PHP2Shell CVE-2026-109618 Patch Guide for PHP Servers

PHP2Shell is an urgent PHP security issue, not a vulnerability limited to WordPress, Drupal, or Joomla. PHP’s October 21, 2026 security advisory identifies CVE-2026-109618 as a critical remote-code-execution flaw linked to out-of-memory handling and partially initialized request state. A related issue, CVE-2026-109619, is commonly discussed under the same PHP2Shell name.

The complete fix is to update the PHP runtime that actually handles web requests. Administrators should identify both the installed PHP version and its server API, or SAPI, before applying a vendor package and restarting the relevant workers.

PHP branch	Fixed release	Patch status
8.2	8.2.35	Update to this release or later
8.3	8.3.36	Update to this release or later
8.4	8.4.27	Update to this release or later
8.5	8.5.12	Update to this release or later

Which PHP servers may be affected?

The advisory covers PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed deployments. The highest demonstrated risk has been associated with mod_php, but administrators should not treat another SAPI as automatically safe. PHP 8.1 and older are upstream-end-of-life; some operating-system vendors may provide backported fixes, so package status must be checked with the relevant distributor.

For teams maintaining application infrastructure, this is also a useful moment to review project consultation guidance around dependency ownership, deployment responsibility, and upgrade planning. Those decisions matter when PHP is supplied by a hosting panel, Linux distribution, container image, or managed platform rather than installed directly.

First response for administrators

1. Determine the PHP binary, version, SAPI, and package source serving production traffic.
2. Apply the fixed vendor release and restart PHP-FPM, Apache, LiteSpeed, or equivalent workers.
3. Verify the running version through the service itself, not only the command-line installation.

Temporary risk reduction while a patch is pending

If an immediate package update is not possible, PHP’s advisory describes limited measures that may reduce exposure to CVE-2026-109618. Administrators can set memory_limit=-1 administratively, enforce conservative post_max_size and request-size limits at the frontend, and avoid RLIMIT_AS or RLIMIT_DATA. These controls address specific failure conditions, but they are not a complete security fix and should not delay upgrading.

Configuration changes also need to be applied at the layer that receives the request. A setting in a command-line configuration file may not affect PHP-FPM or Apache, while a hosting panel may regenerate service configuration during deployment. Record the change, identify which workers inherited it, and plan its removal after the fixed package is installed. Teams that need help mapping this responsibility across an application stack can use project consultation guidance as a starting point for upgrade planning.

Verify the runtime, not just the package

After updating, restart every service that can execute PHP, including PHP-FPM pools, Apache workers, LiteSpeed processes, or container workloads. Then verify the version through the web-serving path. A command such as php -v may inspect a different binary or SAPI from the one handling production traffic. Check the service configuration, container image, hosting panel, or a controlled diagnostic endpoint, while ensuring that version details are not exposed publicly.

Review evidence of attempted exploitation

Patch deployment should be followed by focused log review. Look for unusual multipart requests, repeated HTTP 500 responses, memory-limit failures, malformed PHPSESSID cookies, and unexplained PHP worker crashes or churn. Correlate web-server, PHP, process-manager, firewall, and application logs by timestamp. These indicators are not proof of exploitation on their own, but clusters of anomalies can justify preserving logs, rotating relevant credentials, reviewing file changes, and escalating to an incident-response process.

Because package names and backport status vary by distribution, document the vendor advisory and exact installed build used to close the issue. Do not mark a server remediated solely because its operating system reports that a package is current.

Confirm the vendor fix and close the exposure

Version checking is only one part of PHP2Shell remediation. The installed build may come from a Linux distribution, hosting control panel, container image, or managed platform, and each source can publish fixes on a different schedule. Compare the package changelog or vendor security notice with the upstream fixed branches, then record the exact build, repository, image digest, or platform release used in production.

For PHP 8.2, 8.3, 8.4, and 8.5, the upstream fixed releases are 8.2.35, 8.3.36, 8.4.27, and 8.5.12 respectively. Older branches require particular care: PHP 8.1 and earlier are no longer supported upstream, although a distribution may backport the relevant patch. Treat a vendor-maintained backport as resolved only after its advisory or package metadata confirms that CVE-2026-109618 is addressed.

Check every production path

• Inspect public web servers, internal administration sites, staging systems, and forgotten maintenance hosts.
• Check separate PHP-FPM pools, Apache virtual hosts, LiteSpeed services, cron containers, and queue workers.
• Confirm that blue-green, autoscaling, and rollback images do not still contain a vulnerable runtime.
• Remove temporary mitigations only after patched workers are active and verified.

If suspicious activity appears in the logs, preserve the relevant records before aggressive rotation. Review recently modified PHP files, unexpected child processes, outbound connections, authentication events, and credentials accessible to the affected service. A confirmed compromise requires incident response, not merely a package update. Rotate secrets according to the application’s exposure and document the timeline for containment, eradication, and recovery.

