PHP Vulnerability: PHP2Shell Patch and How to Check Your PHP Version (WordPress)

PHP2Shell is the name given to two PHP vulnerabilities (CVE-2026-109618 · CVE-2026-109619) whose patches were released on October 21, 2026. They are remote code execution flaws that let even an unauthenticated request run code on the server, so the first thing to do is check which PHP version your site uses and upgrade it to a patched version. On an Nginx + Apache server running WordPress 7.1.3, I checked the PHP version in Site Health, upgraded only the php packages to the patched version and then checked again.

1️⃣ The PHP2Shell PHP vulnerability: how the flaws work and who is affected

The flaws sit inside the PHP engine, which reads the request before any WordPress code runs, so they remain even if you keep plugins and themes up to date, unless you upgrade PHP. According to the CERT-EU advisory, both score 9.2 on CVSS; the technical details are public and being discussed, and early proof-of-concept code has started to circulate.

CVE-2026-109618 is a flaw where, when a request exceeds the memory limit (memory_limit) and is aborted, the cleanup process treats half-initialized request data as valid data. CVE-2026-109619 is a flaw where the state of memory freed after a fatal error lingers and is reused before initialization by the next request handled by the same worker.

The php.net announcement says every PHP installation that handles web requests is affected, and it considers Apache mod_php the most dangerous setup. That is because a single unauthenticated request was shown to trigger the attack on mod_php before any application code ran.

The patched versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and every version in the 8.2 to 8.5 branches below them is affected. PHP 8.1 and earlier are branches the PHP project no longer supports, so there is no official patched version; they are covered by fixes that distributions and hosting providers carry over (backports).

When CISA published its notice on October 21, no actual exploitation had been confirmed, but CISA judged it risky to leave systems unpatched and advised patching immediately, starting with internet-facing systems. In its advisory the same day, CERT-EU assessed that, with proof-of-concept code starting to circulate, it had become more likely that attackers were already exploiting the flaws.

2️⃣ Checking the PHP version: Site Health › Info › Server

Even knowing about the flaws, you can't decide what to do until you know which PHP version your site runs on. In the admin screen, open [Tools › Site Health] and expand the [Server] section on the [Info] tab: the [PHP version] row shows the PHP version that actually handles your site's requests.

The [PHP SAPI] row right below [PHP version] shows how PHP runs; fpm-fcgi means a PHP-FPM setup. Because the flaw is inside the PHP engine that reads requests, this setup is affected too, and the php.net announcement singled out Apache mod_php as the most dangerous setup. Here, you only need the two rows [PHP version] and [PHP SAPI] in the [Server] section.

The attack starts with an unauthenticated request. At the stage where PHP reads the specially crafted request before WordPress code does, the request triggers one of the two flaws, which leads to code running on the server. The patched versions block this flow, so the task is to bring your site's PHP up to a patched version or later.

[php -v] in the terminal only shows the version of the default command-line PHP. On setups that install several PHP versions on one server, such as cPanel's EA-PHP or CloudLinux's alt-php, it can differ from the version your site uses. That's why the [PHP version] value in Site Health is the reference.

php -v

PHP 8.3.xx (cli) (built: Jun  3 2025 17:17:57) (NTS gcc x86_64)

On a server where you can't get into the admin screens, find the version your site uses from the PHP-FPM processes running to handle web requests. Debian and Ubuntu packages include the version number in the path of the configuration file the FPM master read, and below is what I found on a Debian 12 test server at a managed host.

ps -eo user,args | grep '[p]hp-fpm'

root     php-fpm: master process (/etc/php/8.2/fpm/php-fpm.conf)
abcdefg+ php-fpm: pool abcdefghij-82
klmnopq+ php-fpm: pool klmnopqrst-82

The 8.2 in the configuration path is the PHP version the site uses on this server, and this host also adds the version number to the end of the pool name (-82). You can also check which file the running FPM service started in the [Main PID] line of [systemctl status], and it is shown even without the root account.

