PHP2Shell PHP Vulnerability (CVE-2026-109618 & CVE-2026-109619): Affected Versions, Patches and Protection

PHP2Shell is the name for two critical security vulnerabilities in PHP itself: CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS 4.0 9.2 and let attackers run their own code on web servers without logging in. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on 21 October 2026. If you use PHP for web requests, update now, restart every PHP process and check the system for signs of attack.

The flaws do not affect a single CMS but every website that runs on PHP, including TYPO3, WordPress, Shopware and Laravel. Germany's BSI has issued a warning, and several security firms report attack attempts.

This guide explains what PHP2Shell is, which PHP versions and server setups are affected, how to check your server, close the gap and find traces of an attack, and how NITSAN supports you.

Check your PHP version right now with our free PHP2Shell checker. If you are affected, we help you with priority.

What is PHP2Shell?

PHP2Shell is the collective name security researchers gave to two related flaws in the PHP interpreter. Both belong to the use-after-free (CWE-416) class and sit in areas that almost every request touches: memory management and error handling.

The two CVEs at a glance:

How does the PHP2Shell attack work?

An attack via PHP2Shell runs in four steps:

• Crafted HTTP request: An attacker sends a specially built request without logging in, usually with a multipart body.
• Memory limit or fatal error: PHP aborts processing while request data is still being set up.
• Broken memory state: Half-initialised data or stale pointers are left behind and reused later.
• Attacker code is executed: The memory corruption is used to run commands with the rights of the PHP user.

Why is PHP2Shell so dangerous?

• No login required: The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) needs neither credentials nor user interaction.
• The attack runs before your code: On mod_php the exploit fires before any CMS code starts. Plugins and login protection do not help.
• Huge exposure: Palo Alto Networks Unit 42 counts over 22.6 million potentially exposed instances. The vulnerable code has existed since PHP 5.4 (2012).
• Early attacks: The CVE IDs leaked before the patch. Cloudflare saw first attack attempts at 07:43 UTC on 21 October, more than six hours before the release.
• Credential leaks: According to Wiz and Patchstack, worker memory holding passwords, API keys and session tokens can be read even without code execution.

As of 22 October, the BSI was not aware of broad successful exploitation. watchTowr, however, reports exploitation attempts, and several public authorities, universities and hospitals in Germany took online services offline as a precaution.

Which PHP versions are affected by PHP2Shell?

All PHP versions before the following releases are vulnerable:

Which server setups are at risk?

Every PHP installation that processes web requests is affected. The risk differs by server API (SAPI):

What does PHP2Shell mean for TYPO3 websites?

TYPO3 itself needs no code fix. Every TYPO3 instance, however, inherits the risk of its PHP version. The TYPO3 version decides how far you can move PHP forward:

Find your current TYPO3 version quickly with the free TYPO3 Version Check. For older installations, our TYPO3 Upgrade Service helps. To learn what a TYPO3 security update is and how to keep TYPO3 up to date, read our article on TYPO3 security and maintenance.

Timeline: when did what happen?

How do you check whether your server is affected by PHP2Shell?

What matters is the PHP version your website serves. The command-line version can differ. Check it like this:

• In TYPO3: Admin Tools › Environment › PHP Info, or the system information menu at the top right of the backend.
• On the server: php -v only shows the CLI version. Also check with apachectl -M | grep php whether mod_php is loaded and with systemctl list-units | grep fpm which PHP-FPM services run.
• With your host: Ask for the exact PHP version and whether every PHP process was restarted after the update.
• Assess: If your version is below 8.5.12, 8.4.27, 8.3.36 or 8.2.35, the server is vulnerable. PHP 8.1 and older is always vulnerable without a backport.

Fix PHP2Shell: 5 steps

1. Inventory every PHP runtime

List all servers, vhosts, containers and appliances with PHP, including PHP in control panels and vendor products. Record the version and SAPI for each system.

