Skip to main content
Entidex

PHP2Shell · CVE-2026-109618 · CVE-2026-109619

CVE-2026-109618 and CVE-2026-109619: which PHP versions are safe?

Updated 23 October 2026 · By Dean, founder of Entidex Ltd

Not sure if your site is exposed? Three questions, two minutes.

Run the free check

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and later are safe from PHP2Shell (CVE-2026-109618 and CVE-2026-109619), released by the PHP project on 21 October 2026. PHP 8.1, 8.0 and 7.4 get no new release, and an older-looking version number can still be patched through a distro backport, so check the package changelog and the PHP-FPM version actually serving your site.

Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619, together known as PHP2Shell (PHP project, 21 October 2026). Both PHP2Shell flaws are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution.

Branch Safe from Support status
PHP 8.5 8.5.12 Supported
PHP 8.4 8.4.27 Supported
PHP 8.3 8.3.36 Security fixes only
PHP 8.2 8.2.35 Security fixes only, ends 31 December 2026
PHP 8.1 No release End of life. Source patch published.
PHP 8.0 No release End of life. Source patch published.
PHP 7.4 No release End of life. Source patch published.

Any PHP version below these in the same branch is vulnerable to PHP2Shell unless a fix has been backported. The PHP2Shell flaws go back to PHP 5.4.

Does an old PHP version number mean my server is vulnerable to PHP2Shell?

An old PHP version number does not prove a server is vulnerable to PHP2Shell, because Linux distributions such as Ubuntu, Debian and Red Hat often keep the same headline PHP version for the life of a release and copy security fixes into it. Copying security fixes into an older version is called backporting.

A server can report PHP 8.1.2 or 8.3.6 and still be patched, while another server with the same number might not be. The PHP version string alone can mislead you in both directions.

The package changelog is the reliable PHP2Shell test. Look for the CVE numbers:

# Debian / Ubuntu (package name varies, e.g. php8.3-fpm)
apt changelog php8.3-fpm | grep -E 'CVE-2026-10961[89]'

# Red Hat / AlmaLinux / Rocky
rpm -q --changelog php-fpm | grep -E 'CVE-2026-10961[89]'

If both CVE numbers appear in the changelog of the installed package, the PHP2Shell fix is in. If neither CVE number appears, assume the server is exposed and update.

How do I check which PHP version is serving my site?

The PHP version serving a website can differ from the PHP version on the command line, because many servers have more than one PHP installed. Checking the PHP that actually serves your site for PHP2Shell takes five steps:

  1. Read the PHP version in WordPress Site Health. In WordPress, go to Tools > Site Health > Info > Server and read PHP version. Site Health shows the PHP that actually runs your site, and is the quickest check for non-technical owners.
  2. Run php -v on the command line. The php -v command shows the command-line (CLI) PHP. The CLI version is useful, but may not be the version serving your website: a server can have PHP 8.3 on the command line and PHP 7.4 running the site through PHP-FPM. 
    php -v
  3. Check PHP-FPM, not just the CLI. List the PHP-FPM services and binaries. On cPanel, Plesk and CloudLinux servers, each PHP build lives in its own folder and each site can use a different build, so check every build that a site uses. 
    systemctl list-units --type=service | grep -i fpm
ls /usr/sbin/php-fpm* /opt/cpanel/ea-php*/root/usr/sbin/php-fpm /opt/plesk/php/*/sbin/php-fpm 2>/dev/null
php-fpm8.3 -v
  4. Check the package changelog for both CVE numbers. Run the apt changelog or rpm -q --changelog command from the backports section against each PHP package in use. A package whose changelog lists both CVE-2026-109618 and CVE-2026-109619 has the PHP2Shell fix.
  5. Update, then restart PHP. Installing new packages does not replace code already running. PHP-FPM pools, Apache with mod_php and LiteSpeed keep the old code in memory until restarted. After updating, restart the relevant services: 
    sudo systemctl restart php8.3-fpm
sudo systemctl restart apache2   # or httpd, or lsws
    Still showing as vulnerable after an update? Work through why a PHP2Shell patch looks like it is not working.

Are there settings that help if I cannot update PHP yet?

PHP says updating is the only complete fix for PHP2Shell. Reporting from The Hacker News describes settings that block some confirmed PHP2Shell attack paths, such as disabling session upload progress. These settings reduce risk on specific paths and leave others open. Use the settings only as a short stopgap while you update. The NCSC advises taking unpatched internet-facing systems offline.

Cloudflare has deployed firewall rules for known PHP2Shell exploit patterns, including on free plans. Reports say attackers changed their payloads to get around early Cloudflare rules. Treat a firewall as extra protection, never as the fix.

Can I check for PHP2Shell automatically?

The free PHP2Shell Check script from Entidex Ltd does all of the above in one read-only run on Linux. The PHP2Shell Check script:

  • finds every PHP runtime: CLI, PHP-FPM, mod_php, LiteSpeed, and cPanel, Plesk and CloudLinux builds
  • decides patched or vulnerable using the version and the distro package changelog, so backports are caught
  • flags processes still running old code that need a restart
  • looks for signs of compromise, such as web-shell patterns and PHP files in upload or temp folders

The PHP2Shell Check script never changes anything. Use the script only on servers you own or are authorised to manage. Get the script and take the self-check.

Need proof for an insurer or client? A Patch Check costs £49 per server: run one command, get the verdict within a minute and a signed, dated result once payment has cleared. See prices.

What else do people ask about PHP versions and PHP2Shell?

Is PHP 8.2 safe?

PHP 8.2.35 and later are fixed for PHP2Shell. PHP 8.2 reaches end of life on 31 December 2026, so plan your next upgrade.

My server says PHP 8.1. Is it vulnerable?

A server on PHP 8.1 is protected only if your distribution or host applied the PHP2Shell backport. Check the package changelog for both CVE numbers, CVE-2026-109618 and CVE-2026-109619.

Does php -v prove my site is safe?

No. The php -v command shows the command-line PHP. Check the PHP-FPM or web server version too.

Take the 3-question self-check: entidex.com/php2shell#check

Where does this PHP2Shell information come from?