PHP2Shell is the name for two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, that let an attacker run code on a web server without logging in. The PHP project released fixed versions on October 21, 2026: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. On October 26, CISA confirmed the flaws are being exploited in attacks. Any website or web application running PHP, including WordPress, Drupal, Joomla, and Magento sites, needs to be updated now. Palo Alto Networks firewalls are affected too: on October 28, the company confirmed attacks on PAN-OS management pages exposed to the internet.
If Spot On Tech manages your IT, you are covered. We identified and patched every client server and website running PHP and checked them for signs of compromise. Client firewalls are covered too. The rest of this guide explains what PHP2Shell is and what every other business should check.
Current as of November 1, 2026. Sources: Field Effect and The Register on the firewall attacks, the PHP project's release announcement, Huntress, Patchstack, CISA, BleepingComputer, and The Register.
Key takeaways
- Update PHP now. The fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Restart every PHP worker afterward so the fix takes effect.
- Attacks are confirmed. CISA added both flaws to its Known Exploited Vulnerabilities list on October 26, 2026, after researchers recorded the first successful attacks.
- No login is needed. An attacker only has to reach the website over the internet.
- Firewalls are a target too. Palo Alto Networks PAN-OS firewalls use PHP in their management web page, and attackers are taking them over where that page is exposed to the internet. Update PAN-OS and keep the management page off the internet.
- It is not a WordPress or plugin bug. The flaw is in PHP, so any site on an unpatched version is exposed, however well its plugins are maintained.
- Settings changes are not a fix. The PHP project says only an update fully closes the vulnerabilities.
- Check one setting after you patch. Because of a separate, rarer flaw (CVE-2026-115560) that the October 21 updates do not fix, PHP recommends
session.upload_progress.enabled=0until its next release for applications that change session settings while they run. If you are not sure, turn it off. - Old PHP is the biggest risk. PHP 8.1 and older get no official update. Those sites need a vendor backport, an upgrade, or to come off the internet.
Timeline
| Date (2026) | What happened |
|---|---|
| October 17 | Amazon sees the first exploitation attempt against its decoy servers, four days before the fixes are released. |
| October 20 | Details of the two vulnerabilities leak online before the planned disclosure. PHP announces an early security release. |
| October 21, morning | Hosting partners report active exploitation incidents to Patchstack, and Cloudflare reports early attacks and deploys temporary firewall rules. |
| October 21, 13:52 UTC | PHP releases 8.5.12, 8.4.27, 8.3.36, and 8.2.35, plus minimal source fixes for 7.4, 8.0, and 8.1. |
| October 21 | The UK National Cyber Security Centre urges organizations to update immediately or take affected systems offline. |
| October 23 | PHP discloses a separate, rarer flaw, CVE-2026-115560, with no patch yet, and recommends turning off session upload progress until its next release. |
| October 23 and 24 | Suspected China-linked attackers take full control of Palo Alto firewalls at U.S. government-affiliated organizations by chaining PHP2Shell with a Linux kernel flaw, according to security firm Dream. Siemens warns that its RUGGEDCOM APE1808, which runs PAN-OS, is affected. |
| October 24 | A Perplexity security researcher records 35 successful attacks that ran commands on three decoy servers running PHP 8.4.26 with Apache mod_php. |
| October 25 | CYFIRMA links slow, targeted scanning of government, bank, and aviation PHP servers to a suspected North Korea-linked group, with moderate confidence. |
| October 26 | CISA adds both flaws to its Known Exploited Vulnerabilities list and gives federal agencies until October 29 to patch. |
| October 28 | Palo Alto Networks confirms PHP2Shell attacks on internet-exposed PAN-OS management pages. CISA adds the Linux kernel flaw Fragnesia (CVE-2026-46300), used to turn PHP2Shell access into full control, to its exploited list. |
| October 29 | Dream reports about 25 systems taken over in the United States, Japan, Taiwan, and South Korea, followed by attacks on Active Directory passwords. Palo Alto's Unit 42 confirms the findings. |
What PHP2Shell is
PHP is the programming language behind a large share of the web, including WordPress. Both vulnerabilities come from the way PHP cleans up memory when a web request ends abnormally. Researchers from Calif, OpenAI, and Wiz found that an attacker can send specially crafted requests that leave PHP's memory in a corrupted state, then use that state to run their own code on the server.
- CVE-2026-109618 abuses how PHP handles running out of memory during a request.
- CVE-2026-109619 abuses leftover request data that a later request can reuse. It can also leak memory contents, which Wiz showed could expose passwords, tokens, API keys, and certificates.
The PHP project rates both as critical, with a CVSS v4.0 score of 9.2. The code runs with the permissions of the web server account, which is usually enough to change the website, read its database credentials, and plant a backdoor. Wiz demonstrated unauthenticated attacks against WordPress, Drupal, and Joomla.
According to the PHP security advisory, every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Apache with mod_php carries the highest risk, because a demonstrated exploit works before any application code runs.
Is PHP2Shell being exploited?
Yes. On October 26, 2026, CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog, its list of flaws with evidence of real attacks, and gave federal agencies until October 29 to patch. CISA has not said which organizations were hit.
