PHP2Shell Vulnerabilities: A 7-Step Response Checklist for SMBs

Two critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, let an attacker run code on a web server without logging in. Researchers call the pair PHP2Shell. PHP runs most of the web, so the flaws reach company websites, client portals, online forms, and vendor tools that never mention PHP in their documentation.

This guide explains what the flaws are in plain terms. It shows where PHP tends to sit inside a business that does not think of itself as running it. It then walks through seven steps to close the exposure, with the questions to send your web host and software vendors. It ends with what to keep on file for your insurer or auditor.

Key Takeaways

• PHP2Shell is a pair of flaws in the PHP engine itself, so a well-built website can still be exposed.
• The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The PHP project says updating is the only complete fix.
• PHP 8.1 and older have no official fixed release. Those systems need an upgrade, a vendor backport, or restricted access until one is in place.
• Many businesses run PHP without knowing it, through a hosted website, a client portal, a hosting control panel, or a vendor appliance.
• After an update, every PHP process must restart. Confirm the version the website actually serves.
• If a server shows signs of probing, capture its PHP worker memory before the restart. A restart erases that evidence.
• PHP 8.4.27 and 8.5.12 have a known bug that can crash some applications that use the SimpleXML extension. Test key pages after the update.
• Amazon reported an exploitation attempt on October 17, four days before the patch. Review logs from that date forward.
• CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26. Trail of Bits has confirmed working exploits against unpatched PHP 8.2 through 8.5.
• The flaws can expose server memory. Rotate passwords, API keys, and certificates stored on any server that ran a vulnerable version while exposed to the internet.

What PHP2Shell Is

PHP is the programming language behind WordPress, Drupal, Joomla, Magento, and a long list of business web applications. According to Tenable, PHP is used by 69.3% of websites whose server-side language is known. That reach is why one flaw in PHP affects so many organizations at once. Security researcher Silas Cutler roughly estimates that more than 1.3 million internet-exposed hosts are potentially vulnerable.

Both flaws come from how PHP cleans up after an error while it handles a web request. The PHP security team rates each one 9.2 out of 10 under CVSS version 4.0. Both can be exploited by an attacker who has no account on the system. The CVE numbers that leaked before the release carried a score of 10.0. The PHP Foundation says that score was incorrect.

The two flaws in plain terms

CVE-2026-109618 is a memory corruption flaw. If PHP runs out of memory while it is still setting up a request, the cleanup that follows can treat half-built data as valid. An attacker can trigger that condition on purpose to run their own code.

CVE-2026-109619 is a use-after-free flaw. Data left over from one request can point to memory that has already been released. A later request handled by the same PHP worker can then use that memory. PHP's advisory lists memory disclosure as a confirmed impact of this flaw.

Why a secure website can still be affected

Most website security work focuses on the application, such as WordPress plugins, login pages, and form handling. PHP2Shell sits one layer below that, in the engine that runs the application. Researchers at Wiz showed that even a basic "Hello World" page on an affected PHP version can be vulnerable.

The research firm Calif confirmed pre-authentication code execution against specific versions of WordPress, Drupal, Joomla, and Magento. On October 26, Trail of Bits showed a working shell on MediaWiki, Symfony, Laravel, and phpBB running unpatched PHP. The PHP project considers Apache servers that run PHP as a module (mod_php) the highest risk. A demonstrated exploit on that setup runs before any application code loads.

Which PHP versions are affected

Every PHP installation that serves web requests is in scope. That includes PHP-FPM, Apache with mod_php, php-cgi, LiteSpeed, and FrankenPHP. The affected code dates back to PHP 5.4, released in 2012.

What Is Known About Attacks So Far

Reports on active exploitation differ by source. Here is what each one has said as of October 27, 2026:

• Amazon Threat Intelligence saw an exploitation attempt against its honeypot network on October 17, four days before the patch. More attempts followed on October 21. Amazon says the payloads and infrastructure suggest multiple actors. Amazon now says PHP2Shell is being broadly exploited.
• watchTowr reported exploitation attempts through its own honeypots starting October 21. It has also reproduced both flaws.
• Cloudflare reported early attacks and deployed temporary firewall rules for traffic that passes through its network.
• On October 24, researcher Adel Karimi reported successful attacks on three honeypot servers running PHP 8.4.26. The activity matched CVE-2026-109618. The test setup was built to favor the exploit, so it does not show how reliably the attack works on other servers.
• On October 26, Trail of Bits confirmed that PHP2Shell exploits work against unpatched releases of PHP 8.2 through 8.5.
• On October 26, CISA added both flaws to its Known Exploited Vulnerabilities catalog. Federal civilian agencies must fix them by October 29.
• Palo Alto Networks Unit 42 retracted an earlier report that linked a compromise at a European government agency to these flaws.
• Public exploit code is circulating online. Tenable warns that unverified exploit code is sometimes laced with malware.

