PHP2Shell: the critical PHP vulnerability and how to patch it

Short answer

Both bugs are memory-safety flaws in how PHP handles incoming web requests, including file uploads. Each is rated 9.2 out of 10 on CVSS v4.0. The fix is to upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to your Linux distribution's patched package, and then restart PHP.

This is a flaw in PHP itself, not in a plugin. Every PHP site should check its version today.

Who is affected?

• Apache with mod_php: the highest risk, because a demonstrated exploit triggers before any application code runs
• PHP-FPM, the setup behind most Nginx servers: affected, with exploitation depending on configuration and application behaviour
• Other ways of running PHP, such as php-cgi, FrankenPHP and LiteSpeed, are also listed as affected
• Older branches: official fixes cover PHP 8.2 to 8.5; PHP 8.1 and older are end-of-life, so you depend on your OS vendor or an extended-support provider

Is PHP2Shell being exploited?

Reports differ. Some security vendors say they have seen exploitation attempts, while others have not confirmed attacks in the wild, and researchers note that reliable exploitation is harder on some systems than others. None of that changes the advice: the details are public, so assume attackers are working on it and patch now.

How to patch PHP2Shell, step by step

• Find the PHP version your website actually runs, from your hosting panel or a phpinfo() page; php -v in a terminal shows the command-line version, which can differ
• Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your distribution's security update
• Restart PHP-FPM and the web server, because running processes keep the old, vulnerable code in memory
• On managed hosting, check your provider's status page, since many hosts patch their platforms for you
• On PHP 8.1 or older, plan the upgrade now instead of waiting for the next emergency

Is there a temporary workaround?

Only a partial one. Setting session.upload_progress.enabled = 0 in php.ini or the PHP-FPM pool configuration blocks one known attack path for CVE-2026-109619, but does nothing for CVE-2026-109618. Web application firewall rules can block known exploit patterns. Treat both as stopgaps until the real update is installed.

What PHP2Shell means for business owners

Many companies do not know which PHP version their website, online shop or internal tools run on. That is the real risk. Ask whoever maintains your site three questions: which PHP version runs in production, when it was last patched, and who handles the next emergency update. If nobody can answer quickly, that is the gap to close.

Conclusion

PHP2Shell is serious because it sits in PHP itself and can be reached without logging in. The fix is simple: update PHP, restart it and confirm the new version is live. Do it today, then make sure the next patch does not depend on luck.