PHP2Shell · CVE-2026-109618 · CVE-2026-109619
Still on PHP 7.4, 8.0 or 8.1? Your PHP2Shell options
Updated 23 October 2026 · By Dean, founder of Entidex Ltd
Not sure if your site is exposed? Three questions, two minutes.
Run the free checkPHP 7.4, 8.0 and 8.1 are end of life and received no new PHP release for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on 21 October 2026, only source patches. The four realistic options are a backported patch from your host or distribution, an upgrade to a supported PHP version, applying the source patch yourself, or taking the site offline temporarily.
Why are PHP 7.4, 8.0 and 8.1 a special case for PHP2Shell?
PHP 7.4, 8.0 and 8.1 are end of life, and the PHP project no longer releases new versions for them. When PHP fixed the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) on 21 October 2026, the PHP project released new versions only for 8.2, 8.3, 8.4 and 8.5 (PHP project, 21 October 2026).
For PHP 7.4, 8.0 and 8.1, the PHP security team published source patches instead. Someone still has to apply the source patches and rebuild PHP, because the patches do not apply themselves.
Both PHP2Shell flaws allow an attacker to run code on the server without logging in. Public exploit code exists, and sites on old PHP are among the most exposed.
When did PHP 8.1, 8.0 and 7.4 reach end of life?
PHP 8.1 reached end of life on 31 December 2025, PHP 8.0 on 26 November 2023 and PHP 7.4 on 28 November 2022 (PHP project, supported versions). After those dates the PHP project publishes no new releases for the branch, which is why PHP2Shell has no 8.1, 8.0 or 7.4 release.
| PHP branch | End of life | Official PHP2Shell release |
|---|---|---|
| 8.2 | 31 December 2026 | 8.2.35 |
| 8.1 | 31 December 2025 | None. Source patch only. |
| 8.0 | 26 November 2023 | None. Source patch only. |
| 7.4 | 28 November 2022 | None. Source patch only. |
Does PHP 8.1 still get security updates?
PHP 8.1 gets no security updates from the PHP project, but PHP 8.1 can still get security updates from your Linux distribution or host. Long-term-support Linux releases, such as Ubuntu LTS, Debian and Red Hat Enterprise Linux and its rebuilds, keep patching the PHP they ship for the life of the release, and paid extended-support services and some hosts do the same. Whether your PHP 8.1 has the PHP2Shell fix depends on who supplies it, so check the package changelog for both CVE numbers or ask your host. The same applies to PHP 7.4 and 8.0.
When does PHP 8.2 reach end of life?
PHP 8.2 reaches end of life on 31 December 2026, so PHP 8.2 is fixed for PHP2Shell in 8.2.35 but has about two months of official security support left. A site that moves from PHP 7.4 or 8.1 to PHP 8.2 now will need to move again in early 2027. Upgrading to PHP 8.3 or later avoids a second move.
Can my host or Linux distribution backport the PHP2Shell fix?
A backported PHP2Shell patch from your host or Linux distribution is option 1 for sites on PHP 7.4, 8.0 or 8.1. On a supported Linux release, the distribution may ship a patched package that keeps the old version number, and Ubuntu, Debian and Red Hat commonly do this. Some hosts and long-term support vendors do the same for their own PHP builds.
What to do: ask your host to confirm in writing that the PHP serving your site includes the PHP2Shell fixes. If you manage the server, check the package changelog for both CVE numbers. See which PHP versions are safe.
Good for: sites that cannot move to newer PHP this week.
Should I upgrade from PHP 7.4 or 8.1 to fix PHP2Shell?
Upgrading to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later is option 2, and the long-term answer to PHP2Shell. PHP 8.2 itself reaches end of life on 31 December 2026, so PHP 8.3 or later buys more time.
What to do:
- Take a full backup.
- Test the site on the new PHP version, ideally on a staging copy, because older themes and plugins sometimes break on newer PHP.
- Switch the site to the new PHP version. Many cPanel and managed hosts let you switch PHP versions per site.
Good for: most WordPress sites that are reasonably up to date.
Can I apply the PHP2Shell source patch myself?
Applying the PHP security team's source patch yourself and rebuilding PHP is option 3, for anyone who builds PHP from source and has no vendor. Patching PHP from source needs real server experience, and a mistake can take the site down.
What to do:
- Only attempt a source patch if you are comfortable compiling PHP.
- Apply the PHP security team's source patch and rebuild PHP.
- Restart all PHP processes afterwards.
- Confirm the running PHP version.
Good for: in-house apps tied to old PHP that cannot be upgraded quickly.
Should I take my PHP site offline until PHP2Shell is fixed?
Taking the site offline temporarily is option 4, and matches NCSC advice: the NCSC has advised organisations to take internet-facing PHP systems offline if they cannot update straight away (NCSC). For a brochure site or an old system that few people use, a short outage may be the safest choice while you sort a PHP2Shell fix.
Good for: old systems with no clear owner.
What should I not rely on to fix PHP2Shell on old PHP?
Three common PHP2Shell workarounds are not fixes on PHP 7.4, 8.0 or 8.1:
- Updating WordPress or plugins. PHP2Shell is a flaw in PHP, so a WordPress or plugin update does not fix PHP2Shell.
- Config tweaks alone. PHP says updating is the only complete fix. Some settings block specific attack paths only.
- A firewall alone. Reports say attackers changed payloads to get around early firewall rules.
How can Entidex Ltd help with end-of-life PHP and PHP2Shell?
The Entidex Ltd Emergency Fix covers end-of-life PHP for £299 per server. It checks the server for compromise first, shows you the plan, then applies your vendor's patched PHP packages where they exist (for example Ubuntu Pro, Red Hat Enterprise Linux or CloudLinux), restarts PHP and checks your sites still load. If that does not fix it, we take over. Limited slots each day. See prices.
Not sure what you are running? Start with the free 3-question self-check, or our free read-only PHP2Shell Check script for Linux servers.
We only work on systems you own or are authorised to manage.
What else do people ask about PHP end of life?
When did PHP 8.1 reach end of life?
PHP 8.1 reached end of life on 31 December 2025. The PHP project no longer releases new PHP 8.1 versions, so there is no official PHP 8.1 release for PHP2Shell, only a source patch.
When does PHP 8.2 reach end of life?
PHP 8.2 reaches end of life on 31 December 2026. PHP 8.2.35 is fixed for PHP2Shell, but after 2026 PHP 8.2 gets no new official releases, so plan a move to PHP 8.3 or later.
Does PHP 8.1 still get security updates?
Not from the PHP project. Linux distributions, extended-support services and some hosts still patch the PHP 8.1 they ship. Check the package changelog for CVE-2026-109618 and CVE-2026-109619, or ask your host in writing.
Which PHP version should I upgrade to from PHP 7.4 or 8.1?
PHP 8.3 or later. PHP 8.2 is fixed for PHP2Shell in 8.2.35 but reaches end of life on 31 December 2026, so PHP 8.3.36, 8.4.27 or 8.5.12 and later buy more time. Test on a staging copy first.