PHP powers millions of websites worldwide, including WordPress, Laravel, Drupal, Joomla, and custom PHP applications. However, a newly disclosed critical security issue known as PHP2Shell has raised serious concerns for website owners and server administrators.
The vulnerability could allow attackers to execute malicious commands remotely on affected servers without requiring authentication. If exploited, it may lead to server compromise, data theft, website defacement, or unauthorized access.
Let's understand what PHP2Shell is, which PHP versions are affected, and how to protect your website.
What Is the PHP2Shell Vulnerability?
PHP2Shell refers to two critical vulnerabilities in the PHP core runtime, identified as:
CVE-2026-109618
CVE-2026-109619
Both vulnerabilities are related to memory management issues during PHP request processing, including out-of-memory handling and the use of previously freed memory.
Attackers may exploit these weaknesses through specially crafted HTTP requests to execute arbitrary code on vulnerable servers.
Both vulnerabilities have a CVSS 4.0 severity score of 9.2 (Critical), making them a serious security concern.
Importantly, this is a vulnerability in PHP itself, not a specific WordPress plugin, theme, or website application. Therefore, websites using affected PHP versions may be at risk even if their application code is properly secured.
Which PHP Versions Are Affected?
PHP2Shell affects a wide range of PHP releases, including older unsupported versions.
The following patched versions are available for supported PHP branches:
| PHP Version | Affected Versions | Fixed Version |
|---|---|---|
| PHP 8.5 | Below 8.5.12 | 8.5.12 |
| PHP 8.4 | Below 8.4.27 | 8.4.27 |
| PHP 8.3 | Below 8.3.36 | 8.3.36 |
| PHP 8.2 | Below 8.2.35 | 8.2.35 |
What about PHP 8.1 and older?
PHP 8.1, 8.0, 7.x, and 5.x are also affected. Some older branches have source-code backports or vendor-provided security patches, but not all receive official binary updates.
If your website uses an unsupported PHP version, upgrading to a currently supported PHP release is strongly recommended.
What Are the Risks of PHP2Shell?
If attackers successfully exploit this vulnerability, they may be able to:
Execute unauthorized commands on the server.
Upload malicious scripts or web shells.
Access sensitive website files and database credentials.
Steal confidential information.
Modify website content or inject malicious code.
Compromise hosting accounts and other applications on the server.
Disrupt website availability and server operations.
Websites running PHP through Apache mod_php, PHP-FPM, PHP-CGI, or LiteSpeed may also be affected.
How to Protect Your Website from PHP2Shell
Website owners and server administrators should take the following security measures immediately.
1. Update PHP to a Patched Version
The most important step is upgrading PHP to the latest patched release:
PHP 8.2.35 or later
PHP 8.3.36 or later
PHP 8.4.27 or later
PHP 8.5.12 or later
Choose a supported version compatible with your website, CMS, themes, and plugins.
2. Check Your Current PHP Version
You can check your PHP version using your hosting control panel, cPanel, WHM, or SSH.
For SSH, run:
php -vFor PHP-FPM installations, also check the version used by the actual PHP-FPM service. The command-line PHP version may differ from the version serving your website.
3. Restart PHP Services After Updating
After installing security updates, restart the relevant PHP-FPM pools or Apache services to ensure that old PHP worker processes are no longer running.
4. Use a Web Application Firewall (WAF)
A properly configured WAF can help detect and block suspicious requests associated with known PHP2Shell exploitation attempts. However, it should be considered an additional security layer, not a replacement for PHP updates.
5. Review Server Logs and Website Files
Check server access logs, error logs, and recently modified website files for suspicious activity. Look for unexpected PHP scripts, unknown administrative accounts, unusual processes, and unauthorized changes.
6. Keep Your Website and Server Updated
Regularly update your CMS, plugins, themes, PHP runtime, operating system, and server software. Use strong passwords, restrict unnecessary access, and maintain regular backups.
Is Your WordPress or Custom PHP Website at Risk?
Yes. PHP2Shell is a PHP runtime vulnerability, so it is not limited to WordPress.
The following platforms and applications may also be affected when running vulnerable PHP versions:
WordPress websites
Laravel applications
Drupal and Joomla websites
Magento-based stores
Custom PHP websites
PHP-based CRM and ERP applications
Updating plugins or changing website passwords alone will not fix this vulnerability. The underlying PHP runtime must be patched.
Final Thoughts
PHP2Shell is a critical reminder that website security depends not only on application-level protection but also on keeping the underlying server environment updated.
If your website or hosting server uses an affected PHP version, prioritize the security update as soon as possible. Regular server monitoring, secure configurations, updated software, and reliable backups can help reduce the risk of future security incidents.
Don't wait for an attack to discover that your website is vulnerable. Check your PHP version and secure your server today.