Attackers started early. Amazon saw the first attempt against its decoy servers (honeypots) on October 17, four days before the fixes shipped, and Cloudflare, watchTowr, and Patchstack reported attempts around the release. Those early attempts were reported as unsuccessful. On October 24, Perplexity security researcher Adel Karimi recorded 35 successful attacks that ran commands on three decoy servers running PHP 8.4.26 with Apache mod_php, the setup the PHP project rates as highest risk. The decoys were configured in a way that favored the attacker, so many real servers may be harder to break into, but working attacks now exist. The Register and BleepingComputer have the details.
Scanning continues. On October 25, threat intelligence firm CYFIRMA linked a slow, targeted campaign probing government, banking, and aviation PHP servers in about a dozen countries, including the United States, to a suspected North Korea-linked group, with moderate confidence. Cloudflare reports millions of exploitation attempts since disclosure (The Hacker News).
Are firewalls affected by PHP2Shell?
Yes, some are. Palo Alto Networks firewalls run PHP in their management web interface, the page administrators use to configure the device. On October 28, Palo Alto confirmed PHP2Shell attacks on PAN-OS firewalls whose management interface can be reached from the internet. PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 and Panorama are affected. Traffic passing through the firewall is not; the risk is the management page. Siemens' RUGGEDCOM APE1808, which runs PAN-OS, is affected too.
The attacks are serious. Security firm Dream reported on October 29 that suspected China-linked attackers built their own PHP2Shell exploit for the firewall, then chained it with a Linux kernel flaw nicknamed Fragnesia (CVE-2026-46300) to take full control. They took over about 25 systems in the United States, Japan, Taiwan, and South Korea, including Palo Alto firewalls at U.S. government-affiliated organizations. From there they tunneled into internal networks, decrypted a stored directory service password, and sprayed passwords against Active Directory accounts. Palo Alto's Unit 42 confirmed the findings (The Register). Fragnesia also affects ordinary Linux servers, so install your distribution's kernel update as well.
If you run a Palo Alto firewall:
- Update PAN-OS and Panorama to the fixed hotfix for your version: 12.2.4-h1 or later on 12.2, and the hotfix listed in Palo Alto's advisory for other releases.
- Make sure the management interface is reachable only from trusted internal addresses, never from the internet, and that no outside-facing interface has a management profile attached.
- Remember that patching does not remove an attacker who is already in. Look for unexpected outbound SSH connections, unfamiliar admin activity, and password spraying in Active Directory, and change the firewall's admin and directory (LDAP) passwords if anything looks wrong.
- Send firewall logs to a separate system, so the evidence survives if the device is tampered with.
Other firewall and VPN brands have their own exploited flaws this year. Our GlobalProtect post tracks them, and our firewall and VPN security guide covers the long-term fix.
Is there a new PHP vulnerability after PHP2Shell?
Yes, but it is far less likely to affect you. On October 23, PHP disclosed CVE-2026-115560, a separate flaw that can also let an attacker run code. The October 21 updates do not fix it. It only affects an unusual setup: an application that changes how PHP stores session data while it runs, on a server with session upload progress turned on. PHP calls that combination unlikely in practice and will ship a fix and a full advisory with its next release.
Until then, PHP recommends setting session.upload_progress.enabled=0. The PHP Foundation says applications that never change the session serializer while they run can leave upload progress on. If you are not sure whether yours does, turn it off, and if you already applied the setting for PHP2Shell, keep it in place after you update.
Where PHP may be running in your business
| Where | Examples |
|---|---|
| Your website | WordPress, Drupal, Joomla, WooCommerce, and Magento sites |
| Hosting | Shared hosting and control panels such as cPanel and Plesk |
| Internal tools | Intranets, portals, ticketing, and custom web apps |
| Vendor software | Appliances and Windows programs that quietly include PHP, including Palo Alto Networks PAN-OS firewalls |
| Old servers | Anything still on PHP 8.1 or earlier |
Vendor software is the easiest to miss. Huntress notes that some appliances and Windows applications include their own copy of PHP without advertising it, so an inventory has to look beyond the website.
Fixed PHP versions
| PHP branch | Update to |
|---|---|
| 8.5 | 8.5.12 or later |
| 8.4 | 8.4.27 or later |
| 8.3 | 8.3.36 or later |
| 8.2 | 8.2.35 or later |
| 8.1 and older | No official update. Use a vendor backport or upgrade. |
Linux distributions and long-term support vendors received the fixes in advance, so your operating system's package may carry the fix under its own version number. Check with your vendor. PHP 8.2 itself reaches end of life on December 31, 2026, so sites on 8.2 should plan their next upgrade as well.
What your business should do now
1. Find every place PHP runs
List your websites, staging sites, hosting accounts, internal web tools, and vendor appliances. Ask each web host, developer, and software vendor directly which PHP version they run for you and whether it is patched.
2. Update and restart
Install the fixed version or your vendor's patched package, then restart every PHP worker, including PHP-FPM pools and Apache. A fix that is installed but not loaded does not protect you. Prioritize internet-facing servers, starting with any running Apache and mod_php. Then leave session upload progress turned off until PHP's next release, as described above.
