The October 2026 PHP security update: what PHP2Shell is and what to do

On October 21, 2026, the PHP project released security updates for every branch it still supports. They fix 2 critical flaws known together as PHP2Shell: CVE-2026-109618 and CVE-2026-109619. The severity listed for them is CVSS v4.0 9.2, rated critical. Proof-of-concept code is reportedly public, and security researchers reported attempts to use it within days of the fix.

Here is what PHP released, what the 2 flaws are in plain words and in technical terms, who needs to act, and what to ask your host or developer for.

What is PHP2Shell?

PHP2Shell is the name for 2 separate flaws in PHP, the language behind WordPress, Drupal, Joomla, Magento, Laravel and many custom websites. Both were fixed in the same release on October 21, 2026. In plain words:

• [CVE-2026-109618](/cve/CVE-2026-109618): A memory error while PHP reads form data can let an attacker run their own code.
• [CVE-2026-109619](/cve/CVE-2026-109619): Leftover state from 1 request can be reused by the next, letting an attacker run code.

Both sit in PHP itself, not in WordPress or any other app built on it. That's why the fix comes from PHP and is applied on the server.

For your developer

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): Remote code execution via out-of-memory corruption during request parsing.
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): Remote code execution via stale global state across requests on the same worker.

PHP2Shell applies to PHP served through PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The GitHub advisories and PHP's announcement are linked in the sources at the end of this page.

Who is affected

Any website whose server runs PHP from before the fix. PHP still releases updates for 4 lines, 8.2 and newer, and each got its own fixed release:

• [PHP 8.5](/php-versions/8-5): 8.5.0 to 8.5.11 are from before the fix. Update to 8.5.12 or later.
• [PHP 8.4](/php-versions/8-4): 8.4.0 to 8.4.26 are from before the fix. Update to 8.4.27 or later.
• [PHP 8.3](/php-versions/8-3): 8.3.0 to 8.3.35 are from before the fix. Update to 8.3.36 or later.
• [PHP 8.2](/php-versions/8-2): 8.2.0 to 8.2.34 are from before the fix. Update to 8.2.35 or later.

PHP 7.4, 8.0 and 8.1 no longer get releases from PHP. For those lines, PHP published the fix only as source code, which a host or developer has to build by hand. Some hosts and Linux distributions add fixes like this to their own PHP packages without changing the version number, so the number alone can't settle it. Ask your host whether the fix is on your server, and plan a move to PHP 8.2 or later. See PHP 7.4, PHP 8.0 and PHP 8.1 for their dates.

Sites built on Webflow, Shopify, Squarespace or Wix don't run PHP that their owners manage; the platform runs the servers. WordPress, WooCommerce, Drupal, Joomla, Magento and Laravel sites do run PHP. Does my website use PHP? helps if you're not sure.

How serious is it?

The severity listed for PHP2Shell is CVSS v4.0 9.2, rated critical. Either flaw can let an attacker run their own code on a server that runs PHP from before the fix. Proof-of-concept code is reportedly public, and security researchers reported attempts to use it within days of the fix. The Canadian Centre for Cyber Security published an alert about both flaws (AL26-026).

That makes this an update to schedule now rather than at the next routine maintenance window. It doesn't mean any particular site has been attacked, and a calm, prompt update is the right response.

What to do

1. 1Find out whether your website runs on PHP. Enter its address in PHP Scanner; it loads your page once and tells you what it saw.
2. 2Find the exact PHP version. Your server may hide it, which is good practice. How to check your PHP version shows where to look in WordPress, cPanel and managed hosts.
3. 3Compare it with the fixed releases: 8.2.35, 8.3.36, 8.4.27, 8.5.12. Anything older on the same line is from before the fix.
4. 4Ask whoever runs your server to update PHP to the fixed release for your line and restart PHP. On shared or managed hosting that's your host; on your own server it's your developer.
5. 5If the update can't happen today, ask for PHP's temporary workarounds. They close only some attack paths. PHP2Shell workarounds lists each one.

Doing it yourself? How to update PHP in WordPress and How to change your PHP version in cPanel walk through the common cases, and the host guides for cPanel, GoDaddy, Bluehost, SiteGround and WP Engine show where each one keeps the setting.

How to follow PHP security updates every month

PHP fixes security problems in point releases (the last number in a version like 8.3.36). Lines in active support get regular point releases. Lines that receive security fixes only get a release when one is needed, so some months bring several and others none.

• PHP 8.5: active support until December 31, 2027, security fixes until December 31, 2029.
• PHP 8.4: active support until December 31, 2026, security fixes until December 31, 2028.
• PHP 8.3: security fixes only, until December 31, 2027.
• PHP 8.2: security fixes only, until December 31, 2026. After that date it gets no more updates from PHP.

To keep up, watch the news page on php.net, ask your host how quickly they apply PHP point releases, and check your site again after each update. PHP versions and end-of-life dates keeps every line's status in 1 place.