PHP2Shell changelog: every change to our facts and guides

What changed on 22 October 2026?

• Facts: added the CVSS 4.0 score of 9.2 for both CVE-2026-109618 and CVE-2026-109619, from the GitHub security advisories.
• Facts: added two official stopgaps for CVE-2026-109618 from PHP’s announcement: removing the PHP memory limit and lowering post_max_size. Like the other stopgaps, they never count as a fix.
• Facts: exploitation status updated to “attack attempts observed”. Cloudflare reported attack traffic and mutating payloads before the patch. Successful compromise is not confirmed.
• Facts: added warnings from national cybersecurity agencies, each marked with whether we have verified it at the source.
• Facts: confirmed PHP’s minimal source patches for PHP 7.4, 8.0 and 8.1 (no new releases for those branches).
• Guides: added Japanese-language guides for four Japanese rental-server hosts.
• Checker: verdicts come only from the details you enter in your browser; the site never contacts your server.
• CVE pages: CVE-2026-109618 and CVE-2026-109619 now open with a vulnerability record generated from our data: CVSS, affected and fixed versions, affected setups, stopgaps, exploitation status, fixed distribution packages and official sources.
• Guides: added PHP2Shell and WordPress, a self-check for WordPress site owners.

What was in the first version on 21 October 2026?

• Facts: fixed releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12 from PHP’s security announcement.
• Facts: vulnerability details from the GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp advisories.
• Facts: vendor package versions from the Ubuntu and Debian security notices.
• Rules: version check with four verdicts: in the affected range, matches a fixed release, check your vendor’s patch, can’t tell yet.
• Guides: patch guide with a message for hosting providers, plus guides for WordPress, cPanel and Plesk, Ubuntu and Debian, Docker, end-of-life PHP, workarounds and intrusion checks.

What do we track for this changelog?

PHP’s security announcements and advisories, operating-system vendor notices, hosting provider announcements, national cybersecurity agencies and the original research. Wording-only edits aren’t listed; any new or corrected fact, verdict rule or guide step is.

Found a mistake?

Tell us the page and a link to your source; we correct facts quickly and record the correction here. See about PHP2Shell.help, or go back to the PHP2Shell checker.