Understanding the PHP2Shell Critical RCE Vulnerabilities
The cybersecurity community is facing a high-severity threat known as PHP2Shell.
Disclosed by the PHP core team on October 21, 2026 under CVE-2026-109618 and CVE-2026-109619, these flaws carry a CVSS v4.0 score of 9.2 (Critical), allowing unauthenticated remote code execution (RCE).
The flaw lives in the PHP runtime engine on the server, not in application code. Updating your own code alone will not protect you.
What is PHP2Shell? (Technical Overview)
PHP2Shell is a Use-After-Free (UAF) flaw within the PHP core engine's memory management and request parsing mechanisms.
When the server approaches its memory limit (OOM) or receives specially crafted multipart upload requests, the interpreter frees objects incorrectly. An attacker can leverage this to execute operating system commands on the host.
Affected PHP Versions
| Branch | Affected | Fixed in |
|---|---|---|
| PHP 8.1 and older | All versions | No patch (EOL) |
| PHP 8.2 | < 8.2.35 | 8.2.35 |
| PHP 8.3 | < 8.3.36 | 8.3.36 |
| PHP 8.4 | < 8.4.27 | 8.4.27 |
| PHP 8.5 | < 8.5.12 | 8.5.12 |
PHP 8.1 and earlier are end-of-life, so no official patch will ship for them; systems still on those branches need to be migrated to a supported branch.
Does Updating WordPress Resolve This?
No. The flaw resides in the underlying PHP runtime engine, not in application code. Updating WordPress core, themes or plugins alone does not mitigate it.
Mitigation & Resolution
- Upgrade the PHP engine: move to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 and above.
- Temporary mitigation: set
session.upload_progress.enabled = 0inphp.iniand restart PHP-FPM.
To verify the running version and setting:
php -v
php -i | grep -i "session.upload_progress.enabled"Remember to restart PHP-FPM, otherwise the php.ini change will not take effect:
sudo systemctl restart php8.3-fpm