Pentest Machine
PT-BR PT ES EN
Request a quote

Security alert · PHP2Shell

PHP2Shell: what to do in the next 72 hours

Two critical flaws in the PHP core (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow remote code execution and reading server memory. Patching is the first step, not the last.

Request a quote See how it worksTypical timeline: 72 h after access

What happened

On 21 Oct 2026 the PHP project fixed two flaws found by Wiz Research, Calif and OpenAI. One corrupts request state during out-of-memory handling; the other reuses freed state and lets an attacker read process memory — passwords, tokens and API keys from other requests — as well as execute code.

  • Affected: every PHP install serving web requests: PHP-FPM, Apache mod_php (highest risk), php-cgi, FrankenPHP and LiteSpeed.
  • Fixed: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Branches 8.1 and older are unsupported; minimal backports exist and several distributions shipped patched packages.
  • Exploitation: attack attempts were seen before and right after disclosure. Wiz demonstrated unauthenticated code execution against WordPress, Drupal and Joomla.

Sources: Help Net Security, BleepingComputer, Wiz.

Do this now

  1. Inventory: run php -v on every server (don't trust the web header).
  2. Update to your branch's fixed release or your distribution's patched package (check the changelog).
  3. Partial mitigation until then: session.upload_progress.enabled=0, memory_limit=-1 via php_admin_value with a container memory cap, a low post_max_size and WAF rules. None of them blocks everything.
  4. Rotate secrets after patching: database passwords, API and cloud keys, WordPress salts, session secrets and OAuth tokens. Invalidate active sessions.
  5. Look for signs since 17 Oct: spikes of 500 and out-of-memory errors, odd multipart uploads, web shells, new admin users.

Free, passive check

The External Security X-Ray now shows PHP2Shell exposure signals for your domain: PHP and CMS detected, declared version and server. It is passive — it sends no attacks — and does not replace checking the version on the server.

PHP2Shell response in 72 hours

Fixed scope, fixed-price proposal within 24 h, delivery within 72 h of access being granted:

  • Version and SAPI inventory for every PHP server and container.
  • Log review for exploitation since 17 Oct.
  • Prioritised secret-rotation plan.
  • Executive report and per-server remediation plan.
  • Retest after the fix.

We updated our own stack to PHP 8.4.27 and applied the mitigations right after disclosure.

Frequently asked questions

Does updating PHP fix everything?

It closes the flaw but doesn't undo what may have leaked. Because CVE-2026-109619 allows reading process memory, rotate secrets and invalidate sessions after patching.

My site is behind Cloudflare. Am I protected?

Partly. Cloudflare published WAF rules for the known vectors, but they are temporary. Update PHP anyway.

I run PHP 7.4 or 8.1. Now what?

Those branches are unsupported. Check whether your distribution shipped a patched package; if not, plan the move to 8.2+ and apply the mitigations meanwhile.

Does the X-Ray confirm whether I'm vulnerable?

No. It shows external signals (PHP, CMS, declared version). Distributions patch without changing the version number, so confirmation happens on the server.

Further reading

Other services

Web application penetration testingWeb App PentestAPI penetration testingAPI PentestAI and LLM penetration testingAI / LLM Pentest · SpecialtyGet a penetration testing quote in 24 hoursGet a quote

Request a quote

Get a proposal within 24h.

Tell us what you need tested. An expert — not a salesperson — replies with scope, timeline and price.

  • NDA available before any detail is shared
  • Support in EN, PT and ES
  • Invoicing in the US, EU or Brazil