PHP2Shell vulnerability: what it is, who is affected and how serious it is

What are the two PHP2Shell vulnerabilities?

Both are memory-safety bugs in PHP itself, fixed in the same releases.

Each has its own page: CVE-2026-109618 and CVE-2026-109619.

Who is affected by the PHP2Shell vulnerability?

Any PHP installation that serves web requests on an unfixed version. PHP’s advisory lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and rates the risk highest for mod_php, where a demonstrated exploit runs before any application code. The original research reports that at least one of the flaws reaches back to PHP 5.4.

PHP 8.1 and older get no new releases; PHP published minimal source patches for 7.4, 8.0 and 8.1 only. The fixed releases are:

How serious is PHP2Shell?

Critical. Remote code execution means an attacker could run commands with your web server’s permissions: change or plant files, read configuration such as database passwords, and install a backdoor that survives the update. The research also describes a way to leak process memory. Whether a given server can be attacked still depends on its PHP version, configuration, memory layout and application.

Which governments have issued PHP2Shell warnings?

National cybersecurity agencies in Asia, Europe and North America have warned about the PHP2Shell vulnerability. Most tell organisations to update immediately; several advise taking services offline or isolating them if they can’t be patched, and some point out that PHP is also embedded in products and devices.

Is the PHP2Shell vulnerability being exploited?

Attack attempts have been seen, but successful compromise has not been confirmed. Cloudflare reported attack traffic against its customers and attackers changing payloads to bypass its rules before the fix was released. None of the sources we checked as of 22 Oct 2026 confirms a successful takeover through PHP2Shell, which doesn’t mean no one is exploiting it. Sansec expects mass exploitation now that the patch and write-ups are public.

Repositories claiming to be working exploits have also appeared. We haven’t verified them and don’t link to them. Don’t download or run code from them.

Does PHP2Shell affect every PHP website in the same way?

No. “At least one flaw since PHP 5.4” describes where the vulnerable code exists, not proof that one attack works against every site. The CVSS scores for both flaws rate attack complexity as high and note that certain conditions must be present, and PHP rates mod_php highest risk. On the other hand, Sansec reports that researchers confirmed code execution against popular applications and that default configurations are vulnerable. The safe assumption is that an unpatched web-facing PHP is exposed.

Is PHP2Shell the same as wp2shell?

No. wp2shell is the name of a separate critical vulnerability in WordPress core, fixed by updating WordPress. PHP2Shell is in PHP itself and is fixed by updating PHP. Search engines sometimes mix up the two names, so check the CVE numbers when reading advice.

Why is it called PHP2Shell?

PHP2Shell is the name used in the original Wiz Research write-up. It describes the worst case: a request to a PHP website could end with an attacker running commands (a shell) on the server. The official advisory titles are “RCE via OOM corruption” and “RCE via stale global state”.

What should I do now?

1. Check your PHP with the PHP2Shell checker.
2. Update by following the PHP2Shell patch guide.
3. If you updated late, review the check if your website is hacked guide.

Which sources support this page?

• The PHP Group: RCE via OOM corruption
• The PHP Group: RCE via stale global state
• The PHP Group: security advisory
• Wiz Research: original research
• Cloudflare: WAF protections
• Sansec: PHP2Shell research
• Rapid7: wp2shell, a separate WordPress core vulnerability