PHP2Shell: Remote Code Execution in PHP

• You run PHP websites or APIs on your own servers or containers

  PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed

  Act now

  Update to a fixed version today and restart every PHP process. Apache with mod_php is at the highest risk. Find your fixed version

• You run PHP 8.1 or older

  Including 7.x and 5.x

  Act now

  These versions are affected and the PHP project will not release a fix. Install your vendor’s backported package if one exists, or upgrade to PHP 8.2 or later.

• Your PHP runs on a managed host or platform

  Shared hosting, cPanel, Plesk, App Engine, Laravel Cloud

  Update needed

  Confirm with your provider that PHP is patched. Several platforms patched automatically, but custom images and containers must be rebuilt and redeployed by you. Platform status

• You run products that bundle PHP

  Appliances, control panels, Windows software with php-cgi.exe

  Update needed

  Ask the vendor for a fixed build. The Dutch NCSC keeps a list of products that embed PHP.

• Your site sits behind Cloudflare, Akamai or another firewall

  A CDN or web application firewall in front of PHP

  Update needed

  These services now block known attacks automatically, which buys you time. They do not fix PHP, so update anyway. What each provider covers

• You only use PHP on the command line

  Scripts, Composer, cron jobs that do not serve web requests

  Low risk

  PHP describes the risk as installations that serve web requests. Update with your next routine patch.

1. 01

   Find every PHP that serves web traffic

   Include servers, container images, control panels and products that bundle PHP. Check the PHP that serves requests, not only the one on the command line: they are often different installs. How to check
2. 02

   Update to a fixed version

   Install 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution’s patched package. Rebuild container images on a patched base image. Patched versions
3. 03

   Restart every PHP process

   Restart PHP-FPM, Apache, and any long-running PHP workers such as queue workers or Laravel Octane. A process that started before the update keeps running the vulnerable code.
4. 04

   If you cannot update today, reduce the exposure

   Apply PHP’s temporary measures and update as soon as a package is available. They block the known attack paths, not all of them.
5. 05

   Check for signs of compromise and rotate secrets

   Exposed servers may already have been attacked, and one of the flaws can leak server memory. What to look for

PHP releases

For PHP 7.4, 8.0 and 8.1, the PHP security team published minimal source backports for people who build PHP themselves, but no official releases. PHP 8.2 reaches end of life on 31 December 2026.

Operating systems and images

Distributions often backport the fix without changing the PHP version number. Ubuntu 24.04’s fixed package is still PHP 8.3.6, for example. Check the package version, not only php -v.

Hosting platforms

Not yet fixed

Until a package arrives for these, apply the temporary measures. We could not confirm the status for Alpine, Bitnami, AlmaLinux, Rocky Linux, AWS Lambda or Azure App Service from their own pages.

On the server

php -v                        # the command-line PHP
php-fpm -v                    # may be named php-fpm8.3, php-fpm84 and so on
apachectl -M | grep -i php    # any output means Apache loads mod_php

Compare the result with the fixed versions. If PHP came from your distribution, check the package changelog for the CVE numbers instead. A match means the fix is installed.

zgrep -E "CVE-2026-10961[89]" /usr/share/doc/php*-common/changelog.Debian.gz

rpm -q --changelog php-common | grep -E "CVE-2026-10961[89]"

Through the web server

To see the version and settings that live requests actually use, save this as a PHP file with a hard-to-guess name in your web root, open it once in a browser, then delete it.

<?php
echo PHP_SAPI, " ", PHP_VERSION, "\n";
echo "session.upload_progress.enabled=", var_export(ini_get("session.upload_progress.enabled"), true), "\n";
echo "memory_limit=", ini_get("memory_limit"), "\n";
echo "post_max_size=", ini_get("post_max_size"), "\n";

The first line shows the server interface, for example fpm-fcgi or apache2handler for mod_php, and the version. The other lines show whether the temporary measures below are in effect. Do not leave the file in place or use a public phpinfo() page instead.

