PHP2Shell: myths and facts

Does PHP2Shell have a CVSS score of 10.0?

"CVSSCVSS is a score from 0 to 10 that shows how serious a security weakness is, so you can see at a glance which problems to deal with first. 10.0"

Verdict: Not true

In plain language

It is one of the most serious categories, just not the highest score. You still need to update.

What the primary source says

The PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. project gives 9.2 (CVSS v4.0), NVDThe NVD is a US government database of known security weaknesses. It adds its own severity scores and extra details to the public records of each weakness. gives 9.8 (CVSS v3.1). Both critical, neither is 10.

Source php.net 20-10/NVD / checked 2026-10-21 17:30 UTC / last change 2026-10-21 17:13 UTC

Is every PHP version since 5.4 affected, including PHP 6?

"Every PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. since 5.4 is affected" or "PHP 5 through 8, including 6"

Verdict: Partly true

In plain language

If your site runs PHP 8.2 to 8.5, there is an update. If it runs an older version, assume it is at risk too.

What the primary source says

Fixed releases exist for 8.2, 8.3, 8.4 and 8.5. For 7.4, 8.0 and 8.1 the security team only published source patches; assume those versions are affected too. The advisory says nothing about older versions. NVD counts all versions before 8.2.35 as affected; in its CVE records the PHP project only lists 8.2 through 8.5. PHP 6 was never released.

Source GHSA-w8hw/NVD / checked 2026-10-21 17:30 UTC / last change 2026-10-21 17:13 UTC

Which branches still get fixes? See the supported PHP versions.

Are you safe if you turn off session.upload_progress?

"Turn off session.upload_progress and you are safe"

Verdict: Not true

In plain language

That setting closes only one of the attack routes. The rest stay open until you update.

What the primary source says

That setting only helps against one attack path of CVE-2026-109619. It does not help against CVE-2026-109618. Only updating is a complete fix.

Source GHSA-6wmf / checked 2026-10-21 16:25 UTC / last change 2026-10-21 16:34 UTC

Is only Apache mod_php vulnerable?

"Only ApacheA web server is the program, such as Apache, Nginx or LiteSpeed, that answers when a visitor opens your site and sends back the page and files. mod_phpmod_php is an older way of running PHP, in which PHP is built into Apache, the program that answers visitors, instead of running as a separate helper. is vulnerable"

Verdict: Not true

In plain language

Apache mod_php is most at risk, but PHP-FPMPHP-FPM is a helper on your hosting that runs your site's PHP code as a separate job and hands the finished page back to the program that answers visitors. and other common setups are at risk too.

What the primary source says

mod_php is hit hardest. PHP-FPM is vulnerable too: for CVE-2026-109619 an attack via FPM was demonstrated, for CVE-2026-109618 according to source code analysis. FrankenPHP and LiteSpeed (LSAPI) are likely affected as well.

Source GHSA-w8hw/GHSA-6wmf / checked 2026-10-21 16:25 UTC / last change 2026-10-21 16:34 UTC

Will a few php.ini settings do?

"A few php.iniphp.ini is the settings file for PHP on your hosting. It sets limits, such as how much memory a script may use, how big an upload may be and if errors show. settings will do"

Verdict: Not true

In plain language

Changing settings helps only partly and for a while. Only an update fixes it.

What the primary source says

According to the PHP project there is no complete configuration fix. Only updating to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 solves it.

Source php.net 21-10 / checked 2026-10-21 16:25 UTC / last change 2026-10-21 16:34 UTC