PHP2Shell: what happened and what to do

On 21 October 2026 at 14:00 UTC the PHP project released emergency updates for two critical flaws in the PHP interpreter, nicknamed PHP2Shell. Both are rated 9.2 on CVSS v4.0 and both allow remote code execution without logging in, on any server that serves web pages with PHP.

Researchers also showed the flaws can reveal the memory of PHP worker processes. That memory can hold passwords, session tokens, API keys and certificates.

The flaws are in PHP itself, not in any application or Composer package. Updating your application or its dependencies does nothing. The PHP software on the server must be updated and every PHP worker restarted.

Wiz describes four underlying bugs and groups them slightly differently between the two CVE numbers. The descriptions agree on the mechanism: state that survives a failed or finished request is reused by the next one.

• Versions: every PHP release since 5.4.0.
• Deployment types: every installation that serves web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The command-line PHP binary is not listed as affected.
• Highest risk: Apache with mod_php, where a demonstrated exploit fires on a request without login, before any application code runs. No application-level control can stop it.
• Applications: code execution was demonstrated against the latest WordPress, Drupal and Joomla.

Any PHP server reachable from the internet was exposed from at least 17 October until it was patched and restarted.

PHP released fixed versions for every supported branch on 21 October 2026. Your server should be on one of these, or later:

Some providers, including Ubuntu and Hostinger, apply the fix without changing the version number. A site can be patched and still report an older version, so the version alone is not proof either way.

Ubuntu

Ubuntu applies the fix without changing the PHP version number. A patched Ubuntu 24.04 server still reports PHP 8.3.6. Check the package version (dpkg -l | grep php8) instead.

Non-LTS releases past end of life, such as 24.10 and 25.04, get no fix.

Other platforms

Ondřej Surý PPA (ppa:ondrej/php)

Tracks upstream PHP. Patched packages report the upstream fixed versions: 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Containers

Rebuild images on the fixed tags (php:8.x-fpm, php:8.x-apache, wordpress:php8.x) pulled after 21 October, then redeploy. A running container keeps its old PHP until it is rebuilt.

After any update

Restart every PHP worker: Apache, PHP-FPM and LiteSpeed lsphp. Patched files on disk do nothing until the running workers are replaced.

What the larger hosts have said publicly. Check your host's own notice for the latest.

On Hostinger, open hPanel, then Websites, then Dashboard, then PHP Info. The Build Date must be 21 October 2026 or later. The version shown in the x-powered-by header may still be the old patch number.

From outside

The x-powered-by: PHP/x.y.z response header, where a server shows it. It is unreliable for patch status on hosts that patch without changing the version, and missing where expose_php is off.

On the server

php -v, dpkg -l | grep php, the PHP Info Build Date, and the package source (apt-cache policy).

Scanners

Nessus plugin 369483 has local and remote checks. The remote check only works when the server shows its PHP version.

These settings block specific attack paths and buy time until you can update. PHP is explicit that they do not make an installation safe.

Restart every PHP worker after changing any of these. Cloudflare and other firewall vendors have deployed rules; treat them as a stopgap only. Where patching is not possible at all, CISA's guidance is to put the system behind a web application firewall or take it offline.

From the Wiz and Tenable write-ups:

• Unusual file-upload requests followed by memory-limit errors in the PHP log
• Repeated HTTP 500 responses from otherwise healthy pages
• Malformed PHPSESSID cookies in responses
• PHP workers restarting or crashing more often than usual
• PHP worker processes launching shells or downloading tools (sh, bash, curl, wget or nc running as the web user)

Checks to run on the server:

• PHP files created or changed since 17 October 2026 that you did not deploy
• Any .php file in upload or storage folders
• Unknown administrator accounts (on WordPress) and unknown scheduled tasks for the web user
• POST requests answered with 4xx or 5xx errors in the access log around the exposure window

Because the flaws leak worker memory, a server that was reachable while unpatched may have exposed any secret its PHP processes held. Rotate database passwords, third-party API keys, OAuth and JWT signing keys, and service account keys.

Treat application encryption keys separately. WordPress salts are cheap to rotate: everyone is logged out and nothing else breaks. Laravel's APP_KEY should stay unless there is evidence of compromise, because changing it makes data encrypted with the old key unreadable.

Retrieved 23 October 2026.