PHP Vulnerability: PHP2Shell Patch and How to Check Your PHP Version (WordPress)

PHP2Shell is the name given to two PHP vulnerabilities (CVE-2026-109618 · CVE-2026-109619) whose patches were released on October 21, 2026. They are remote code execution flaws that let even an unauthenticated request run code on the server, so the first thing to do is check which PHP version your site uses and upgrade it to a patched release. On an Nginx + Apache server running WordPress 7.1.3, I checked the PHP version in Site Health, upgraded only the php packages to the patched release and then checked again.

1️⃣ The PHP2Shell PHP vulnerability: how the flaws work and who is affected

The flaws sit inside the PHP engine, which reads the request before any WordPress code runs, so they remain even if you keep plugins and themes up to date, unless you upgrade PHP. According to the CERT-EU advisory, both score 9.2 on CVSS; the technical details are public and being discussed, and early proof-of-concept code has started to circulate.

CVE-2026-109618 is a flaw where, when a request exceeds the memory limit (memory_limit) and is aborted, the cleanup process treats half-initialized request data as valid data. CVE-2026-109619 is a flaw where the state of memory freed after a fatal error lingers and is reused before initialization by the next request handled by the same worker.

According to the php.net announcement, every PHP installation that handles web requests is affected, and Apache mod_php is considered the most dangerous setup. That is because a single unauthenticated request was shown to trigger the attack on mod_php before any application code ran.

The fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, and every release in the 8.2 to 8.5 branches below them is affected. PHP 8.1 and earlier are branches the PHP project no longer supports, so there is no official patched release; they are covered by fixes that distributions and hosting providers carry over (backports).

When CISA published its notice on October 21, no actual exploitation had been confirmed, but CISA judged it risky to leave systems unpatched and advised patching immediately, starting with internet-facing systems. In its advisory the same day, CERT-EU assessed that, with proof-of-concept code starting to circulate, it had become more likely that attackers were already exploiting the flaws.

2️⃣ Checking the PHP version: Site Health › Info › Server

Even knowing about the flaws, you can't decide what to do until you know which PHP version your site runs on. In the admin screen, open [Tools › Site Health] and expand the [Server] section on the [Info] tab: the [PHP version] row shows the PHP version that actually handles your site's requests.

The [PHP SAPI] row right below [PHP version] shows how PHP runs; fpm-fcgi means a PHP-FPM setup. Here, you only need the two rows [PHP version] and [PHP SAPI] in the [Server] section.

The attack starts with an unauthenticated request. At the stage where PHP reads the specially crafted request before WordPress code does, the request triggers one of the two flaws, which leads to code running on the server. The fixed releases block this flow, so the task is to bring your site's PHP up to a fixed release or later.

[php -v] in the terminal only shows the version of the default command-line PHP. On setups that install several PHP versions on one server, such as cPanel's EA-PHP or CloudLinux's alt-php, it can differ from the version your site uses. That's why the [PHP version] value in Site Health is the reference.

php -v

PHP 8.3.xx (cli) (built: Jun  3 2025 17:17:57) (NTS gcc x86_64)

3️⃣ Below PHP 8.2: check with your host for a backport and request one if there is none

If [PHP version] in Site Health is below 8.2 (7.x, 8.0 or 8.1), there is no official patched release from php.net. According to php.net's supported versions table (checked on October 22, 2026), only four branches are supported, 8.2, 8.3, 8.4 and 8.5, and no security patches are released for official 8.1 and earlier.

Instead, distributions and hosting providers sometimes ship packages that carry over only the fix while keeping the version number (backports). The 7.4.33, 8.0.30 and 8.1.34 packages on a managed hosting test server are one example. Their changelog contained the line [Backported from 8.2.35 — CVE-2026-109618, CVE-2026-109619].

Even when the version number is the same, you can confirm whether the fix is included by finding the CVE number in the package changelog. On Debian and Ubuntu, search with something like [zcat /usr/share/doc/php8.2-cli/changelog.Debian.gz | grep 109618]. On RPM-based systems it looks like [rpm -q --changelog php-common | grep 109618]; match the version number in the package name to the version your site uses.

So if you are below 8.2, first ask your hosting provider whether a backport has been applied, and if it hasn't or they can't confirm it, ask them to move you to a supported version (8.2 or later). After the upgrade, check again with the [PHP version] value in Site Health.

CISA advised organizations running 8.1 or earlier that cannot update right away to keep their PHP-based systems offline until they are patched or upgraded.

