What happened
On October 21, 2026, the PHP project published security releases for every supported PHP branch, fixing two critical vulnerabilities that security researchers group under the name PHP2Shell:
- CVE-2026-109618 (PHP advisory GHSA-w8fx-3rm8-4pc9): a flaw in how PHP parses certain HTTP headers, reported as unauthenticated remote code execution. An attacker needs no account on your site to attempt it.
- CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): an out-of-bounds read in URL validation, reported as a memory disclosure with a path to remote code execution.
Both vulnerabilities carry a CVSS v4.0 base score of 9.2 (Critical) in the National Vulnerability Database analyses summarized by Tenable Research. They are in PHP itself, the language runtime underneath WordPress, Joomla, Drupal and most PHP sites, not in any one application. Updating your CMS and plugins does not close them.
Fixed releases by branch
The October 21, 2026 releases are the first upstream releases that fix both vulnerabilities:
| Your PHP branch | Fixed release | Status of the branch |
|---|---|---|
| PHP 8.5 | 8.5.12 or later | Supported |
| PHP 8.4 | 8.4.27 or later | Supported |
| PHP 8.3 | 8.3.36 or later | Supported |
| PHP 8.2 | 8.2.35 or later | Supported; PHP 8.2 reaches end of life December 31, 2026 |
| PHP 8.1, 8.0, 7.4 and older | No new upstream release | End of life at the PHP project, see the backport section below |
What counts as fixed
A site is fixed for these two CVEs when one of the following is true, and can be evidenced:
- The running PHP is at or beyond the fixed release for its branch, and services were restarted after the update.
- A distribution or LTS vendor build carries the vendor's backported fix for both CVEs, confirmed from the vendor's own records (see below).
- The site has moved to a supported, patched branch.
Anything short of that, host-level filtering, web application firewall rules, or disabling features, is a partial mitigation. It may reduce exposure, but it is not the patch, and it should never be reported as one.
Branches without an upstream fix, and backports
PHP 8.1 and older no longer receive updates from the PHP project, and the project's October 21 announcement said no further updates will be issued for PHP 8.1 or older branches. It would be wrong, though, to say those sites have no fix in any circumstances:
- Distribution and vendor backports: mainstream Linux distributions and LTS vendors backport security fixes into the versions they ship, without changing the announced version number. A site can be protected while its version string still looks old.
- Minimal source backports: the PHP security team published minimal source-code backports for PHP 7.4, 8.0 and 8.1 for these vulnerabilities, for operators who build PHP themselves.
- What does not count: a host's general statement that they "take security seriously", a control panel's marketing page, or a network-level filter are not patch evidence. Vendor evidence means the vendor's advisory, changelog or package record naming the fix.
If no patch evidence exists for an end-of-life branch, the durable fix is a planned move to a supported branch. That is what the legacy migration service covers, and why it is quoted after assessment rather than at a flat price.
The October 23 informational update
On October 23, 2026, the PHP project published an informational advisory about session upload progress: it relates to a mitigation for CVE-2026-109619 and recommends setting session.upload_progress.enabled=0 in php.ini until the next regular bugfix release, to fully protect against an unlikely remote-code-execution vector while the feature processes attacker-controlled data. The project said the full advisory for the related finding (CVE-2026-115560) will ship with that next release. If your configuration uses session upload progress, ask whoever maintains your PHP to confirm this setting.
A note for Windows servers
Exploitability depends on how PHP is run on the server. Windows deployments of PHP as CGI are uncommon, but uncommon is not exempt: the same rule applies. Confirm the running build with your vendor or administrator rather than assuming the platform protects you.
How conclusions are worded here
A patch-status review ends in one of three conclusions, and nothing stronger:
- Patch status confirmed for the reviewed CVEs: the running build evidence shows a fixed release or a verified vendor backport.
- Potentially affected: the running build predates the fix and no vendor patch evidence exists.
- More information required: the evidence available does not settle the question, for example when the version cannot be confirmed as the running build.
A version seen in a response header is evidence, not a full assessment: headers can be hidden, and vendors can patch without changing version numbers. Equally, a host or provider confirming in writing that the running build includes the fix can resolve a case with no paid work at all. No honest service can guarantee a site will never be attacked.
Corrections and updates
October 24, 2026: first version of this guide. It incorporates the PHP project's October 21, 2026 security advisory and the October 23, 2026 informational update on session upload progress.
Primary sources
- PHP project archive, October 21, 2026 security releases
- PHP project archive, October 23, 2026 informational advisory (session upload progress)
- PHP project security and backports notes
Secondary technical references: Tenable Research FAQ and the Huntress report. Official sources govern where summaries differ.