Several governments took public websites offline while they patched. These included the Dutch government portal Overheid.nl, public-facing Finnish government services, and French Interior Ministry websites. The Wikimedia Foundation and the Internet Archive also shut down services for a period as a precaution.

The disclosure timeline was also short. Details leaked on October 20, and patches went out on October 21. PHP had planned the release for October 22 and moved it up a day after the leak. Security firm Sansec expected mass attacks to begin within 15 minutes of the release. For a flaw like this, critical updates need to go out within days, outside the normal monthly patch cycle.

Where PHP Runs in a Typical Business

Most businesses KairosIT works with do not write PHP. The exposure usually comes through systems that a vendor built or a host runs. Check each of the places below.

Your public website

If your site runs on WordPress, Drupal, or Joomla, it runs on PHP. On managed hosting, the host controls the PHP version on the server. Your web designer or marketing agency may manage the site without managing the server under it, so ask both parties who owns the update.

Client portals, intake forms, and booking tools

Patient intake forms, document upload portals, payment pages, and scheduling tools are often PHP applications. Healthcare practices, law firms, and CPA firms rely on these to collect sensitive client data. A flaw that exposes server memory matters most on systems that handle that kind of information.

Hosting control panels

Control panels such as cPanel and Plesk bundle their own copy of PHP. That copy may be separate from the PHP version your website uses. cPanel and CloudLinux released backported fixes, so confirm with your host that those updates are installed.

Vendor appliances and internal web tools

PHP runs inside many vendor products that do not advertise it. Examples include network appliances with a web login page, help desk systems, intranets, wikis, and monitoring dashboards. Ask each vendor directly, since the product documentation may not say.

Old sites nobody remembers

Campaign landing pages, staging copies of the main website, and microsites from past events often stay online for years. These sites often go without updates. A Shodan-based analysis published by CybelAngel found that 59% of internet-facing PHP hosts that report a version were on a branch with no official fix. Our post on cybersecurity problems hidden in plain sight covers how these forgotten systems build up.

A Seven-Step PHP2Shell Response Plan

These steps follow the guidance published by the PHP project, CISA, and the security firms tracking the flaws. Work through them in order.

List every PHP system you depend on

Start with anything reachable from the internet. Record the system name, the owner, the host or vendor, the PHP version, and how PHP runs on it (PHP-FPM, mod_php, or php-cgi). Include systems a vendor runs for you, since you still carry the risk if your client data lives there.

If you use a vulnerability scanner, run credentialed or agent-based scans for this step. An unauthenticated scan can only spot a vulnerable version when the server reveals its PHP version over the network.

Send your web host and vendors direct questions

Put the request in writing so the answers are on record. Ask each host and vendor the following:

• Do any systems that store or process our data run PHP?
• Which PHP version is running now, and on what date was it updated?
• If any system runs PHP 8.1 or older, what is the plan to fix it?
• Have you reviewed logs from October 17 onward for signs of exploitation?
• Can you send written confirmation for our records?

A vendor's exposure becomes your exposure when that vendor holds your data. Our guide to third-party cyber risk in 2026 explains how to make these requests part of your normal vendor review.

Patch, restart, and confirm the served version

Update each system to the fixed release for its branch. Then restart every PHP process, including PHP-FPM and the web server. The fix does not take effect until the old processes stop.

Check the logs before you restart. Google Cloud's guidance, written with input from Mandiant, says to capture worker memory from any server that shows signs of probing. A restart erases that evidence.

Confirm the version through a web request to the site. The command-line copy of PHP can differ from the copy the web server loads. Linux distributions such as Debian and Red Hat also backport fixes into older version numbers, so check your distribution's advisory if the number looks out of date.

Windows servers need one more check. On October 26, PHP released updated Windows builds 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1. These fix a separate flaw in the bundled Brotli library, tracked as CVE-2026-111497. The PHP version number stays the same, so confirm the build number on each Windows server.

PHP 8.4.27 and 8.5.12 include a known bug that can crash PHP processes in some applications that use the SimpleXML extension. PHP traced it to a separate fix in the same release. The PHP2Shell patches did not cause it. A correction is in the PHP source but had not shipped in a release as of October 26. Test your key pages and forms after the update. If errors appear, ask your developer or vendor about php-src issue #24488.