Change three PHP settings

From PHP’s advisory. Turning off session upload progress blocks the confirmed paths for CVE-2026-109619. Removing PHP’s memory limit and capping request size reduces exposure to CVE-2026-109618. Set them in server configuration so applications cannot change them, then restart every PHP process.

php_admin_flag[session.upload_progress.enabled] = off
php_admin_value[memory_limit] = -1
php_admin_value[post_max_size] = 8M

php_admin_flag session.upload_progress.enabled off
php_admin_value memory_limit -1
php_admin_value post_max_size 8M

session.upload_progress.enabled = 0
memory_limit = -1
post_max_size = 8M

• Use post_max_size = 32M if your application accepts uploads, and keep upload_max_filesize below it.
• On PHP 8.5, also set fatal_error_backtraces to off the same way.
• With no memory limit, a single request can use all the memory on the server. Cap memory with a container or cgroup limit instead. Do not use RLIMIT_AS or RLIMIT_DATA: PHP says these can trigger the flaw.
• Setting these with ini_set() or a .user.ini file does not work.

We checked that each snippet takes effect, using the official PHP 8.4 images with PHP-FPM and Apache. We did not test them against the exploits.

Block file upload requests at the web server

The known attacks arrive as multipart form requests, the format browsers use for file uploads. If your site does not accept uploads, Sansec suggests rejecting them outright. This is not part of PHP’s advice, and it breaks every upload form and some checkout forms.

if ($http_content_type ~* "multipart/form-data") { return 403; }

RewriteEngine On
RewriteCond %{HTTP:Content-Type} multipart/form-data [NC]
RewriteRule ^ - [F]

In our tests, both rules returned 403 for upload requests, including unusual spellings of the content type, and let ordinary form posts through. The Apache rule only worked inside a <Directory> block: placed in the global server configuration, it was silently ignored by the virtual host and blocked nothing. Send a test upload to confirm it is working.

Why a firewall rule is not enough

• The rules recognise the attacks known so far. Cloudflare reports attackers already changing their payloads to get past its rules, and Wiz says there are more variants of the flaw than the published ones.
• They only see traffic that passes through the provider. If your server can be reached directly, the rules do nothing, so allow connections only from the provider’s IP ranges.
• Some are off until you turn them on, or only log matches instead of blocking them.
• Cloudflare calls its rules a stopgap, Fastly calls its virtual patch partial protection, and the PHP2Shell researchers say not to treat a protective rule as a substitute for updating PHP.

What each provider has announced

Wiz also credits AWS, Microsoft, Imperva and Vercel with preparing mitigations, but none of them had published anything about these flaws on their own sites at the time of writing. The general PHP rule groups in AWS WAF and Google Cloud Armor are not specific to these flaws. If your provider is not listed, ask it directly.

During an attack

• Unusual multipart requests followed by memory errors or repeated HTTP 500 responses (Wiz).
• Unexpectedly large or garbled PHPSESSID cookies in responses, which can mean server memory is leaking.
• PHP workers crashing or restarting for no clear reason.

According to CrowdStrike, the one trace an attempt reliably leaves in the server log is an out-of-memory error reported in Unknown on line 0, meaning no PHP file was running when it happened. Adjust the log paths to match your server.

grep -E "Allowed memory size of [0-9]+ bytes exhausted .* in Unknown on line 0" \
  /var/log/apache2/error.log /var/log/php*-fpm.log

A match is a reason to investigate, not proof of compromise.

After a successful attack

Huntress recommends looking for:

• PHP or web server processes starting shells or tools such as sh, bash, curl, wget, python, cmd.exe or powershell.exe.
• Reconnaissance commands such as whoami, id or uname -a run by the web server user.
• New PHP files in the web root, upload, cache or temporary folders.
• New cron jobs, scheduled tasks or user accounts.
• New outbound connections from web servers to unknown hosts.

Because one of the flaws can leak server memory, rotate passwords, API keys and tokens held by internet-facing PHP servers once they are patched. No official list of attacker IP addresses or file hashes had been published at the time of writing.

PHP2Shell is two critical flaws in the core of PHP, the code that handles every web request before an application runs. PHP fixed them on 21 October 2026. Because the flaws sit below the application, even a one-line “Hello World” page on an affected version can be attacked, according to Wiz. No login is needed. The name comes from the exploit Wiz built; it is not an official PHP name.

