Loading…
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619, two critical RCE flaws. Fixed versions, update steps and interim mitigations.
One Brotli bug, two names: Node2Shell and HTTP2Shell (CVE-2026-111497). Fixed versions for Node.js, Bun and Python, version checks, patch order and stopgaps.
8 min read
AWS saw a PHP2Shell attempt on 17 October, four days before PHP's fix. Here's how to check logs, processes and files on PHP-FPM, mod_php and shared hosting.
9 min read
Updated 21 October 2026, after the release. PHP has shipped the fixes: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The fixed versions, vulnerability IDs and update steps below come straight from PHP's security advisory and release notes. The original pre-release guidance follows, revised to match what PHP published.
PHP released fixes for two critical vulnerabilities on 21 October 2026, in the release it had scheduled for 14:00 UTC (19:30 IST). PHP says both can allow unauthenticated remote code execution on installations that serve web requests. The two flaws are now widely called PHP2Shell. Patching is the only complete fix. Here is what changed, which version you need, and how to make sure the fix is actually running. Already patched? Check whether you were hit before you did.
| Branch | Fixed version | Notes |
|---|---|---|
| 8.5 | 8.5.12 | Supported |
| 8.4 | 8.4.27 | Supported |
| 8.3 | 8.3.36 | Supported |
| 8.2 | 8.2.35 | Security support ends 31 December 2026 |
| 8.1 and older | No php.net release | See "End-of-life branches" below |
PHP describes them at a high level; the GitHub advisories linked above carry the full technical details.
The score. PHP rates each flaw CVSS v4.0 9.2 (php.net pre-release notice). watchTowr, and a since-deleted Hacker News post, described them as CVSS 10, per BleepingComputer. PHP's 9.2 is the official number. If you want to see what a v4.0 score is built from, CVSS vector strings explained covers it, and the CVSS vector parser will decode the vector from the advisory.
The install you know about is rarely the only one. Check each of these:
php -v for the command-line binary. Your web server may use a different build, so check the web-facing version as well. For PHP-FPM, check each installed version (for example php-fpm8.3 -v on Debian or Ubuntu) and which php*-fpm services are running.FROM php: and note the tag. Then check the images that are actually running, not just what's in the repo.Don't leave a phpinfo() page public to check versions; delete it as soon as you've read it. And see whether your responses advertise the version in an X-Powered-By: PHP/... header. The security header analyzer will show it, and HTTP security headers explained covers why version banners are worth removing. Hiding the banner doesn't fix anything, but it stops you advertising which sites are still unpatched.
If you have more than a handful of servers, an asset scan beats memory; penetration testing vs vulnerability scanning explains what each will find.
php -v with php.net's list.PHP 8.1 and older get no php.net release. Some distributions and LTS vendors backport fixes, so contact yours. Given the severity, PHP's security team also published minimal source backports for PHP 7.4, PHP 8.0 and PHP 8.1 for people who build from source or have no LTS vendor. Treat those as a bridge; the real fix is moving to a supported branch. Running outdated components is a standing risk on its own; it's one of the categories in the OWASP Top 10.
php -v, then confirm the version the web side reports (a temporary check you delete afterwards, or the FPM binary version). You want the version serving requests to be 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor's fixed package.PHP is clear that only the update is a complete solution. Its advisory lists measures that reduce exposure to specific attack paths but "do not make an installation safe":
For CVE-2026-109618 (OOM corruption):
memory_limit=-1 in a way applications can't override, such as php_admin_value in the FPM pool or Apache configuration, and check nothing sets a finite limit back. PHP notes an underlying allocation failure can still reach the vulnerable path.post_max_size: 8M if you don't need uploads, 32M if you do, and keep upload_max_filesize below it.RLIMIT_AS or RLIMIT_DATA instead, as these can cause the vulnerable allocation failure.For CVE-2026-109619 (stale global state):
session.upload_progress.enabled=0 in php.ini, the FPM pool or server configuration, then restart every worker. PHP says not to rely on ini_set() or FPM .user.ini, and that this blocks the confirmed session paths but not other variants.fatal_error_backtraces=0 and restart every worker. This blocks only the confirmed fatal-backtrace path.error_reporting, display_errors or @ does not help.CERT-EU's earlier advice also still applies: consider isolating internet-facing applications until they're patched. That can mean maintenance mode or an IP allowlist, restricting admin paths, and taking down staging copies and abandoned sites. A WAF rule is a stopgap at best, not a fix.
Details leaked before the release, and watchTowr said it believed it had reproduced one of the flaws. Once you're on the fixed version, look for new PHP files in upload and cache directories, admin accounts you didn't create, and unexpected outbound connections from the web server. The detection section of defending your website against AI agent attacks walks through what to look for, including how to spot an uploaded web shell.
phpinfo() pages and version bannersShare this article
One attacker pointed AI agents at 1,200+ sites and got into 100+ companies. Here's what the agents hunted for and how to close each door on your own site.
9 min read
Sign in to leave a comment.