Restrict anything you cannot patch

Systems on PHP 8.1 or older need an upgrade or a patched package from a support vendor. Until then, CISA recommends taking PHP-based systems offline if they cannot be patched or if they run PHP 8.1 or earlier. CERT-EU gives similar advice. It recommends isolating internet-facing applications from public networks until the fix is applied and verified. If a system must stay online, limit access to a VPN or a list of approved IP addresses.

The PHP project published interim configuration changes that reduce exposure. These include setting memory_limit to -1 in a way applications cannot override and setting session.upload_progress.enabled to 0. On PHP 8.5, it also advises setting fatal_error_backtraces to 0. Restart every PHP worker after changing these settings. PHP states that these settings do not make a system safe, so treat them as a short bridge to the update.

On October 23, PHP published a separate advisory on a less likely attack path in the session upload feature, tracked as CVE-2026-115560. PHP says it needs an unusual mix of configuration and application code. Until its next regular release, PHP suggests keeping session.upload_progress.enabled set to 0.

Web application firewall rules from providers such as Cloudflare are also a stopgap. They only cover traffic routed through that provider.

Check for signs of compromise

A system that ran a vulnerable version while exposed may have been reached before the patch. Amazon recommends starting investigations from October 17. Wiz lists these warning signs in web server logs:

• Unusual multipart requests followed by memory limit errors
• Repeated HTTP 500 error responses
• Unusually large or malformed PHPSESSID cookies
• PHP worker processes restarting with no clear cause

On the server itself, look for web shells, changed PHP files, new administrator accounts, unexpected outbound connections, and unexpected processes started by the web server. Continuous monitoring shortens this review. Our post on what MDR covers for SMBs explains how that monitoring works.

Rotate credentials stored on exposed servers

Wiz notes that leaked memory may include passwords, authentication tokens, API keys, and certificates. If a server ran a vulnerable version while exposed, plan to replace the secrets it held. Start with database passwords, payment API keys, single sign-on secrets, and website administrator passwords.

Document what you did

Record the date each system was patched, the version it now runs, the vendor confirmations you received, and the results of the log review. This record is what you will need if an insurer, auditor, or client asks how you responded. Healthcare practices covered by HIPAA should also add the event to their security risk analysis and incident records. Our compliance IT services team can help structure that documentation.

What PHP2Shell Shows About Patch Management

The researchers who found these flaws used AI models in their work, including tools from OpenAI and Google. One of the underlying memory errors was first flagged in a 2024 audit and stayed unfixed because no working exploit had been shown. Three habits make the next event easier to handle.

Keep a current list of internet-facing systems

The first question in any vulnerability response is "where do we run this?" A maintained inventory answers it in minutes. Without one, the first days of a response go to finding systems before any patching starts. The NIST Cybersecurity Framework 2.0 guide for SMBs treats asset inventory as a starting control for this reason.

Put patch timelines into vendor agreements

Ask vendors and hosts how fast they apply critical security updates. Write that timeline into the contract. Ask them to notify you when they finish. A clear agreement also cuts down on follow-up during the next event.

Monitor the systems you cannot patch yourself

Some systems will always sit with a vendor, on an appliance, or on a legacy application that cannot move quickly. Network restrictions and monitoring on those systems limit what an attacker can do while you wait for the vendor.

How KairosIT Helps With PHP2Shell

KairosIT provides managed IT, cybersecurity, and compliance services. Its clients are growing businesses in South Florida and Northern California. For a vulnerability like PHP2Shell, the KairosIT cybersecurity team can help with the following:

• Finding the PHP systems your business depends on, including vendor-hosted ones
• Sending the vendor and host questions above, then tracking each answer
• Patching and restarting systems KairosIT manages, then confirming the served version
• Restricting access to systems that cannot be patched yet
• Reviewing logs and monitoring for signs of compromise
• Rotating credentials that may have been exposed
• Documenting the response for insurers or auditors

Businesses with their own IT staff can bring KairosIT in alongside that team. Our co-managed IT services are built for that arrangement.

Get a Written PHP2Shell Exposure Check From KairosIT

If you are not sure which of your systems run PHP, or whether your vendors have patched, KairosIT can find out and give you a written summary of the results. That record also supports your next insurance renewal or compliance review.

Learn more about KairosIT's managed IT and cybersecurity services, or schedule an IT strategy call to start your PHP2Shell review.