PHP2Shell: what we know
This page lists only confirmed facts, each with its source and the time we checked it. We update it when a primary source changes. We do not repeat unconfirmed claims.
In short
- Fixed releases
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Source php.net security advisory checked details
- Affected according to the CVE records
- 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12. NVD also counts older versions
Source cve.org (CNA: PHP Group) checked details
- PHP 8.1 and older
- No more updates from the PHP project. Assume these versions are affected too.
Source php.net security advisory checked details
- CVE IDs
- CVE-2026-109618 and CVE-2026-109619: CVSS v4.0 9.2 (PHP project), CVSS v3.1 9.8 (NVD)
Source cve.org (CNA: PHP Group) checked details
Rumours and facts
What is going around, next to what the primary source says.
- Rumour: "CVSS 10.0"
- The PHP project gives 9.2 (CVSS v4.0), NVD gives 9.8 (CVSS v3.1). Both critical, neither is 10.
Source php.net 20-10NVD checked
- Rumour: "Every PHP version since 5.4 is affected" or "PHP 5 through 8, including 6"
- Fixed releases exist for 8.2, 8.3, 8.4 and 8.5. For 7.4, 8.0 and 8.1 the security team only published source patches; assume those versions are affected too. The advisory says nothing about older versions. NVD counts all versions before 8.2.35 as affected; in its CVE records the PHP project only lists 8.2 through 8.5. PHP 6 was never released.
- Rumour: "Turn off session.upload_progress and you are safe"
- That setting only helps against one attack path of CVE-2026-109619. It does not help against CVE-2026-109618. Only updating is a complete fix.
Source GHSA-6wmf checked
- Rumour: "Only Apache mod_php is vulnerable"
- mod_php is hit hardest. PHP-FPM is vulnerable too: for CVE-2026-109619 an attack via FPM was demonstrated, for CVE-2026-109618 according to source code analysis. FrankenPHP and LiteSpeed (LSAPI) are likely affected as well.
- Rumour: "A few php.ini settings will do"
- According to the PHP project there is no complete configuration fix. Only updating to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 solves it.
Source php.net 21-10 checked
- Domain
- Check
- Result
- Report
We are checking
We only read what your site already sends in public. This takes a few seconds.
- Looking up the domain
- Connecting to your site
- Reading the headers
- Identifying the platform
- Identifying the CDN or firewall
Adds platform, firewall or CDN, hosting and your previous scan. We add your result to the form. A person replies within 1 working day.
Details
- Website
- PHP
- PHP version
- Checked
Headers we looked at
What this does not tell you
Read how to find your PHP version yourself
Ask your hosting provider
Copy this question and send it to your hosting provider or developer. You do not need to give us an email address for this.
Which PHP version does this website use, and how do I check that in my hosting panel?
Where should we send your report?
You see the report below. The email version, ready to forward to your web developer, follows.
Your full report
- Website
- PHP
- PHP version
- Platform
- Firewall/CDN
- Hosting
- Previous scan
We add your result to the form. A person replies within 1 working day.
What you can do now
- Update today to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or to the patched package from your host or distribution. That is the only complete fix.
- Cannot update right away? Have your administrator apply the temporary measures from the PHP project's two security advisories, then restart all PHP processes. They include:
- the memory_limit setting from the advisory;
- disabling session.upload_progress;
- on PHP 8.5, disabling fatal_error_backtraces;
- blocking multipart form uploads at the frontend if your site does not use them.
- Mind the memory_limit: without a per-request memory cap, one request can use a lot of server memory. Use it only briefly, together with the request size limits from the advisory, and update afterwards.
- Do not treat this as a fix. According to the PHP project, settings never cover everything.
Source GHSA-w8hw-w9fx-j79wGHSA-6wmf-4rv5-p3rp
No administrator, or not sure what this means? Have your web developer or host do this today, or ask us via the form on this page. We reply within 1 working day.
Plan your PHP upgrade: calendar file
Pick your PHP branch and download a small calendar file (.ics) with the official support end dates from php.net. It also holds one reminder, labelled as our proposal, 60 days before security support ends. No email address needed, and the file holds no personal data.