Teams with several applications should assign ownership for the runtime, operating-system package, deployment pipeline, and post-patch verification. A concise upgrade record can prevent a web-facing service from being overlooked during the next emergency. For broader dependency mapping and rollout planning, project consultation support can help teams define responsibilities and validation checkpoints.

PHP2Shell CVE-2026-109618 patch verification checklist

Once the fixed runtime is deployed, verify the complete request path rather than relying on a package manager’s status message. PHP may be installed in several places on the same host, and the command-line binary can differ from the SAPI serving web traffic. Confirm the active version through the relevant PHP-FPM pool, Apache configuration, LiteSpeed service, container image, or hosting platform. Keep diagnostic output restricted so version details are not disclosed publicly.

Validate every execution environment

• Check public sites, administration panels, staging environments, and internal tools that accept external or employee-submitted files.
• Inspect separate PHP-FPM pools, virtual hosts, queue workers, scheduled jobs, and containerized services.
• Confirm that autoscaling templates, blue-green deployments, and rollback images use a fixed build.
• Record the exact package version, repository, image digest, or managed-platform release.

For supported upstream branches, the relevant fixed versions are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP 8.1 and older branches require additional verification because upstream support has ended. A distribution may provide a backported correction, but remediation should be based on that vendor’s advisory or package metadata rather than on the visible version number alone.

Investigate indicators after the PHP2Shell update

Review web-server, PHP, process-manager, firewall, and application logs around the update window. Pay particular attention to unusual multipart requests, repeated HTTP 500 responses, memory-limit failures, malformed PHPSESSID cookies, unexpected worker churn, newly modified PHP files, unexplained child processes, and outbound connections from the web service. None of these signals proves exploitation independently, but a related cluster warrants preserving logs and escalating for incident response.

If compromise is suspected, rotate exposed credentials according to the application’s access scope and document containment, eradication, and recovery actions. Teams managing multiple applications can use project consultation support to map runtime ownership, deployment dependencies, and post-patch validation checkpoints.

Complete the PHP2Shell rollout safely

A successful PHP2Shell update should be treated as a controlled deployment, not a single command executed on one server. First, identify the runtime that handles public requests, then stage the corrected package or image in a representative environment. Exercise login flows, uploads, payments, background jobs, and administrative tools before moving the change to production. This helps reveal configuration differences between the command-line PHP binary and the SAPI used by the web server.

Restart and verify the serving workers

After updating the package, restart the relevant PHP-FPM pools, Apache processes, LiteSpeed service, or application containers. A patched file on disk does not protect requests still handled by an older worker. Verify the active process version through a restricted administrative check, service inspection, or deployment output, and confirm that the expected number of healthy workers returns after the restart.

• Record the update time, fixed package or image identifier, and affected hosts.
• Confirm that load balancers are sending traffic only to patched backends.
• Check health probes, error rates, latency, memory use, and worker restarts.
• Keep a rollback path available, while ensuring rollback artifacts are not vulnerable.

Temporary settings such as memory_limit=-1, conservative frontend request limits, and avoiding address-space resource limits may reduce specific risk, but they are not a complete fix. Remove them only after the corrected runtime is active and the configuration has been reviewed for normal security and capacity requirements.

Where several teams share ownership, document who approves the package, restarts services, checks the live SAPI, and reviews post-update telemetry. Project consultation support can help coordinate those checkpoints across applications, infrastructure, and deployment pipelines.

Monitor for delayed signs of exploitation

Continue reviewing logs after the update for recurring multipart anomalies, malformed session cookies, unexplained worker churn, new files, unexpected processes, or outbound traffic. Correlate these events with deployment records and preserve evidence before routine log rotation removes useful context.

Close the incident-response loop

Patch verification is only one part of the response. Compare application, web-server, and operating-system logs with deployment timelines to determine whether suspicious activity began before the update. Preserve relevant request samples, process information, file timestamps, and authentication records according to your incident-response policy. Avoid deleting evidence during cleanup, and restrict access to copied logs because they may contain sensitive identifiers.

If the review finds evidence of unauthorized code execution, treat the affected host and connected services as potentially exposed. Rebuild from a trusted image when appropriate, remove persistence, rotate credentials and signing keys within the affected trust boundary, and check for lateral movement. Notify customers, regulators, or business partners only through the procedures that apply to your organization and jurisdiction.

What the PHP2Shell CVE-2026-109618 patch guide means for teams

The central lesson from this PHP2Shell CVE-2026-109618 patch guide is straightforward: configuration changes can reduce immediate exposure, but only a corrected PHP runtime provides complete remediation. The PHP security advisory identifies fixed upstream releases as 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Administrators using older branches should verify whether their operating-system vendor has backported the fixes and follow that vendor’s documented package guidance.

For developers and site owners, the safest workflow is to inventory every serving SAPI, update through a trusted channel, restart all relevant workers, verify the live version, and monitor for delayed indicators. Do not assume that a patched command-line binary means PHP-FPM, Apache, LiteSpeed, FrankenPHP, or a containerized deployment is also protected.