Security advisory
php2shell is critical, so update PHP today.
Two critical flaws in PHP let an attacker run code on your server without logging in. Here is who is at risk, how to tell if you are affected, and the one fix that actually closes it.
By p4ndora security, Security at p4ndora.ai. Published October 21, 2026. 6 min read.
The short answer
Is my site affected by php2shell?
If your server runs PHP below 8.5.12, 8.4.27, 8.3.36 or 8.2.35, treat it as affected and update now. The checker above reads your public response headers for a hint, but a header can be hidden or wrong, so the safe move is to update PHP and follow the steps below.
- Who is affected. Any site on a PHP version below the fixed ones, whatever server software you run. The risk is highest on Apache mod_php.
- What it is. Two flaws called php2shell, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 critical, both allowing remote code execution with no login.
- The one fix. Update PHP to a fixed version. A distribution package can look old yet already carry the patch, so check with your vendor.
Check if your site is affected.
An interactive panel where you enter your website address and start a check. It reads only the public response headers your server already sends to every visitor, looks for the reported PHP version, and shows one of three results. Likely affected, needs a manual check, or no affected version seen. Each result links to the update steps on this page and to a p4ndora audit of your own code.
php2shell is two critical flaws in PHP itself, disclosed on 21 October 2026. The check above reads only your site's public response headers and gives you a quick hint. It is not a verdict, so read on and update PHP whatever it says.
Why php2shell is urgent.
php2shell is the public name for two flaws fixed together, CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS v4.0 score of 9.2, which is critical. Both let an attacker run code on your server with no account and no login, which is about as serious as a web flaw gets.
The flaws are in PHP itself, so they reach sites across every common setup. PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed are all in scope. No special configuration is needed to be at risk. The exposure is highest on Apache mod_php, where PHP runs inside the web server itself.
If an attacker succeeds, the code runs with the same access as your website, which usually means it can read your files and reach your database. That is why the right response is to update today, not this week.
How php2shell works, in plain terms.
A simple diagram of memory during one request. A block of memory is set aside and used, then marked free for reuse, then used a second time after it should have been let go. A small marker shows the two moments php2shell abuses, one while PHP recovers from running low on memory and one when leftover state from an earlier request is picked up again.
You do not need the deep detail to act, and we will not publish any. Here is the idea at a reader's level.
Both flaws are a kind of bug called use after free, known in the catalogue as CWE-416. While PHP handles a request, it sets aside small pieces of memory and later marks them free to reuse. In these two cases a piece of memory is used again after it was no longer valid. One happens while PHP is recovering from running low on memory, the other when leftover state from an earlier request is picked up by a later one.
When memory is reused like this, an attacker who can shape what later fills it can, in the worst case, steer the program into running their own code. We are keeping this high level on purpose. The takeaway is simple. This is a real path to remote code execution, and updating PHP removes it.
How to fix php2shell.
There is one complete fix. Update PHP to a version that carries the patch. Everything else, such as a web firewall rule, only narrows the odds and does not close the flaw.
A short ladder of PHP branches with the first release that carries the fix. Branch 8.5 fixed in 8.5.12, branch 8.4 in 8.4.27, branch 8.3 in 8.3.36, branch 8.2 in 8.2.35. Below the ladder a note marks PHP 8.1 and older as out of official support, reached only by minimal source backports.
The fixed releases came out on 21 October 2026. Update to at least the version for your branch.
PHP 8.5
Update to 8.5.12 or newer.
PHP 8.4
Update to 8.4.27 or newer.
PHP 8.3
Update to 8.3.36 or newer.
PHP 8.2
Update to 8.2.35 or newer.
PHP 8.1 and older have reached end of life and get no official release. The PHP team published minimal source backports for 7.4, 8.0 and 8.1, so a site stuck on an old branch still has a path forward, but moving to a supported branch is the better answer.
One point trips people up. A Linux distribution or a long term support vendor often patches early and keeps the old version number. Your package can read as an older PHP while it already carries the fix. Do not judge by the version string alone. Check your vendor's advisory, or update and confirm with them.
The official details are in the PHP release announcement, the 8.5.12 change log, and the GitHub advisories for CVE-2026-109618 and CVE-2026-109619.
Update PHP, then check your own code.
Updating PHP closes php2shell. It does not touch the far larger surface that most breaches actually start from, which is the code you wrote. A flaw in the runtime is rare. A missing check on the way from user input to your database or your files is not.
p4ndora reads your repository and follows every route from the outside in. It finds where input reaches something dangerous with no check in between, and every finding comes with the exact lines and the path that reaches them. Each push is checked again, so a fix stays fixed.
Your whole repository
An audit takes in everything at one pinned commit, not a sample of it.
Findings you can check
Every finding is tied to its lines and the path that reaches them.
Every push compared
A new commit is checked again, so you see what changed for security.
Update PHP today. Then start an audit and see what the rest of your code has been hiding.
Questions
- Am I affected by php2shell?
- If your server runs PHP below 8.5.12, 8.4.27, 8.3.36 or 8.2.35, assume yes and update now. The checker at the top reads your public headers for a hint, but a header can be hidden or wrong, so update regardless.
- Which PHP versions fix php2shell?
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on 21 October 2026. Update to at least the fixed version for the branch you run.
- What are CVE-2026-109618 and CVE-2026-109619?
- The two flaws that make up php2shell. Both are rated CVSS 9.2 critical and both allow unauthenticated remote code execution. The weakness class is use after free, CWE-416.
- I run an old PHP version. What now?
- PHP 8.1 and older get no official release. Minimal source backports exist for 7.4, 8.0 and 8.1, but the right move is to update to a supported branch that has a full fix.
- My distribution still shows an old PHP version. Am I still at risk?
- Maybe not. Distributions and support vendors often patch early and keep the old version number, so your package can be fixed while it still reads as older. Check your vendor's advisory to be sure.
- Does p4ndora detect php2shell?
- php2shell is a flaw in the PHP runtime, so the fix is to update PHP, not to change your code. p4ndora audits the code you wrote, where most breaches begin, and watches every push for new issues.
Secure your code.
Connect a repository with read access and run your first p4ndora audit.