- Download calendar: PHP 8.2 (active support until 2024-12-31, security support until 2026-12-31)
- Download calendar: PHP 8.3 (active support until 2025-12-31, security support until 2027-12-31)
- Download calendar: PHP 8.4 (active support until 2026-12-31, security support until 2028-12-31)
- Download calendar: PHP 8.5 (active support until 2027-12-31, security support until 2029-12-31)
Source php.net supported versions checked
Share this page
Ask your AI to explain
Opens the chat with a question about this page. An AI answer can differ; the sources above are leading.
- ChatGPT (opens in a new tab)
- Perplexity (opens in a new tab)
- Claude (opens in a new tab)
- Google AI Mode (opens in a new tab)
This question is sent along: Summarise the confirmed facts on https://websitewithoutphp.com/en-gb/php2shell/ in 5 short points, with the source per point.
Confirmed facts
-
On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to php.net these releases fix two critical vulnerabilities that can allow unauthenticated remote code execution, and all PHP users are strongly encouraged to update immediately.
Source php.net security advisory checked Version 1 #feit-phpnet-advisory
-
php.net names as at risk all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. php.net considers the risk highest for mod_php and mentions a demonstrated exploit (a proof that the attack works) in which an unauthenticated request triggers the attack before any application code runs. php.net and CISA have not reported exploitation in the wild.
Source php.net security advisory checked Version 2 #feit-phpnet-who
Corrections (1)
Corrected on : was “mentions a demonstrated exploit in which an unauthenticated request triggers the attack before any application code runs.”, reason: Claim wording reviewed: a demonstrated exploit is a proof that the attack works, not exploitation in the wild. Explanation and the statement that php.net and CISA report no exploitation were added.
-
The PHP project published CVE-2026-109618 and CVE-2026-109619 on cve.org at 13:48 and 13:54 UTC, each rated CVSS v4.0 9.2. NVD completed its analysis at 17:01 UTC and gives both its own score of CVSS v3.1 9.8 (critical). The difference comes from a different scoring version and a different assessment of attack complexity, not from new facts. Affected according to the PHP project's CVE records: 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12. NVD additionally counts all older PHP versions as affected.
Source cve.org (CNA: PHP Group), also GHSA-w8hw-w9fx-j79w, also GHSA-6wmf-4rv5-p3rp, also NVD CVE-2026-109618, also NVD CVE-2026-109619 checked Version 6 #feit-cve-records
Corrections (5)
Corrected on : was “php.net rates each at CVSS v4.0 9.2.”, reason: Source of the score corrected: it comes from the CVE records of the PHP Group, with the attack vector described.
Corrected on : was “The NVD has not yet published its own record (checked 14:06 UTC).”, reason: NVD status updated: both records received at 14:17 UTC.
Corrected on : was “(the GHSA security advisories were not listed as a source for this fact)”, reason: Primary security advisories of the PHP project added as an extra source (source check Hector 16:25 UTC).
Corrected on : was “The NVD received both records at 14:17 UTC (status Received); an NVD analysis and score of its own is not available yet.”, reason: NVD status updated: both records are undergoing analysis since 16:13 UTC; the 9.2 shown by NVD is the PHP project's score (check Hector 16:50 UTC).
Corrected on : was “NVD is analysing both records (status Undergoing Analysis since 16:13 UTC); there is no NVD score of its own yet. The 9.2 shown by NVD is the PHP project's score.”, reason: NVD analysis completed at 17:01 UTC: its own score of CVSS v3.1 9.8 and a wider list of affected versions (check Hector 17:13 UTC).
-
PHP 8.1 and older no longer receive updates from the PHP project. Older versions are not listed in the CVE records, but given the severity the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1, so treat those versions as affected. Some distributions and LTS vendors provide backported fixes.
Source php.net security advisory checked Version 2 #feit-unsupported
Corrections (1)
Corrected on : was “Given the severity, the PHP security team published minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build from source.”, reason: Older versions are not listed in the CVE records, so the text now says to treat them as affected.
-
The CISA Known Exploited Vulnerabilities catalog (catalogue version 2026.10.21, released 14:04 UTC) does not list these vulnerabilities, and php.net reports no exploitation in the wild. That does not mean there are no attacks: Cloudflare reports attack traffic targeting its customers, watchTowr (via The Register) sees exploitation attempts, CERT-EU reports circulating proof-of-concept code and a higher likelihood of exploitation, and NCSC-NL considered large-scale exploitation likely in the short term. None of these sources has confirmed successful exploitation.
Source CISA KEV, also The Register (watchTowr) checked Version 4 #feit-kev
Corrections (3)
Corrected on : was “(version of 20 October 2026, 19:00 UTC)”, reason: Newer catalogue version checked.
