PHP2Shell: CVE-2026-109618 and CVE-2026-109619
Last reviewed
PHP2Shell is a pair of critical vulnerabilities in the PHP runtime itself. Because the flaw lives below your application code, updating your own dependencies does not remove it: PHP has to be upgraded and restarted.
Which PHP versions are fixed?
| PHP branch | Fixed in |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
| PHP 8.1, 8.0, 7.4 and older | No official fixed release: use a vendor backport or move to a supported branch |
Affected ranges in our database: >=5.4.0 <8.2.35>=8.3.0 <8.3.36>=8.4.0 <8.4.27>=8.5.0 <8.5.12
How to check whether you are affected
- On the server, run
php -v(and check the PHP-FPM or Apache module version if it differs). - For Docker, run
docker run --rm your-image php -vor scan the image itself. - From the outside, run a devsecurity scan. It reads the version your server announces and compares it with the advisory data above.
A remote scan can confirm the version only when the server announces it. Distributions often backport fixes without changing the version number, so a patched system can still report an older number: compare the package changelog with the advisory.
How to fix it
- Upgrade PHP to the fixed release for your branch, or to your vendor's patched package.
- Restart PHP-FPM or your web server so the new version is loaded.
- Verify with
php -v, then run a verification scan.
Detailed commands for Ubuntu, Debian and RHEL: How to update PHP on Linux safely. If you deploy with containers: scan your Docker image.
If you cannot upgrade immediately, follow the mitigation guidance in the vendor advisory and your operating system vendor's notice. Workarounds are not a substitute for the upgrade.
Sources
Confirm every detail against the official PHP advisory and release notes before acting. These references were used to compile this page.
- https://www.php.net/ChangeLog-8.php (vendor)
- https://sansec.io/research/php2shell
- https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/
- https://securitylabs.datadoghq.com/articles/php2shell-critical-vulnerabilities-in-php/
- https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
Database records: CVE-2026-109618CVE-2026-109619
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the name used for a pair of critical memory-safety vulnerabilities in the PHP runtime, tracked as CVE-2026-109618 and CVE-2026-109619, that can lead to remote code execution on the server.
Which PHP versions fix PHP2Shell?
The fixed releases are PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12. Each branch is fixed in its own release, so a server on 8.2 needs 8.2.35, not a different branch's number.
Is PHP 8.1, 8.0 or 7.4 affected?
Those branches are end of life and have no official fixed release. Move to a supported branch, or install a backported package from your operating system or long-term-support vendor.
How can I tell if my website is affected?
Run php -v on the server, check your container image, or run a devsecurity scan. A scan can only confirm the version when your server announces it; if it hides it, the result is “could not be confirmed”, not “safe”.
Does my Linux distribution's PHP need the same version number?
Not always. Distributions often backport fixes without changing the upstream version, so compare the package changelog with the advisory.