3. If you cannot update today, limit exposure
Take the site offline or into maintenance mode, or restrict who can reach it. The PHP project lists temporary settings, such as turning off session.upload_progress, but it states that they do not make an installation safe. Cloudflare's emergency firewall rules help only if your server accepts traffic exclusively through Cloudflare. Avoid unofficial "fix" plugins and copied code snippets.
4. Check for signs of compromise
Preserve web server and PHP logs before making changes. Then look for:
- PHP or web server processes starting shells, scripting tools, or download tools.
- New or changed files in the website folders, especially unfamiliar PHP files.
- New scheduled tasks, cron jobs, or user accounts.
- Unexpected administrator accounts in WordPress or other site software.
- Outbound connections from the web server to unfamiliar addresses, which attackers use to download more tools.
- In web server logs, a POST request that returns a 500 error, followed by PHP reporting memory exhaustion or heap corruption and the web server worker crashing. ReliaQuest flags this sequence as a likely exploitation attempt.
5. Rotate secrets if you see warning signs
Because one of the flaws can leak memory, a targeted server may have exposed its database password, API keys, or other credentials. If you find signs of compromise, treat the server as compromised, rebuild or clean it with professional help, and change every credential it held.
6. Plan the upgrade for old PHP
Sites on PHP 8.1 or older are now permanently exposed unless a vendor backports the fix. Treat the upgrade as urgent, and keep those systems off the open internet until it is done. Our patch management guide for small businesses covers how to keep software like this current going forward.
For WordPress site owners
WordPress is not the vulnerable part, and updating plugins does not fix this. Your PHP version is what matters. In WordPress, go to Tools > Site Health > Info > Server to see the PHP version your site runs, or ask your host. If you are on managed WordPress hosting, check your host's announcements to confirm they have patched.
What to ask your web host or IT provider
- Which PHP version do our websites and applications run, and has it been patched for CVE-2026-109618 and CVE-2026-109619?
- Were PHP workers restarted after the update?
- Are any of our systems on PHP 8.1 or older, and what is the plan for them?
- Have you checked our servers for new files, accounts, or scheduled tasks since October 17?
- Do any vendor appliances or programs we use include their own copy of PHP?
- Is our firewall patched for PHP2Shell, and is its management page closed to the internet?
How Spot On Tech helps
For the businesses we manage, patching, monitoring, and incident response are part of the same service. That is how we identified and patched every PHP system our clients run. Our cybersecurity services cover vulnerability response and monitoring, and a technology risk assessment can find the forgotten servers, sites, and vendor software that cause problems in moments like this.
If you are a New York or New Jersey business and are not sure whether your website or systems are exposed, talk with Spot On Tech.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed in October 2026. They let an attacker run code on a web server running PHP without logging in.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released on October 21, 2026. PHP 8.1 and older receive no official update, though some vendors provide backports.
Is WordPress affected by PHP2Shell?
WordPress itself is not the flaw, but any WordPress site running an unpatched version of PHP is exposed. Researchers demonstrated the attack against WordPress, Drupal, and Joomla. Updating PHP, not WordPress or plugins, is the fix.
Is PHP2Shell being exploited?
Yes. CISA added both vulnerabilities to its Known Exploited Vulnerabilities list on October 26, 2026, and researchers recorded the first successful attacks on October 24. Attempts began as early as October 17. Update now.
Is PHP2Shell on the CISA KEV list?
Yes. CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on October 26, 2026. Federal civilian agencies must patch by October 29, 2026, and CISA urges every organization to prioritize the fix.
What is CVE-2026-115560?
A separate PHP flaw disclosed on October 23, 2026, that the PHP2Shell updates do not fix. It affects only an unusual configuration. Until PHP's next release, PHP recommends setting session.upload_progress.enabled=0 for applications that change session settings while they run. If you are not sure, turn it off.
Are Palo Alto firewalls affected by PHP2Shell?
Yes. Palo Alto Networks confirmed on October 28, 2026, that attackers are exploiting PHP2Shell against PAN-OS firewalls whose management interface is exposed to the internet. Update PAN-OS and Panorama to the fixed hotfix and restrict the management interface to trusted internal addresses.
What is Fragnesia (CVE-2026-46300)?
A Linux kernel flaw that lets an attacker who already runs code on a system take full root control. Attackers chained it with PHP2Shell to take over firewalls, and CISA added it to its exploited list on October 28, 2026. Install your Linux distribution's kernel update.
Do the PHP configuration workarounds make us safe?
No. The PHP project lists temporary settings that reduce risk, but says only an update is a complete solution.
How do I check which PHP version my website uses?
In WordPress, go to Tools, then Site Health, then Info, then Server. Otherwise, check your hosting control panel or ask your host or developer.
Are Spot On Tech clients affected?
Spot On Tech's managed clients are covered. We identified and patched every client server and website running PHP, and checked them for signs of compromise. Our clients remain covered after the October 28 reports of attacks on firewalls.