Corrected on : was “Exploitation in the wild is not confirmed by php.net or CISA at this time.”, reason: Reports from Cloudflare, CERT-EU and NCSC-NL added.
Corrected on : was “Cloudflare reports attack traffic targeting its customers, CERT-EU reports circulating proof-of-concept code”, reason: Report from watchTowr via The Register (15:08 UTC) added: exploitation attempts, none successful (check Hector).
Live timeline
42 moments, newest first
Every moment from the first signal onwards. Each entry shows its source and status. Confirmed means: checked against a primary source. Reported means: reported this way by the named party.
-
-
NVD completes its analysis
NVD set both CVEs to status Analyzed (17:00 UTC for CVE-2026-109618, 17:01 UTC for CVE-2026-109619) and gives both its own score of CVSS v3.1 9.8 (critical), next to the PHP project's CVSS v4.0 9.2. NVD counts all PHP versions before 8.2.35 as affected, more than the PHP project's CVE records.
The source names no PHP branch.
Source NVD CVE API 2.0 checked
-
watchTowr sees exploitation attempts
15:08 UTC: The Register quotes watchTowr: the company sees attempts to exploit the flaws on its sensors. According to watchTowr, no attempt has succeeded so far.
The source names no PHP branch.
Source The Register checked
-
CISA adds its assessment
CISA added an SSVC assessment to both CVE records: exploitation none, not automatable, technical impact total. CISA also linked the Wiz blog as a third-party advisory.
The source names no PHP branch.
Source cve.org CVE Services API (CISA-ADP) checked
-
NVD receives the records
NVD added both CVEs with status Received. NVD has not published its own analysis yet.
The source names no PHP branch.
Source NVD CVE API 2.0 checked
-
BleepingComputer covers the release
BleepingComputer reported the emergency patches for the two flaws tracked as PHP2Shell and advised admins to install the fixed versions as soon as possible.
The source names no PHP branch.
Source BleepingComputer checked
-
Not in CISA's KEV catalogue
The KEV catalogue version released at 14:04 UTC does not list CVE-2026-109618 or CVE-2026-109619. Exploitation in the wild is not confirmed by CISA.
The source names no PHP branch.
Source CISA Known Exploited Vulnerabilities catalog checked
-
Wiz publishes PHP2Shell
Wiz published its research under the name PHP2Shell, with a disclosure timeline and thanks to the PHP team, Calif and OpenAI. Wiz says nearly every PHP version back to 5.4 is affected by at least one issue.
The source names no PHP branch.
Source Wiz Blog checked
-
Cloudflare names the researchers
Cloudflare wrote that Calif.io, Wiz, OpenAI and Quarkslab disclosed the two flaws known as php2shell, and that it had worked with the PHP Foundation, OpenAI and Wiz on mitigations. It still tells customers to patch.
The source names no PHP branch.
Source Cloudflare Blog checked
-
Ubuntu ships PHP updates
Ubuntu published USN-8948-1 for both CVEs and rates them critical. At our check, php8.1 on 22.04 (jammy) and php8.3 on 24.04 (noble) were marked as released.
Source Ubuntu Security Notice USN-8948-1 checked
-
Cloudflare sees attack traffic
Cloudflare reports that it observed attack traffic targeting its customers and adjusted its WAF rules. This reports attack attempts, not confirmed successful exploitation.
The source names no PHP branch.
Source Cloudflare-blog checked
-
CVE-2026-109619 published
The CVE record "RCE via stale global state" went public with the same score and the same affected version ranges. Credits name Wiz, Ryan at Calif.io and OpenAI as reporters.
Source cve.org CVE Services API checked
-
First press reports of the fix
Help Net Security reported that the fixes were out and repeated php.net's advice to update immediately. It also mentioned the UK NCSC urging organisations to patch.
The source names no PHP branch.
Source Help Net Security checked
-
CVE-2026-109618 published
The CVE record "RCE via OOM corruption" went public with CVSS v4.0 9.2 (critical). Affected: 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12.
Source cve.org CVE Services API checked
-
Debian fixes php8.4 in trixie
Debian released DSA-6574-1 with php8.4 version 8.4.27-1~deb13u1 for the stable release trixie. At our check, the Debian tracker still marked php8.2 in bookworm as vulnerable.