systemctl status php8.2-fpm --no-pager | head -6

● php8.2-fpm.service - The PHP 8.2 FastCGI Process Manager
     Loaded: loaded (/lib/systemd/system/php8.2-fpm.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-10-22 07:14:57 UTC; 7h ago
       Docs: man:php-fpm8.2(8)
    Process: <PID> ExecStartPost=/usr/lib/php/php-fpm-socket-helper install /run/php/php-fpm.sock /etc/php/8.2/fpm/pool.d/www.conf 82 (code=exited, status=0/SUCCESS)
   Main PID: <PID> (php-fpm8.2)

With the default packages of RHEL-based distributions such as AlmaLinux, the master configuration path is /etc/php-fpm.conf, so no version number appears; in that case, check the version of the FPM package with [rpm -qf /usr/sbin/php-fpm].

3️⃣ Below PHP 8.2: check with your host for a backport and request one if there is none

If [PHP version] in Site Health is below 8.2 (7.x, 8.0 or 8.1), there is no official patched version from php.net. According to php.net's supported versions table (checked on October 22, 2026), only four branches are supported, 8.2, 8.3, 8.4 and 8.5, and no security patches are released for official versions 8.1 and earlier.

Security support for the 8.2 branch ends on December 31, 2026, so if you are upgrading now, choose 8.3 or later.

Instead, distributions and hosting providers sometimes ship packages that carry over only the fix while keeping the version number (backports). The 7.4.33, 8.0.30 and 8.1.34 packages on a managed hosting test server are one example. Their changelog contained the line [Backported from 8.2.35 — CVE-2026-109618, CVE-2026-109619].

Even when the version number is the same, you can confirm whether the fix is included by finding the CVE number in the package changelog; if a line comes up, the package contains the fix. On Debian and Ubuntu, search as shown below, and match the version number in the path to the version your site uses.

zcat /usr/share/doc/php8.2-cli/changelog.Debian.gz | grep 109618

   + (CVE-2026-109618, CVE-2026-109619): Avoid state corruption via

On RPM-based systems, search with the command below.

rpm -q --changelog php-common | grep 109618

So if you are below 8.2, first ask your hosting provider whether a backport has been applied, and if it hasn't or they can't confirm it, ask them to move you to a supported version. After the upgrade, check again with the [PHP version] value in Site Health.

CISA advised organizations running 8.1 or earlier that cannot update right away to keep their PHP-based systems offline until they are patched or upgraded.

If you run the server yourself and use 8.1 or earlier, you can install your distribution's backported packages or apply the source patches for 7.4, 8.0 and 8.1 released by the PHP security team. Still, these branches are out of support, so moving to a supported version is the real fix.

4️⃣ PHP 8.2 or later: update to the patched version and check again

If you are on 8.2 or later but below the patched version, upgrade PHP itself. On managed and shared hosting, the provider applies the patch to the whole server, so confirm through its announcements or support whether it has been applied and which build you are on, then see whether [PHP version] in Site Health has changed. Cloudways said in a status page announcement that it was applying the patch to PHP 5.6, 7.4 and 8.0 to 8.4 at 22:19 UTC on October 21, and at 10:11 UTC on October 22 it said the work was finished.

On a server you run yourself, upgrade with packages from your distribution's or an LTS vendor's repository, as the php.net announcement says. Before updating, do a preview of the list of packages that will change to make sure only packages starting with php are upgraded and nothing else comes along, and don't mix it with other operating system updates.

dnf upgrade --assumeno 'php*'

Dependencies resolved.
================================================================================
 Package       Architecture  Version         Repository  Size
================================================================================
Upgrading:
 php           x86_64  8.3.xx-1.…        …       1.9 M
 php-cli       x86_64  8.3.xx-1.…        …       5.6 M
 php-common    x86_64  8.3.xx-1.…        …       1.3 M
 php-fpm       x86_64  8.3.xx-1.…        …       1.9 M
 (lines for extension packages such as php-gd · php-intl omitted)

Transaction Summary
================================================================================
Upgrade  xx Packages

dnf upgrade 'php*'

Upgraded:
  php-8.3.xx-1.….x86_64
  php-cli-8.3.xx-1.….x86_64
  php-common-8.3.xx-1.….x86_64
  php-fpm-8.3.xx-1.….x86_64
  (extension package lines omitted)

Complete!