PHP considers the risk highest for Apache with mod_php, where an attack completes before any application code runs. Remote code execution has also been demonstrated on PHP-FPM.

The two flaws

CVE-2026-109618, out-of-memory corruption. A crafted request can make PHP run out of memory while it is still setting up the request. PHP then abandons the work and cleans up memory that was never properly prepared, which an attacker can turn into code execution. The technical advisory confirms this on Apache with mod_php using default settings.

CVE-2026-109619, stale state. When a request ends abruptly, PHP can leave behind references to memory it has already freed. The next request handled by the same worker uses them. The confirmed paths go through session upload progress, which is on by default, and the fatal error backtraces added in PHP 8.5. The technical advisory confirms code execution on both Apache with mod_php and PHP-FPM.

Is it being exploited?

Early attacks have been reported. Cloudflare says it has seen attack traffic against its customers. A video of a working exploit leaked on 20 October, and community proof-of-concept code is circulating. Treat unofficial exploit repositories as untrusted: some may contain malware. As of 16:30 UTC on 21 October, the flaws were not in the CISA Known Exploited Vulnerabilities catalog.

How PHP is responding

The PHP Foundation calls the time it took to ship a fix “a structural failure”. First signs of the memory problem surfaced in a 2024 audit, and work on the fix stalled repeatedly until the reports in August 2026. The Foundation says it has created an Ecosystem Security Team, hired security staff, commissioned further audits, and is changing how the security team makes decisions. It is asking companies and governments that depend on PHP to fund that work.

1. 2026-07-30

   2026-07-30

   Security firm Calif begins an audit of PHP under the Patch the Planet program.

   PHP Foundation

2. 2026-08-11

   2026-08-11

   Calif reports an unauthenticated remote code execution flaw. OpenAI independently reports the same root cause on the same day.

   PHP Foundation

3. 2026-08-24

   2026-08-24

   Wiz Research reports further ways to attack the same flaws.

   PHP Foundation

4. 2026-09-18

   2026-09-18

   OpenAI reports further attack paths.

   PHP Foundation

5. 2026-10-20

   2026-10-20 · about 15:00 UTC

   The CVE numbers leak on forums and social media, with an incorrect score of 10.0. No technical details leak.

   PHP Foundation

6. 2026-10-20 · 19:30 UTC

   PHP pre-announces the release and brings it forward from 22 to 21 October.

   PHP advisory

7. 2026-10-20 · about 20:00 UTC

   Calif mistakenly publishes a video of a working exploit. It is deleted, but copies circulate.

   PHP Foundation

8. 2026-10-21

   2026-10-21 · 03:02 UTC

   Cloudflare switches on WAF rules for all plans, including Free, and later reports attack traffic against its customers.

   Cloudflare blog

9. 2026-10-21

   PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and publishes its advisory. Ubuntu, Debian, Arch, cPanel and Plesk ship fixes the same day.

   PHP advisory

Several posts written before PHP’s advisory describe the attack as only the upload progress path, and recommend switching that setting off as a complete fix. PHP’s own advisory says it is not. The Swiss NCSC also notes that a firewall alone is not sufficient.

Evidence to keep: the date you assessed it, the list of systems and images that run PHP, the versions before and after, the restart times, any temporary settings and when you removed them, the log review, and any secrets you rotated.

For how these controls work day to day, see our guides to ISO 27001 vulnerability management, SOC 2 vulnerability management, and incident response plans for ISO 27001 and SOC 2.

• PHP security advisory, 21 October 2026Who is at risk, fixed versions and temporary measures.
• GHSA-w8hw-w9fx-j79w (CVE-2026-109618)Technical advisory for the out-of-memory flaw.
• GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)Technical advisory for the stale state flaw.
• PHP Foundation blog, 21 October 2026Disclosure timeline and the Foundation’s security plans.
• Wiz ResearchExploitation research and detection signals.
• php2shell.comWiz’s summary site, with answers to common questions.
• Cloudflare blogWAF rules and observed attack traffic.
• CERT-EU advisory 2026-018Affected versions and recommended measures.
• CrowdStrikeThe log line left by an attack attempt.
• HuntressPost-exploitation behaviour to hunt for.