Source Debian Security Advisory DSA-6574-1 checked
-
Advisory names memory_limit as temporary measure
The security advisory for CVE-2026-109618 names as the main temporary setting for those who cannot update right away: memory_limit=-1, enforced by the administrator, followed by a restart of all PHP workers. The PHP project explicitly says this is not a complete fix.
The source names no PHP branch.
Source GitHub Security Advisory GHSA-w8hw-w9fx-j79w checked
-
GitHub advisories published
PHP published GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) at 13:34:13 UTC and GHSA-w8hw-w9fx-j79w (CVE-2026-109618) at 13:34:25 UTC, both rated critical. Both list 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as patched versions.
Source GitHub Security Advisories, php/php-src checked
-
PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35
The release announcements and the security advisory were merged into the php.net website code at 12:59 UTC, ahead of the planned 14:00 UTC. php.net says the versions fix two critical flaws that can allow unauthenticated remote code execution, and urges everyone to update immediately.
Source php.net news archive en GitHub php/web-php checked
-
NCSC-NL: large-scale exploitation likely
NCSC-NL wrote in its php2shell repository that multiple public proofs of concept were available, that it had no indication of active exploitation, and that it considered large-scale exploitation likely in the short term. NCSC-NL replaced that passage at 14:11 UTC with the official php.net information.
The source names no PHP branch.
Source NCSC-NL, php2shell-repository (versie 1781b17) checked
-
Hosting software vendor ships a stopgap rule
CloudLinux said its Imunify360 ruleset 8.83 blocks the publicly circulating exploit pattern on Apache, as an interim measure only. Updated alt-php and ea-php packages would follow the upstream release.
The source names no PHP branch.
Source CloudLinux Blog checked
-
Dutch NCSC opens an information page
The Dutch National Cyber Security Centre started a public page on GitHub. It said it had no indication of active exploitation yet, but expected large-scale exploitation in the short term.
The source names no PHP branch.
Source NCSC-NL op GitHub checked
-
Dutch sites go offline as a precaution
NOS reported that organisations in the Netherlands were taking websites offline as a precaution, starting with NotuBiz, a meeting platform used by about a hundred municipalities. The article was updated later in the day.
The source names no PHP branch.
Source NOS checked
-
Tenable publishes its FAQ
Tenable summarised what was known before the patch, including the CERT-EU advisory and the expected fixed versions. It noted that exploit code circulating online was unverified and may contain malware.
The source names no PHP branch.
Source Tenable Blog checked
-
SecurityWeek reports the leak
SecurityWeek reported that details of two critical PHP flaws called PHP2Shell had leaked before coordinated disclosure. It wrote that public reporting uses the name PHP2Shell, and that watchTowr and Huntress had not seen exploitation in the wild.
The source names no PHP branch.
Source SecurityWeek checked
-
Plesk will ship patched packages
A Plesk community manager wrote on the Plesk forum that fixed PHP versions will be added to Plesk PHP packages once released, without a firm date yet.
The source names no PHP branch.
Source CMS ADMINS (Plesk forum) checked
-
Cloudflare switches on WAF rules
Cloudflare says customers on its free and paid WAF plans were protected by default from 03:02 UTC, about nine hours before public disclosure. Cloudflare calls this extra protection, not a replacement for updating PHP.
The source names no PHP branch.
Source Cloudflare Blog checked
- all day
CERT-EU: proof-of-concept code circulating
CERT-EU reports that initial public proof-of-concept code is circulating and that this raises the likelihood that attackers are already exploiting the vulnerabilities.
The source names no PHP branch.
Source CERT-EU Security Advisory 2026-018 (v1.1) checked
- all day
Reported from the inside: the embargo broke early
Alexandre Daubois, who writes that he is on the inside of the PHP security team, wrote that the embargo broke in several places on 20 October. According to him, PHP moved the release a day earlier because of it; php.net itself announced 21 October and does not confirm an earlier planned date. He also warned that the most shared php.ini tip only covers one of the two bugs.
The source names no PHP branch.
Source daubois.dev checked
- all day
OpenAI describes the coordination
OpenAI wrote that it led a coalition of maintainers, researchers and security providers over two months, that Calif found a flaw using an OpenAI model, and that Wiz found and reported both flaws independently. OpenAI says applying the fixes is the priority now.
The source names no PHP branch.