If you run the server yourself and use 8.1 or earlier, you can install your distribution's backported packages or apply the source patches for 7.4, 8.0 and 8.1 released by the PHP security team. Still, these branches are out of support, so moving to a supported version is the real fix.

4️⃣ PHP 8.2 or later: update to the patched release and check again

If you are on 8.2 or later but below the patched release, upgrade PHP itself. On managed and shared hosting, the provider applies the patch to the whole server, so confirm through its announcements or support whether it has been applied and which build you are on, then see whether [PHP version] in Site Health has changed. According to its status page, Cloudways started patching every PHP version it supports (5.6 to 8.4) at 22:19 UTC on October 21. At 10:11 UTC on October 22, it announced that the work was complete.

On a server you run yourself, upgrade with packages from your distribution's or an LTS vendor's repository, as the php.net announcement says. Before updating, do a preview of the list of packages that will change to make sure only packages starting with php are upgraded and nothing else comes along, and don't mix it with other operating system updates.

dnf upgrade --assumeno 'php*'

Dependencies resolved.
================================================================================
 Package       Architecture  Version         Repository  Size
================================================================================
Upgrading:
 php           x86_64  8.3.xx-1.…        …       1.9 M
 php-cli       x86_64  8.3.xx-1.…        …       5.6 M
 php-common    x86_64  8.3.xx-1.…        …       1.3 M
 php-fpm       x86_64  8.3.xx-1.…        …       1.9 M
 (lines for extension packages such as php-gd · php-intl omitted)

Transaction Summary
================================================================================
Upgrade  xx Packages

dnf upgrade 'php*'

Upgraded:
  php-8.3.xx-1.….x86_64
  php-cli-8.3.xx-1.….x86_64
  php-common-8.3.xx-1.….x86_64
  php-fpm-8.3.xx-1.….x86_64
  (extension package lines omitted)

Complete!

In this test, only the packages starting with php were upgraded to the patched release, and php-fpm restarted on its own when the package installation finished. The fixed release only takes effect once the php-fpm workers restart, so on systems without an automatic restart, run [systemctl restart php-fpm] yourself.

After the upgrade, check that both [php -v] and the [PHP version] row on the Site Health [Info] tab show the patched release or later, and also check the php-fpm service status and the site's response. If only the command-line value changed and [PHP version] stays the same, restart php-fpm and check again.

After the update, too, expand the [Server] section on the [Info] tab of the same [Tools › Site Health] screen and look at the [PHP version] row. If this value has changed to the version you upgraded to, the php-fpm workers are running on the new version as well.

php -v

PHP 8.3.xx (cli) (built: Oct 19 2026 14:00:34) (NTS gcc x86_64)

systemctl is-active php-fpm

active

curl -s -o /dev/null -w '%{http_code}\n' 'https://example.com/?r=1'

200

For packages whose version number itself goes up, confirm the patch by the new version number; for backported packages that keep the version number, confirm it by the CVE number in the changelog. This server was the former, so [rpm -q --changelog php-common] had no line with the CVE number, and I confirmed it by the new version number on the first line of the changelog.

5️⃣ When you can't upgrade right away: the temporary mitigations from php.net

For servers that can't be upgraded right away, php.net lists the settings below as temporary mitigations, while stating that they only narrow specific attack paths and do not make an installation safe. It also says not to set the memory limit with RLIMIT_AS or RLIMIT_DATA instead, because that can actually cause the vulnerable allocation failures.

php_admin_value is a server-side setting that the application can't override, so shared hosting users often can't change it themselves, and in that case too you end up asking your hosting provider. php.net also advises setting limits at the web server or proxy level on request body size, the number of input fields, the number of multipart parts, the number of headers and nesting depth.

🔢 FAQ & Recommended Content

🔗 Recommended Reading

Security WP Security: wp-admin Security Settings that protect the admin screen by changing the login URL, limiting login attempts and blocking XML-RPC. Read post →

Security wp-config.php Security Vulnerabilities How to keep the wp-config.php file from being exposed and strengthen its security settings. Security WordPress XML-RPC How to spot xmlrpc.php attacks in the logs and three ways to disable it. Server php-fpm max_children warning A hands-on test that finds the cause of the warning in the logs before adding workers.

ℹ️ Affiliate Disclosure
This site's content contains affiliate links. When a visitor buys a product or service through one of them, the site receives a commission from the seller. The amount the buyer pays^{(it goes down during event discounts ↓)}does not go up. Posted prices, discounts, and stock reflect the time of writing and may differ, so confirm with the seller before buying. Products are chosen and reviewed by our own standards, and commissions do not affect the order or content of reviews.