PHP2Shell: the critical PHP vulnerability and what to do today

What happened, in short

• Two flaws in the PHP core: CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. Both score 9.2 out of 10 on CVSS v4.
• No sign-in needed: an attacker can run code on the server with a web request. The highest risk is Apache with mod_php, where the flaw triggers before your application code even runs.
• Almost every PHP in use is affected: PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed, from version 5.4 through 8.5.11. Researchers confirmed unauthenticated attacks against versions of WordPress, Drupal, Joomla and Magento.
• Attacks are happening: Amazon saw the first attempt on October 17, four days before the flaw was published, and says it is now broadly exploited. Cloudflare also reports attacks.

Affected and fixed versions

If you run PHP 8.1 or earlier, there is no patch to wait for: the only way out is moving to 8.2 or later. That is the case for many old servers nobody has dared to touch.

How to tell if your server is exposed

• On a Linux server (EC2, Lightsail, VPS): run php -v and, if you use PHP-FPM, also php-fpm -v (the name may carry the version, for example php-fpm8.3 -v). Compare with the table.
• On cPanel hosting: check each domain's version in MultiPHP Manager. One server can host sites on different versions.
• In containers: look at the base image tag (for example php:8.3-fpm) and the actual version inside the container. An image built a month ago is still vulnerable even if the tag says 8.3.
• Across an AWS account: Amazon Inspector and the Systems Manager inventory show which instances and ECR images have PHP packages and at what version, so the server nobody remembered is not left out.

What to do today, in order

1. 1. Update PHP. It is the only complete fix. If you use your distribution's packages (Ubuntu, Debian, Red Hat), install the PHP security update and restart PHP-FPM or Apache. On Amazon Linux 2023 the fixed package was still being prepared on October 21: check whether it is out before calling it done. In containers, rebuild the image on the fixed version and redeploy.
2. 2. If you cannot update today, reduce exposure. The PHP team suggests temporary settings: session.upload_progress.enabled=0 and, on PHP 8.5, fatal_error_backtraces=0; for the other flaw, set memory_limit=-1 so the application cannot change it, with a memory limit on the container or server so it does not fall over. Restart every PHP worker afterwards. They lower the risk but do not replace the update.
3. 3. Put a filter in front. Cloudflare already has rules for every customer, free plan included. On AWS, with AWS WAF on the load balancer or CloudFront, you can block requests carrying the text PHP_SESSION_UPLOAD_PROGRESS or, if your application takes no file uploads, multipart uploads. Try it in count mode first so legitimate forms keep working.
4. 4. Check whether someone got in. Search server logs since October 17 for POST requests with PHP_SESSION_UPLOAD_PROGRESS, processes you do not recognize, and new or modified PHP files in the site folders.
5. 5. If none of that is possible, take the site off the internet until it is updated. That is what CERT-EU recommends for exposed applications without a patch.

Frequently asked questions