patterns and is useful as a stopgap while you prepare the upgrade, but it does not replace upgrading PHP.
