Your app was patched. Your PHP was not: PHP2Shell explained

On October 20, 2026, the PHP security community received early warning of two critical vulnerabilities. Rather than waiting for the planned disclosure, PHP released patches on October 21, sparking the term "PHP2Shell" to describe the incident. These flaws, CVE-2026-109618 and CVE-2026-109619, are fundamentally different from vulnerabilities in WordPress themes or plugins. Instead, they affect the underlying PHP runtime that powers websites.

The vulnerabilities allow attackers to execute arbitrary code on vulnerable web servers without authentication. This is possible because the bugs in PHP's handling of memory during request processing can be exploited. One flaw occurs when PHP encounters an out-of-memory condition during the creation of request data. Another flaw occurs when request-specific state is not properly reset after memory is freed.

What sets PHP2Shell apart from many other vulnerabilities is that updating the application code (like WordPress) does not fix the issue. The application code remains unchanged, but the underlying PHP runtime has a known vulnerability. This is why many security advisories emphasize that "updating your app does not update PHP."

Finding affected PHP installations can be challenging because PHP is often embedded within other software and may not be immediately apparent. It's common to find PHP hidden within Docker images, vendor software, or shared hosting accounts. To locate these installations, a comprehensive inventory of all systems and servers must be created. Each system must be checked for the PHP version it uses, as multiple PHP versions can coexist on a single server.

The recommended fixes are to install the patched versions of PHP corresponding to the branch you are currently running. However, it's crucial not to jump branches hastily, as this might introduce new issues. Restarting all PHP workers is essential after applying the patch, as the old, vulnerable code remains in memory until the worker restarts.

For those running PHP 8.1 or earlier, there are no official patches available. These versions have reached end-of-life, and the only viable solution is to upgrade to a supported branch or take the system offline until a patch can be applied. This stark reality underscores the importance of maintaining up-to-date PHP installations, as failing to do so can leave websites and applications exposed to significant security risks.