2. Install the patched PHP version

Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 from your distribution, your host or php.net. Debian, Ubuntu and Red Hat received the patch in advance. According to the PHP project, users of rpms.remirepo.net should switch to distribution packages or build from source.

3. Restart every worker

A running PHP-FPM master or Apache with mod_php keeps the old code in memory. Restart every PHP-FPM pool and the web server. Containers must be rebuilt and rolled out again.

4. Verify the live version

Open the website and confirm the new version in the TYPO3 environment module or via a temporary, protected info script that you delete afterwards.

5. Check for compromise

If the system was reachable from the internet unpatched since 20 October, check it for traces of an attack (see below) and rotate credentials.

What if you cannot update immediately?

The PHP security team lists interim mitigations. They reduce the risk but do not make the server safe. Set them in php.ini, the FPM pool or the web server configuration, not via ini_set() or .user.ini:

Was your server attacked via PHP2Shell?

Security teams advise treating every system that was reachable from the internet unpatched from 20 October onwards as potentially compromised until checked. On TYPO3 and other PHP websites, look for these signs:

• New or changed PHP files in writable folders such as fileadmin/, typo3temp/, uploads/ or var/
• Unusual multipart POST requests, bursts of HTTP 500 errors or crashed PHP workers (segfaults) in logs since 20 October
• New backend or system users, unknown cron jobs, SSH keys or outbound connections from the web user
• Differences between vendor/ or core files and composer.lock or a clean installation

After patching, rotate database passwords, API keys, SMTP credentials, the TYPO3 encryptionKey and active backend sessions. If personal data may have been accessed, the GDPR (Art. 33) requires notifying the supervisory authority within 72 hours.

Which configuration mistakes make attacks easier is covered in our article 12 TYPO3 security mistakes.

How NITSAN helps with PHP2Shell

NITSAN is a TYPO3 agency with offices in Dresden, Berlin and Viernheim, a Gold Member of the TYPO3 Association and has more than 20 TYPO3 developers on the team. We close PHP2Shell for organisations in Germany, Austria and Switzerland:

• Emergency patch service: PHP update on your servers or together with your host, restart of every worker, verification of the live version
• Compromise check: review of logs, files, users and cron jobs since 20 October, rotation of critical credentials
• EOL rescue and upgrade: backport path for PHP 7.4 to 8.1 and a safe upgrade to TYPO3 v13 or v14 LTS
• TYPO3 security SLA: planned PHP and TYPO3 updates, monitoring and fast response through our TYPO3 Support & Maintenance, from €149 per month

We handle PHP2Shell requests with priority. We review your request first, get back to you as quickly as possible and close the gap together with you or your host. Customers with a TYPO3 maintenance contract simply mention PHP2Shell in their support request.

Our PHP2Shell response process

Want PHP2Shell closed on your servers? Request priority help, email st@nitsantech.de or call Sven Thelemann directly: +49 351 48196661.

Conclusion

PHP2Shell is one of the most serious PHP security vulnerabilities in years. The flaws sit in the PHP core, affect every website running PHP and can be exploited without logging in. The only complete fix is an update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, followed by a restart of every PHP process.

Systems on PHP 8.1 or older need a backport and an upgrade plan. Also check every unpatched, publicly reachable system for signs of an attack. With an experienced TYPO3 partner, you close the gap quickly and with full documentation. So that the next critical release is not another emergency, our TYPO3 maintenance contract handles PHP and TYPO3 updates on a schedule.

Sources

• PHP Foundation: Today's PHP Security Release
• php.net: Security advisory for CVE-2026-109618 and CVE-2026-109619
• BSI: PHP – critical vulnerabilities threaten web applications worldwide
• WordPress.org: Critical PHP Security Release
• Palo Alto Networks Unit 42: Threat Brief
• watchTowr: PHP2Shell FAQ
• Plesk: PHP2Shell in bundled PHP