PHP2Shell 2026: Stop PHP Site Hacks, Then Decide to Migrate

Q: What is PHP2Shell?

PHP2Shell is the name used for two remote code execution vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS v4.0. The PHP project published fixes on 21 October 2026. One involves out-of-memory corruption and the other stale global state reused by a later request on the same worker. Because they sit in the engine, they affect PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed setups.

Q: Which PHP versions fix PHP2Shell?

The PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026. For 7.4, 8.0 and 8.1, the project says source-backported patches exist and that Linux distributions and LTS vendors received them in advance, so use your distribution or vendor package. After updating, restart every FPM pool and Apache process, because workers started before the update keep running the old engine.

Q: Was my website hacked by PHP2Shell?

Not necessarily. Sansec reported early attacks on 21 October but later said mass exploitation looked less likely than feared, and public exploits do not work against a default installation; most also need an application bug such as local file inclusion. Treat any server that was unpatched and internet-facing as exposed, then hunt for PHP files in upload directories, new admin users, unfamiliar scheduled tasks and changed payment-page scripts.

Q: Are the PHP2Shell mitigations enough if I cannot update today?

No. The PHP team states that the interim mitigations do not make an installation safe. They include disabling session upload progress in php.ini or the FPM pool, enforcing request-size limits at the proxy and, on 8.5, disabling fatal error backtraces. The memory_limit=-1 mitigation needs a container or cgroup memory cap or a single request can exhaust the host. Use mitigations for days while you schedule the update, not as a long-term fix.

Q: Should we migrate away from PHP after PHP2Shell?

Usually not because of this bug. Every major web runtime has had critical vulnerabilities, and Node.js, Python and Java ecosystems have their own supply-chain incidents. The better question is the operating model: who patches the runtime, who owns plugins, and whether the site needs server code per request. Managed hosting, headless CMS or a route-by-route rewrite can all be right for specific sites, but a panic rewrite rarely is.

Q: How do I prevent WordPress or Magento sites from being hacked?

Most PHP site compromises come through plugins and themes rather than the engine. Keep an inventory of every plugin with its maintainer and last update, replace abandoned ones, never install nulled builds, make the code directory read-only to the web server, block PHP execution in upload folders, deploy from pinned images instead of editing servers, and monitor payment pages for script changes. Those controls also blunt the next engine-level bug.

Q: When does PHP 8.2 reach end of life?

The official PHP supported-versions page lists PHP 8.2 as reaching end of life on 31 December 2026, after which it receives no security fixes from the PHP project. PHP 8.1 and older already receive no updates from the project, though some distributions and LTS vendors provide backports. Teams on 8.2 should plan an upgrade to 8.4 or 8.5 now, so the next emergency release does not depend on a vendor backport.

Q: What should I do if I find a webshell on a PHP server?

Stop cleaning and rebuild. If one webshell is present, assume others exist that you have not found. Take a forensic copy if you need one, rebuild the host from a known-good image with a patched PHP version, restore content from a clean backup, and rotate every secret the server could read: database passwords, payment keys, SMTP and cloud credentials. Check your regulatory reporting obligations, such as CERT-In rules in India, before you finish.

Satyam Kumar

Back to Blog

architecture

PHP2Shell and the PHP Site Hacks of October 2026: Patch the Runtime, Then Fix the Estate, and Only Then Ask Whether to Leave PHP

By Satyam KumarOctober 25, 202614 min read

php2shell cve-2026-109618 cve-2026-109619 php security update php-fpm hardening mod_php wordpress security magento security laravel security webshell detection php incident response php 8.2 end of life migrate from php headless cms migration strangler fig migration website hack prevention

PHP2Shell and the PHP Site Hacks of October 2026: Patch the Runtime, Then Fix the Estate, and Only Then Ask Whether to Leave PHP

Frequently Asked Questions

Share this article

Twitter LinkedIn WhatsApp

Satyam Kumar

Founder & AI Architect, AppScale LLP

AI & Cloud Architect. Helping teams build systems that scale to millions.

LinkedIn GitHub

PHP2Shell and the PHP Site Hacks of October 2026: Patch the Runtime, Then Fix the Estate, and Only Then Ask Whether to Leave PHP

Frequently Asked Questions

Share this article

Comments

Leave a comment