PHP2Shell: The 5-Minute Runbook to Check and Patch Your PHP Server
If you run PHP on a public website, this one is for you. On October 21, 2026, the PHP project shipped fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619. The FBI, the NSA, the UK's NCSC and Japan's prime minister all told organizations to check their PHP that same day. This is the short version, written as a runbook you can follow in one sitting.
The situation in four lines
- Both flaws are in PHP core and score 9.2 on CVSS 4.0.
- PHP's advisory describes remote code execution without logging in.
- Attacks were seen before the patch was public.
- Updating a CMS or plugins doesn't fix it. The PHP runtime has to be updated.
Watch the walkthrough
Step 1: find where PHP runs
Start with anything facing the internet, then add control panels and appliances that bundle PHP. Write down each host, its PHP version and whether it uses mod_php, PHP-FPM or something else. mod_php is the riskiest setup according to PHP's advisory.
php -v
php-fpm -v
apachectl -M | grep -i php
ps -eo pid,ppid,user,cmd | grep -E "php-fpm|apache2|httpd" | grep -v grepStep 2: compare with the fixed versions
| Branch | Patched in |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 (end of life December 31, 2026) |
| 8.1 and older | No official release. Ask your vendor for a backport or upgrade. |
If PHP came from your distribution, the version number can stay the same after a backport. Read the package changelog, for example apt changelog php8.3-fpm | head -n 30 on Debian and Ubuntu.
You can also run this small script on the command line. It can't see distro backports, so treat a failure as a reason to read the changelog.
<?php
$fixed = ['8.5' => '8.5.12', '8.4' => '8.4.27', '8.3' => '8.3.36', '8.2' => '8.2.35'];
$branch = PHP_MAJOR_VERSION . '.' . PHP_MINOR_VERSION;
echo 'Running PHP ' . PHP_VERSION . ' via ' . PHP_SAPI . PHP_EOL;
if (version_compare($branch, '8.2', '<')) { echo "No official fix for $branch." . PHP_EOL; exit(2); }
if (!isset($fixed[$branch])) { echo "Unknown branch. Check php.net." . PHP_EOL; exit(3); }
echo version_compare(PHP_VERSION, $fixed[$branch], '>=')
? "OK: at or above {$fixed[$branch]}." : "VULNERABLE: update to {$fixed[$branch]} or newer.";
echo PHP_EOL;Step 3: patch, restart, verify
Update the package or build, then restart the processes that serve web requests. A running PHP-FPM keeps the old code until it restarts. Afterward, check the version again from the web side, not only from the command line.
Step 4: look for signs of abuse
Review logs from October 20 onward. The tell-tale sign is the web server user starting shells, curl or wget. If you find signs of compromise, the FBI says to isolate the system, preserve logs and report it to a field office or ic3.gov.
Can't update today?
PHP published interim mitigations on php.net, and they reduce risk without fixing it. Cloudflare released firewall rules for known attack patterns, which its CTO called a stopgap. The FBI and NSA advice is to take the system offline until it's fully mitigated. A written decision about who approves that is worth having before the next incident.
Why this got so much attention
PHP runs roughly 69% of sites whose server language is known, the flaw sits below every CMS and framework, and exploitation began early. Companies are responding with faster patch windows, treating unsupported PHP as an incident, and written plans for taking sites offline. Several Belgian organizations, including a media group, a university and hospitals, took sites offline as a precaution.
Where AI fits in
Reporting credits AI-assisted tools with helping researchers find the flaws, and defenders can use the same idea. Anthropic's Claude Managed Agents, for instance, supports multi-agent orchestration, so a lead agent can hand version inventory, dependency audits and log review to separate read-only agents and give you one report. Keep a human in charge of any change. Product availability changes, so check Anthropic's docs.
FAQ
Does updating WordPress fix this?
No. The flaw is in PHP itself. You need the PHP update.
Is Cloudflare enough?
No. It helps against known patterns but isn't a substitute for patching.
Where do I learn more PHP security?
I keep a reference of PHP concepts, terms and exercises: PHP Master Guide on Notion.