Actively exploited since 26 October 2026

PHP2Shell: a fix for PHP 5.4 to 8.1, where there is no official one.

PHP2Shell is the name given to two vulnerabilities in PHP, published on 21 October 2026, that let an attacker run code on a server without logging in. CISA added both to its catalogue of known exploited vulnerabilities on 26 October 2026. PHP fixed them only in its supported releases.

Request the fix

The two vulnerabilities

CVE	Score	Affected PHP	Fixed in	What goes wrong
CVE-2026-109618	9.8 Critical	7.3.0 and later	8.2.35, 8.3.36, 8.4.27, 8.5.12	After an out-of-memory error, request memory can be left uninitialised, and the request cleanup then relies on it.
CVE-2026-109619	8.1 High	5.4.0 and later	8.2.35, 8.3.36, 8.4.27, 8.5.12	Internal state can keep pointing at request memory after it has been freed, and a later request relies on it.

Scores from the US National Vulnerability Database (CVSS 3.1). The PHP project rates both 9.2 in CVSS 4.0. Both can be reached over the network, with no login and no user action. US federal agencies must fix them by 29 October 2026.

Is your PHP affected?

Find the PHP version your websites run, not only the command line one: php -v on the server, and the version that phpinfo() or your control panel shows for each site.
Find your version in the table below.
If PHP came from your Linux distribution, check its security advisory too: Debian, Ubuntu, Red Hat and others can ship a fix in a package that keeps the old version number.

Your PHP	CVE-2026-109618	CVE-2026-109619	Official fix
5.3 and older	Not affected	Not affected	Not needed, but PHP 5.3.3 has 266 other CVEs
5.4 to 7.2	Not affected	Affected	None, end of life
7.3 to 8.1	Affected	Affected	None, end of life
8.2 before 8.2.35	Affected	Affected	8.2.35
8.3 before 8.3.36	Affected	Affected	8.3.36
8.4 before 8.4.27	Affected	Affected	8.4.27
8.5 before 8.5.12	Affected	Affected	8.5.12

The vulnerability database also lists products that embed PHP: Palo Alto Networks PAN-OS and Panorama, and the Siemens RUGGEDCOM APE1808. For those, follow the vendor's advisory.

What to do

PHP 8.2 to 8.5

Update to the fixed release of your branch: 8.2.35, 8.3.36, 8.4.27 or 8.5.12.

PHP 5.4 to 8.1

There is no official fix. Move to a supported release, or keep the version you run with our backported fix: within 48 hours of your order, or within 24 hours with priority delivery.