PHP2Shell vulnerability is a reminder that website security needs to start from the server platform. Even though the website still operates normally, businesses should immediately confirm the PHP update status with the administrator or hosting provider.
In this article, Qweb summarizes the information you need to know and proposes a handling process for website owners to coordinate with the technical team. Content is compared with official warnings, updated on October 25, 2026.
What is PHP2Shell and why should website owners care?
PHP2Shell is the name of two vulnerabilities in PHP core: CVE-2026-109618 and CVE-2026-109619. They can allow remote code execution without logging in. This is a problem with the PHP running environment, so just updating the website source code is not enough to handle it.
Theo PHP security notice October 21, 2026, web request serving implementations should be reviewed, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP rates the highest risk with mod_php, where exploits have been demonstrated before the application code runs.
How do the two vulnerabilities work?
CVE-2026-109618: unsafe out-of-memory handling
When a request causes PHP to run out of memory, processing may stop at a time when internal data has not been fully initialized. The cleanup process could then use invalid state and lead to code execution. Specially created multipart requests are one path that can trigger this scenario. See official analysis of OOM errors.
CVE-2026-109619: stale state persists between requests
Some global states may continue to point to memory that has been freed. When the worker processes the next request and accesses the old state before reinitialization, a use-after-free error may occur. Under suitable exploit conditions, the result is remote code execution. Detailed information is included warning about stale global state.
For business managers, the thing to do is ask to check the server environment instead of just looking for a plugin to install.
Which PHP version needs updating?
AWS Security Bulletin lists the first patch milestones as follows:
| PHP branch | Versions affected | First patch |
|---|---|---|
| 8.2 | 8.2.0–8.2.34 | 8.2.35 |
| 8.3 | 8.3.0–8.3.35 | 8.3.36 |
| 8.4 | 8.4.0–8.4.26 | 8.4.27 |
| 8.5 | 8.5.0–8.5.11 | 8.5.12 |
This is a patch for the two CVEs mentioned above, not a commitment that that version is free of other security flaws. For PHP 8.1 and below, plan to switch to a supported branch. If you use a package maintained and patched by the vendor, you need to compare the vendor's own notice; Don't conclude from the original version number alone.
Qweb's recommended process for website owners
1. Confirm the correct system is operating
Make a list of main website, sub-site, test site and internal application. Send the hosting company three questions: which PHP version is serving each website, is the package patched for both CVEs, and when will the deployment be completed? It is recommended to request feedback in writing for convenient follow-up.
2. Prepare a backup and check for compatibility
Before changing your PHP branch, back up your database and website files, and confirm how to restore. With WordPress or WooCommerce, try out the important flows on a test environment: login, form submission, search, order, and checkout. Clearly assign someone to check the content, someone to update the server, and someone to decide on recovery when there is an error.
3. Install the patch and replace the running process
The technical team needs to properly update the web server runtime, then restart or replace the workers for the new version to take effect. With the container, redeploy the updated image. JFrog also emphasizes updating and restarting workers in the processing instructions.
4. Check after update
Requires confirmation of the version of PHP serving the website, as command-line PHP may differ from PHP-FPM or hosting configuration. Recheck selected functions, monitor errors and record results. A process ticket should only be closed when there is evidence of implementation and operational testing.
Can't patch right away: what should be the priority?
Temporary measures only partially reduce the attack surface. It is necessary to set a deadline for completing the patch, assign a responsible person and consider restricting access to unprocessed services.
Note updated on October 23, 2026: PHP also recommends placing session.upload_progress.enabled=0 until the next scheduled fix to prevent another RCE path in a rare application code and configuration combination. Administrators need to check the configuration scope and restart the worker. See notices Session upload progress of PHP.
Do not change the memory limit on a live server yourself without evaluating the resources and impact. WAF rules, request limits, and PHP configurations need to be applied by the administration team as appropriate to the actual system.
Frequently asked questions
Is updating WordPress and plugins enough?
No. PHP2Shell is located in the PHP layer. It is necessary to coordinate with the server administrator to patch the runtime, and maintain updates to WordPress, themes and plugins as part of maintenance work.
Does a website without a file download button need to be checked?
Yes. Not showing file download functionality does not prove that the server is not processing multipart requests. Let engineering determine exposure rather than infer from the interface.
Can WAF replace PHP patching?
No. WAF is the layer that supports risk reduction. Runtime updates remain the priority to fix these two vulnerabilities.
Include platform updates in your website maintenance plan
Enterprises should maintain a list of platform versions, patch review schedules, backups, and troubleshooting leads. When there are new warnings, this list helps quickly identify systems that need priority and avoid missing rarely used websites.
You don't know which PHP website is running? Please contact Qweb.com.vn, provides domain name and hosting unit information to discuss website review, maintenance or upgrade needs. Do not post admin passwords in public comments.
This article is for reference and coordination. Technical recommendations should be compared with actual configurations and the latest announcements from the supplier.
