How to check your server has the php2shell patch

On 21 October, the PHP team unveiled updates for versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12, which incorporate the critical php2shell patch addressing CVE-2026-109618 and CVE-2026-109619 vulnerabilities. Both security flaws permit attackers to execute arbitrary code on the server without prior authentication, and both are currently being exploited.

Organizations utilizing PHP for their websites or e-commerce platforms are strongly advised to verify whether their server processes have applied the necessary patch this week. It is essential to act promptly rather than waiting for the next maintenance window.

Following the patch installation, it is crucial to restart PHP-FPM or Apache and rebuild any container images. The PHP team has committed to supporting PHP 8.2 until 31 December 2026. Unfortunately, the vulnerabilities have already been exploited, with initial attack attempts reported just 19 minutes after the patches were made available. By early on 22 October, Cloudflare had logged millions of such attempts.

A confirmed successful takeover was reported on 26 October, targeting a honeypot server running Apache with mod_php and PHP 8.4.26. Researchers Marcus Hutchins independently confirmed the breach. Additionally, an unnamed European government body experienced a breach via an unpatched server, leaving a web shell in place to maintain unauthorized access.

Several server configurations are susceptible to these attacks, including those running mod_php in Apache and PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. Attackers have attempted over millions of times against unpatched PHP servers, making it imperative to remediate the issue without delay.