PHP2Shell and This Week's Critical Vulnerabilities: How to Patch Your Servers (October 2026)

This week brought one of the most serious PHP security events in years. On 21 October 2026 the PHP project shipped emergency releases for two critical remote code execution flaws, nicknamed PHP2Shell, after details leaked a day early and attackers started probing servers within hours. At the same time, Microsoft's record October Patch Tuesday and a wave of new CISA KEV entries added more urgent work for IT teams.

This guide summarises what happened, which systems are affected and exactly how to patch or mitigate, so you can prioritise your next 24 to 72 hours.

Key Takeaways

• Update PHP now: fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP says updating is the only complete fix.
• Highest risk: Apache mod_php, where an exploit can trigger before your application code runs. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are also exposed under suitable conditions.
• Exploit attempts are live: Cloudflare and watchTowr reported active exploitation attempts on 21 October.
• Old PHP (8.1, 8.0, 7.4) gets no regular fix: use a vendor or distro build, apply the source backport, or upgrade.
• Also patch this week: Windows Shell zero-day CVE-2026-96951 and KEV-listed flaws in Ivanti, Palo Alto PAN-OS, Fortinet, Cisco, BeyondTrust and Atlassian.

What Is PHP2Shell?

PHP2Shell is the name given to two vulnerabilities in the PHP runtime itself, not in a specific framework or CMS. That means WordPress, WooCommerce, Magento, Laravel and custom PHP sites can all be affected if the server runs a vulnerable PHP build. Both are rated 9.2 on CVSS v4.0 by PHP and were reported by researchers from Wiz, Calif and OpenAI.

• CVE-2026-109618 (out-of-memory corruption): an out-of-memory error interrupts a request and leaves data partially initialised. Cleanup code then processes that invalid state, which opens a path to remote code execution.
• CVE-2026-109619 (stale global state / use-after-free): PHP keeps references to request data after the memory is freed, and a later request on the same worker can reuse them. Researchers demonstrated code execution through the session upload progress feature.
• Memory disclosure: researchers also showed unauthenticated leaks of PHP worker memory, which can expose passwords, session tokens and API keys.

Affected and Fixed PHP Versions

Linux distributions often backport fixes without changing the version number. On Ubuntu, Debian, Red Hat, Alpine and others, check the package changelog or vendor advisory for the two CVE IDs instead of relying on the version string.

How to Patch PHP2Shell: Step by Step

1. Inventory every PHP runtime. Include web servers, containers, CI images and secondary installs. Remember that php -v on the command line may not be the binary serving web requests; check phpinfo() or your FPM pool too.
2. Update to the fixed release. Example on Ubuntu or Debian: sudo apt update && sudo apt install --only-upgrade php8.3 php8.3-fpm. On RHEL-based systems use dnf update php*. For Docker, rebuild from the latest official php image tag and redeploy.
3. Restart every PHP process. Restart PHP-FPM, Apache (for mod_php), LiteSpeed or FrankenPHP so no old worker keeps running vulnerable code.
4. Verify. Confirm that both the installed package and the running workers report the fixed build.
5. Review memory settings after patching. The fix introduces a stricter memory limit that can stop long scripts and shutdown handlers, so test heavy jobs such as imports and reports.
6. Rotate secrets if you were exposed. If a server ran a vulnerable build on the public internet, consider rotating database passwords, API keys and session secrets because of the memory disclosure risk.

Temporary Workarounds If You Cannot Patch Today

These measures reduce risk but do not fully fix the flaws. Use them only as a bridge to a proper update.

• For CVE-2026-109619: set session.upload_progress.enabled=0 in php.ini or the FPM pool config and restart workers. Do not rely on ini_set() or .user.ini. On PHP 8.5, also set fatal_error_backtraces=0.
• For CVE-2026-109618: set post_max_size=8M (or 32M if uploads are needed), keep upload_max_filesize below it, enforce request size limits at Nginx, Apache or your WAF, and block multipart requests your app does not use.
• Memory limits: use container or cgroup memory limits rather than RLIMIT_AS or RLIMIT_DATA.
• For PHP-FPM: consider pm.max_requests=1 if performance allows, so each worker handles only one request.
• Restrict exposure: put admin panels and staging sites behind a VPN or IP allow list, and enable your WAF or CDN rules for PHP2Shell.

Signs Your Server May Have Been Targeted

• Unusual multipart POST requests followed by memory limit errors in logs
• Spikes of HTTP 500 responses
• Oversized PHPSESSID cookies
• Unexplained PHP worker crashes or restarts
• New or modified PHP files in upload or cache folders

Other Critical Vulnerabilities This Week

PHP was not the only urgent item. Microsoft's October 2026 Patch Tuesday (13 October) fixed about 1,411 flaws, including 70 rated Critical and three zero-days. CISA also added several actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog between 13 and 16 October.

For all of these, prioritise internet-facing systems such as VPN gateways, firewalls, remote support tools and mail gateways. Apply the vendor patch, confirm the installed version, and if you cannot patch immediately, restrict management interfaces to trusted networks or disable the affected feature.

Note for Windows 10 and 11 Users

October 2026 is the final security update for Windows 11 24H2 Home and Pro and Windows 10 Enterprise LTSB 2016. Plan upgrades for any machines still on these versions.

How OneXT Digital Can Help

Many businesses run dozens of PHP sites across different hosts, versions and plugins, which makes emergency patching slow and risky. OneXT Digital's team can audit your PHP, WordPress, WooCommerce and Magento stack, apply PHP2Shell patches or interim hardening, test your site after the update and set up ongoing maintenance so the next critical CVE is handled within hours, not weeks. Contact us for a free security check of your website.

Sources

• Qualys: PHP2Shell security release analysis
• The Hacker News: PHP issues emergency patches for PHP2Shell
• CISA: Critical vulnerabilities in PHP require immediate patching
• BleepingComputer: Microsoft October 2026 Patch Tuesday