PHP2Shell: what it is, who's affected, and how to fix it today

*Last reviewed: 2026-10-23 PT · By Shawn Gants · Changelog*

Answer: PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two critical flaws in PHP itself (CVSS 9.2). They let an attacker who has no login run code on servers running PHP. The only complete fix is updating PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor's patched build, and then restarting PHP. Updating WordPress or Drupal does not fix it. (php.net, CISA)

The two vulnerabilities

Sources: php.net, PHP Foundation.

Who is affected

• Every PHP installation that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest on mod_php, where an unauthenticated request can trigger the attack "before any application code runs" (php.net).
• Affected releases go back to PHP 5.4 (php2shell.com).
• This isn't limited to WordPress, Drupal or Joomla. Researchers say a plain "Hello World" PHP script on an affected version is exposed (php2shell.com).
• PHP runs about 69% of websites whose server-side language W3Techs can identify (W3Techs).
• PHP is also embedded in appliances and vendor products, where you may not be able to update it yourself (NCSC-NL).

Fixed versions

Source: php.net.

Is it being exploited?

Sources disagree depending on when they published, so here they are side by side:

• AWS (Oct 21): first exploitation attempt seen Oct 17, 2026, four days before disclosure. "PHP2Shell is now being broadly exploited in the wild." (AWS)
• Cloudflare (Oct 21): "we observed attack traffic targeting our customers." WAF protections were on by default from 03:02 UTC Oct 21 (Cloudflare).
• CISA (Oct 21, at publication): had "not observed exploitation" yet (CISA).

Bottom line: treat any unpatched PHP server that faces the internet as at risk.

What to do, in order

1. Find the PHP version your web server actually runs. In Drupal: *Reports → Status report*. The command-line php -v can show a different build (Drupal Aid).
2. Update PHP to a fixed release or your distro's patched package (php.net).
3. Restart Apache / PHP-FPM / workers, and rebuild containers. Running containers keep the old PHP (Tag1).
4. Confirm. Distro builds can keep the old version number. Ubuntu 24.04's fixed package still reports "8.3.6" (Tag1). Ask your host in writing.
5. Can't update yet? Apply PHP's temporary measures, which reduce exposure but "do not make an installation safe" (php.net). Or take the site offline until it's patched (CISA, ENISA).
6. After patching: rotate database passwords and API keys on exposed servers (Tag1). Review logs from Oct 17 onward (AWS).

Does a WAF protect me?

Partly, and only for a while. Cloudflare's rules block known exploit patterns, but Cloudflare itself says customers should still patch (Cloudflare). Datadog found that community config workarounds "don't fully protect you" (Datadog).

What PHP2Shell means for Drupal

Drupal's security team published PSA-2026-10-20. Updating PHP is the only complete mitigation, and the hosting platform is the site owner's responsibility. Your Drupal version and modules don't change whether you're exposed. Is my Drupal site affected? →

What PHP2Shell means for WordPress

WordPress runs on PHP. Its requirements recommend PHP 8.3 or greater, and Site Health can flag an outdated PHP version. Updating WordPress does not fix PHP2Shell. The free version check is the same check for a WordPress host. There is no emergency PHP patching service. WordPress to Next.js migration →

Who has issued alerts

CISA (US) · ENISA with the European Commission, CERT-EU, Europol EC3 and the EU CSIRTs network · UK NCSC · NCSC-NL · NHS England · CSA Singapore · Drupal Security Team. (CISA, ENISA, BleepingComputer, NCSC-NL, NHS England, CSA, Drupal.org) Full dated timeline →

Patched? The next question

PHP2Shell sat in code that "nearly every request touches." The PHP Foundation says a fix stalled for months, which it called "a structural failure" (PHP Foundation). Meanwhile Drupal 10 ends Dec 9, 2026 and PHP 8.2 ends Dec 31, 2026. If you'd rather not run a PHP server at all, that's what we do: Drupal or WordPress to Next.js + Supabase on Netlify. Patched? Now decide if you need a PHP server at all → WordPress migration →

FAQ

What is PHP2Shell?

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution on servers running affected PHP versions (php.net).

Which PHP versions fix PHP2Shell?

8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older branches need a vendor backport or the PHP security team's source backports for 7.4/8.0/8.1 (php.net).

Will updating Drupal or WordPress fix it?

No. The flaw is in PHP, not the CMS (Drupal PSA, Tag1).

Does an attacker need an account?

No. The demonstrated attacks were unauthenticated (CISA, php2shell.com).

What's the CVSS score?

9.2 (CVSS v4.0) for each. A leaked "10.0" was wrong (PHP Foundation).

Is a web application firewall enough?

No. It's a temporary layer. Patch PHP (Cloudflare).

I'm on PHP 7.4 or 8.1. What now?

The PHP project no longer releases those branches. Use a vendor backport, the PHP security team's minimal source backport, or upgrade. If you can't, CISA advises taking the system offline until it's patched (php.net, CISA).

Could data have leaked even without a break-in?

Yes. CVE-2026-109619 can expose process memory, which may include passwords and API keys. Rotate secrets on exposed servers (php2shell.com, Tag1).

Changelog

• 2026-10-22: Page published. (Add an entry for every material update, with a PT timestamp.)