Source OpenAI checked
- all day
Calif publishes its write-up
Calif published its account of the two flaws, which it says were found by Calif, OpenAI and Wiz. It was shared on Hacker News at 13:56 UTC and ends with one message: patch.
The source names no PHP branch.
Source Calif Research checked
- all day
German BSI issues a warning
Germany's federal cyber security agency published a warning about both CVEs, based on the PHP advance notice. Kevin Beaumont linked to it at 11:40 UTC.
The source names no PHP branch.
Source BSI Cybersicherheitswarnung checked
-
-
-
First FAQ for defenders
watchTowr published a FAQ on the two CVEs. It said the official disclosure had been expected on 22 October.
The source names no PHP branch.
Source watchTowr Intelligence checked
-
php.net announces an emergency release
php.net announced a security release for Wednesday 21 October at 14:00 UTC for two critical flaws, both CVSS v4.0 9.2. The team reserved the right to release earlier if details became public or exploitation appeared.
The source names no PHP branch.
Source php.net news archive checked
-
Researcher flags a leak
Security researcher Kevin Beaumont posted that someone had leaked both CVE numbers before a patch was out. CERT-EU later cited this post in its advisory.
The source names no PHP branch.
Source Mastodon (cyberplace.social) checked
-
First public signal
A Hacker News post citing an unnamed source warned of two PHP remote code execution flaws and named both reserved CVE numbers. It said an announcement was planned for 22 October.
The source names no PHP branch.
Source Hacker News checked
- all day
CERT-EU advisory 2026-018
CERT-EU advised organisations to prepare for immediate patching and, where that is not possible, to consider taking internet-facing PHP applications off public networks until a fix is in place. The page lists a release time of 20:33 without a time zone.
The source names no PHP branch.
Source CERT-EU Security Advisory 2026-018 checked
-
-
-
Release versions tagged
The release managers tagged the fixed versions in the PHP source repository: 8.2.35 at 07:30 UTC, 8.3.36 at 14:00 UTC, 8.4.27 at 14:44 UTC and 8.5.12 at 17:04 UTC. The tags were prepared two days before the public release.
Source GitHub php/php-src (git tags) checked
-
-
-
Two CVE numbers reserved
The PHP Group reserved CVE-2026-109618 at 21:03 UTC and CVE-2026-109619 at 21:04 UTC. A reserved number carries no public details until the record is published.
The source names no PHP branch.
Source cve.org CVE Services API checked
-
-
- all day
PHP starts on a coordinated fix
Wiz writes that the PHP project acknowledged the reports on this day and began work on a coordinated fix. php.net itself does not give this date.
The source names no PHP branch.
Source Wiz Blog checked
-
-
- all day
Wiz reports to the PHP security team
According to the Wiz disclosure timeline, Wiz Research reported the vulnerabilities to the PHP security team on this day.
The source names no PHP branch.
Source Wiz Blog checked
-
-
- all day
Wiz finds the flaws independently
Wiz Research writes that it found the first PHP vulnerability on 19 August with help from AI tools, and reported its findings to the PHP security team on 24 August.
The source names no PHP branch.
Source Wiz Blog checked
-
-
- all day
First report to PHP
Calif says it reported the first bug to PHP on this day and started coordinated disclosure. According to Calif, PHP confirmed on 15 August that the demonstration worked.
The source names no PHP branch.
Source Calif Research, php2shell write-up checked
-
-
- all day
Calif finds the first paths
According to its own timeline, security firm Calif found several independent paths in PHP that could lead to remote code execution. It reported the first bug to the PHP project on 11 August and the second on 21 August.
The source names no PHP branch.
Source Calif Research, php2shell write-up checked
-
Still unknown
- Whether the vulnerabilities are being exploited in the wild
- When your hosting provider or Linux distribution ships updated packages
Frequently asked questions
What is PHP2Shell?
The press uses this name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, fixed by the PHP project on 21 October 2026. According to php.net they can allow unauthenticated remote code execution.
Which PHP versions are affected?
According to the CVE records published by the PHP project: 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27 and 8.5 before 8.5.12. PHP 8.1 and older no longer receive updates from the PHP project; php.net published source backports for 7.4, 8.0 and 8.1. Treat those older versions as affected.
Which versions fix it?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026.
Are the vulnerabilities being exploited?
php.net mentions a demonstrated exploit, a proof that the attack works. php.net and CISA have not reported exploitation in the wild, and the CISA Known Exploited Vulnerabilities catalog does not list them at our last check.