BIMPROWhat happened
PHP published emergency security releases on 21 October 2026 for two vulnerabilities, nicknamed PHP2Shell. Details leaked a day before the scheduled disclosure.
| CVE | Type | In plain terms |
|---|---|---|
| CVE-2026-109618 | Out-of-memory corruption | When PHP runs out of memory, it can stop with request data half set up, and cleanup then treats that data as valid. That can lead to code execution. |
| CVE-2026-109619 | Stale global state | Internal state from one request can survive after its memory is freed, creating a use-after-free on later requests. |
Who is affected
Any PHP runtime that serves web requests and is older than the fixed releases: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed setups. Reports say a single unauthenticated request can trigger an attack before application code runs, so this is a server-level problem, not a bug in your own code.
| Your PHP branch | Fixed in |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| Older (8.1, 8.0, 7.x…) | No official fix reported. Ask your host or Linux distribution about backports, and plan an upgrade. |
Your checklist
Find every copy of PHP
Servers, containers, staging boxes, old marketing sites, WordPress hosting, internal tools. PHP often hides in places nobody remembers. Run
php -vand check your hosting control panels.Update to a fixed release
Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a distro build that includes the fix). On shared hosting, select a patched PHP version in your control panel or ask the provider.
Restart PHP workers
Restart PHP-FPM or Apache after updating so old processes, and any state they hold, are gone.
Isolate what you can’t patch yet
Follow the vendor advice: put unpatched, internet-facing PHP apps behind a WAF or take them offline until they’re updated. Cloudflare has published protections for customers.
Watch for signs of compromise
Check for unexpected files, new admin users, odd outbound traffic and spikes in memory errors. If you suspect a breach, contact your hosting provider or an incident response firm straight away.
How BIMPRO can help
We’re an AI and software development company, not an incident-response firm. What we can do is help you get your application estate under control and set up so the next advisory is less stressful.
PHP exposure check
We help you inventory your PHP apps and versions and produce a short prioritised patch list.
AI-assisted code review
We review legacy code for risky patterns and dependency problems, and flag what’s worth fixing first.
Modernisation roadmap
For apps stuck on unsupported PHP, we plan a phased move to a maintained stack such as Node.js with TypeScript, without a risky big-bang rewrite.
Automation & monitoring
Version tracking and update alerts, so unsupported runtimes get noticed before attackers notice them.
FAQ
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For older branches, check your host or Linux distribution for backports and plan an upgrade.
Is my site affected if it’s on shared hosting?
If your pages are served by PHP, your host is responsible for patching the runtime. Ask which PHP version your account uses and when it was updated, and select a patched version in your control panel if one is offered.
Do I need to rewrite my PHP application in another language?
No. Patching the runtime is the immediate fix. Migration is worth considering for apps on unsupported versions or that are costly to maintain.
Not sure what you’re running?
Send us a short description of your sites and apps. We’ll tell you where to look first and whether anything needs more than a patch.
Request a free PHP exposure check