If you woke up on 21 October to a stream of messages that said “PHP is on fire, update everything,” and you weren't sure what exactly to update, you weren't alone. The PHP2Shell vulnerability is two separate flaws in PHP itself, not in WordPress or Laravel or whatever your site runs on. That is what makes it awkward.
Here is what the PHP project actually said, without the panic and without the vendor-blog padding.
What the PHP2Shell vulnerability is
PHP2Shell is the nickname for two bugs, CVE-2026-109618 and CVE-2026-109619. Both are remote code execution flaws. Both were scored 9.2 on CVSS v4.0, which is critical. The PHP project published its advisory on 21 October 2026, a day after it had warned that an unusually serious release was coming.
- CVE-2026-109618 is about memory running out. If PHP hits an out-of-memory condition while handling a request, request data can be left half set up, and the cleanup code afterwards treats it as if it were fine.
- CVE-2026-109619 is about leftover state. Something owned by one request can survive after its memory has been freed, and a later request on the same worker ends up using it.
You don't need to follow the memory mechanics to understand the consequence. In the wrong conditions, someone who is not logged in can get PHP to run code of their choosing, with the permissions of your web server account.
Why it matters even if your own code is clean
Most security advice is about your code. Sanitise this input, escape that output, update that plugin. None of it helps here. The bug lives in the language runtime underneath everything. A carefully written Laravel app and a forgotten contact form from 2017 run on the same engine, and the engine is the problem.
You can have perfect application code and still be exposed, because the hole is in the floor, not the furniture.
The PHP project says the risk is highest on Apache with mod_php, where an unauthenticated request can trigger the attack before any of your application code even starts. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are all listed as affected. For PHP-FPM the project says it is susceptible, and the shape of the attack is different, but it is not a reason to relax.
Is it being used against real servers?
Details leaked on 20 October, which is why the release was pulled forward. Several security vendors and at least one large network provider have since reported exploitation attempts. Reports differ on how far those attempts got, and as of the coverage we read (22 to 23 October) neither CVE had been added to CISA's Known Exploited Vulnerabilities list. Treat that as a snapshot, not a promise. It could look different by the time you read this.
The practical reading: scanning is happening, a working attack against a specific unpatched server is plausible, and waiting for confirmation is a bad plan.
What to do today
Update PHP to a fixed release. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP team was direct that there is no complete mitigation, so settings changes only buy you time. If you are on PHP 8.1 or older, the project no longer ships updates, though it has published source backports for 7.4, 8.0 and 8.1, and some Linux vendors provide their own.
One more thing from 23 October: a separate note about session upload progress (CVE-2026-115560) says to set session.upload_progress.enabled=0 until the next regular bugfix release, if you changed the serialize handler at runtime. Check the PHP advisory page for the latest on that one.
The next two posts cover the practical parts: what PHP2Shell means for WordPress and shared hosting in India, and a version by version patching checklist.
We build and maintain PHP and non-PHP systems for businesses across Delhi NCR and India. If you are not sure which PHP version your site is running, or who is responsible for updating it, that is a fixable problem. Look at our PHP security patching service work, or just tell us what you are running and we will tell you whether the PHP2Shell vulnerability touches you.