In this test, only the packages starting with php were upgraded to the patched version, and php-fpm restarted on its own when the package installation finished. The patched version only takes effect once the php-fpm workers restart, so on systems without an automatic restart, run [systemctl restart php-fpm] yourself.

After the upgrade, check that both [php -v] and the [PHP version] row on the Site Health [Info] tab show the patched version or later, and also check the php-fpm service status and the site's response. If only the command-line value changed and [PHP version] stays the same, restart php-fpm and check again.

After the update, too, expand the [Server] section on the [Info] tab of the same [Tools › Site Health] screen and look at the [PHP version] row. If this value has changed to the version you upgraded to, the php-fpm workers are running on the new version as well.

php -v

PHP 8.3.xx (cli) (built: Oct 19 2026 14:00:34) (NTS gcc x86_64)

systemctl is-active php-fpm

active

curl -s -o /dev/null -w '%{http_code}\n' 'https://example.com/?r=1'

200

For packages whose version number itself goes up, confirm the patch by the new version number; for backported packages that keep the version number, confirm it by the CVE number in the changelog. This server was the former, so [rpm -q --changelog php-common] had no line with the CVE number, and I confirmed it by the new version number on the first line of the changelog.

5️⃣ When you can't upgrade right away: the temporary mitigations from php.net

For servers that can't be upgraded right away, php.net lists the settings below as temporary mitigations, while stating that they only narrow specific attack paths and do not make an installation safe. It also says not to set the memory limit with RLIMIT_AS or RLIMIT_DATA instead, because that can actually cause the vulnerable allocation failures.

php_admin_value is a server-side setting that the application can't override, so shared hosting users often can't change it themselves, and in that case too you end up asking your hosting provider. php.net also advises setting limits at the web server or proxy level on request body size, the number of input fields, the number of multipart parts, the number of headers and nesting depth.

The session.upload_progress.enabled setting in the table was recommended once more in php.net's October 23 advisory. To also block an unlikely remote code execution path (CVE-2026-115560), php.net advised keeping this value at 0 until the next regular bugfix version. The setting was already listed as a mitigation in the October 21 GHSA-6wmf-4rv5-p3rp advisory, so if you applied it then, you can leave it as it is.

This path only arises when an application whose configuration sets session.serialize_handler to php_binary or php_serialize switches it to php with ini_set() before session_start(), and the session upload progress feature is also on. Looking at the CVE-2026-115560 path alone, php.net said applications that don't change the serialization method at runtime can keep using this feature with it turned on.

🔢 FAQ & Recommended Content

🔗 Recommended Reading

Security WP Security: wp-admin Security Settings that protect the admin screen by changing the login URL, limiting login attempts and blocking XML-RPC. Read post →

Security wp-config.php Security Vulnerabilities How to keep the wp-config.php file from being exposed and strengthen its security settings. Security WordPress XML-RPC How to spot xmlrpc.php attacks in the logs and three ways to disable it. Server php-fpm max_children warning A hands-on test that finds the cause of the warning in the logs before adding workers.

ℹ️ Affiliate Disclosure
This site's content contains affiliate links. When a visitor buys a product or service through one of them, the site receives a commission from the seller. The amount the buyer pays^{(it goes down during event discounts ↓)}does not go up. Posted prices, discounts, and stock reflect the time of writing and may differ, so confirm with the seller before buying. Products are chosen and reviewed by our own standards, and commissions do not affect the order or content of reviews.