PHP2Shell: myths and facts

Does PHP2Shell have a CVSS score of 10.0?

"CVSSCVSS is a score from 0 to 10 that shows how serious a security weakness is, so you can see at a glance which problems to deal with first. 10.0"

Verdict: Not true

In plain language

It is one of the most serious categories, just not the highest score. You still need to update.

What the primary source says

Source

Neither is 10. The PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. project gives 9.2 (CVSS 4.0) for both; NVDThe NVD is a US government database of known security weaknesses. It adds its own severity scores and extra details to the public records of each weakness. gives 9.8 and 8.1 (CVSS 3.1).

Source php.net 20-10/NVD/NVD CVE-2026-109619 / checked 22 October 2026 at 22:39 UTC / last change 22 October 2026 at 22:39 UTC

Is every PHP version since 5.4 affected, including PHP 6?

"Every PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. since 5.4 is affected" or "PHP 5 through 8, including 6"

Verdict: Partly true

In plain language

If your site runs PHP 8.2 to 8.5, there is an update. If it runs an older version, assume it is at risk too.

What the primary source says

Source

Fixed releases exist for 8.2, 8.3, 8.4 and 8.5. For 7.4, 8.0 and 8.1 the security team only published source patches; assume those versions are affected too. The advisory says nothing about older versions. NVD counts all versions before 8.2.35 as affected; in its CVE records the PHP project only lists 8.2 through 8.5. PHP 6 was never released.

Source GHSA-w8hw/NVD / checked 21 October 2026 at 17:30 UTC / last change 21 October 2026 at 17:13 UTC

Which branches still get fixes? See the supported PHP versions.

Are you safe if you turn off session.upload_progress?

"Turn off session.upload_progress and you are safe"

Verdict: Not true

In plain language

That setting closes only one of the attack routes. The rest stay open until you update.

What the primary source says

Source

That setting only helps against one attack path of CVE-2026-109619. It does not help against CVE-2026-109618. Updating is the fix for both vulnerabilities. For an additional, unlikely route (CVE-2026-115560), the PHP project also mentions this setting until the next regular release.

Source GHSA-6wmf/php.net / checked 24 October 2026 at 12:13 UTC / last change 24 October 2026 at 12:13 UTC

Is only Apache mod_php vulnerable?

"Only ApacheA web server is the program, such as Apache, Nginx or LiteSpeed, that answers when a visitor opens your site and sends back the page and files. mod_phpmod_php is an older way of running PHP, in which PHP is built into Apache, the program that answers visitors, instead of running as a separate helper. is vulnerable"

Verdict: Not true

In plain language

Apache mod_php is most at risk, but PHP-FPMPHP-FPM is a helper on your hosting that runs your site's PHP code as a separate job and hands the finished page back to the program that answers visitors. and other common setups are at risk too.

What the primary source says

Source

mod_php is hit hardest. PHP-FPM is vulnerable too: for CVE-2026-109619 an attack via FPM was demonstrated, for CVE-2026-109618 according to source code analysis. FrankenPHP and LiteSpeed (LSAPI) are likely affected as well.

Source GHSA-w8hw/GHSA-6wmf / checked 21 October 2026 at 16:25 UTC / last change 21 October 2026 at 16:34 UTC

Will a few php.ini settings do?

"A few php.iniphp.ini is the settings file for PHP on your hosting. It sets limits, such as how much memory a script may use, how big an upload may be and if errors show. settings will do"

Verdict: Not true

In plain language

Changing settings helps only partly and for a while. Only an update fixes it.

What the primary source says

Source

According to the PHP project there is no complete configuration fix. Only updating to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 solves it.

Source php.net 21-10 / checked 21 October 2026 at 16:25 UTC / last change 21 October 2026 at 16:34 UTC

Is the fix in PHP 8.5.12 incomplete?

The fix in PHP 8.5.12 is incomplete

Verdict: Unconfirmed

In plain language

The PHP project has not confirmed this publicly. You still need to update.

What the primary source says

Source

An unconfirmed Fediverse report was forwarded to oss-security. The same writer later reported, second-hand, that the PHP project told Canonical it is unrelated and not a real issue. The PHP project has not confirmed this publicly. The fixed releases remain 8.2.35, 8.3.36, 8.4.27 and 8.5.12. You still need to update.

Source oss-security /16/oss-security /23 / checked 21 October 2026 at 22:30 UTC / last change 21 October 2026 at 22:30 UTC