What is PHP2Shell?
PHP2Shell groups two related memory-safety vulnerability classes in core PHP: CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS v4.0 9.2. Researchers demonstrated unauthenticated remote code execution and process-memory disclosure. PHP released fixes on 21 October 2026. The vulnerable component is the interpreter, rather than a particular plugin or CMS.
Which installations need attention?
PHP advises updating all installations serving Web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. WordPress, Drupal, Joomla, MediaWiki, Laravel and custom applications inherit the runtime risk. An application update alone does not replace PHP. Inventory embedded appliances, administrative interfaces, staging sites and containers as well as public production websites.
Is PHP-FPM exempt?
No. Exploitability differs by SAPI and by vulnerability. FPM terminates a child when request startup fails, preventing some demonstrated startup-only sequences. It does not eliminate application-level or cross-request state paths. Do not generalize the mod_php demonstration into identical exploitability everywhere, or use FPM as evidence that patching is unnecessary.
PHP 8.1 and older
These branches receive no normal PHP project release. Minimal source backports were published for 7.4, 8.0 and 8.1 as an exceptional response; building and validating them is the operator’s responsibility. A distribution or LTS vendor may provide maintained packages. Research reports affected releases back to PHP 5.4, with different conditions per path. Migrate legacy runtimes to a supported branch and verify any interim vendor patch.
PHP2Shell in plain language
PHP is the engine running your website; WordPress, Laravel and plugins sit above it. Updating a plugin does not update PHP. Two runtime memory-safety flaws can turn abnormal request cleanup into disclosure or code execution. A public website check can find clues, but only the host or server administrator can verify the actual Web runtime and its patch.
PHP2Shell tools →Evidence by PHP runtime
| Runtime | CVE-2026-109618 ↗ | CVE-2026-109619 ↗ |
|---|---|---|
| Apache mod_php | RCE demonstrated | RCE demonstrated |
| PHP-FPM | Application-dependent susceptibility; no complete FPM exploit demonstrated for this CVE | RCE demonstrated through a suitable application path |
Also update php-cgi, FrankenPHP and LiteSpeed. PHP recommends updating every Web-serving installation. This table distinguishes demonstrated paths from general exposure.