PHP2Shell Vulnerability Explained: Affected PHP Versions, Fixes and How to Protect Your Website (2026)

PHP runs the backend of roughly seven out of ten websites. When a flaw lands inside PHP itself, it does not matter how clean your WordPress theme or Laravel code is. The weak spot sits underneath everything you built.

That is exactly what PHP2Shell is. It is a pair of critical bugs in the PHP engine that can let a stranger run commands on a web server without a password, a login, or any click from you. Below, we break down what these bugs do, who needs to act, and the exact steps that keep a site safe.

PHP2Shell Vulnerability Key Facts and CVE Details

What Is the PHP2Shell Vulnerability and How Does It Work?

PHP2Shell is the nickname researchers gave two memory-safety flaws in PHP. The name tells you the worst case: an attacker sends a request to your site and ends up with a shell on your server.

To understand the problem, think about how PHP serves pages. A server keeps a pool of PHP workers. Each worker picks up a visitor request, builds the page, cleans up, and moves to the next visitor. One worker handles hundreds of requests in a row.

Both bugs break that cleanup routine. When a request crashes in a specific way, PHP leaves scraps of old data behind in memory. The next request on the same worker can then touch that leftover data. A skilled attacker can shape those scraps so the server treats them as real instructions.

CVE-2026-109618: The Out-of-Memory Bug

Every PHP request has a memory limit. If a request blows past that limit at just the wrong moment, PHP halts the job instantly. In several places, that sudden stop leaves internal request data only half built. The cleanup step that runs afterward trusts the half-built data as if it were complete, and that opens a path to code execution.

PHP's team confirmed full remote code execution over plain HTTP against Apache with mod_php, using default memory settings. The attack fires before any of your application code even runs.

CVE-2026-109619: The Stale Pointer Bug

The second flaw involves state that outlives its own request. After a fatal error or a memory crash, PHP can keep internal pointers that still aim at memory it already freed. When a later request lands on the same worker, PHP may read that freed memory before it resets everything.

Researchers reached this bug through several routes, including the fatal error backtrace feature that PHP 8.5 turns on by default, OPcache shared memory, and session handling on both mod_php and PHP-FPM. It can lead to memory leaks or full code execution.

Which PHP Versions Are Vulnerable to PHP2Shell and Which Fix It?

Every supported branch before the fixed release is vulnerable. Older branches are in worse shape because they no longer get regular updates.

One catch for Linux servers: distributions like Ubuntu and Red Hat often apply the fix but keep an older looking version number. Check your distribution's security notice instead of trusting the version string alone.

How to Fix PHP2Shell and Protect Your Website

Your steps depend on how you host your site.

If You Use Shared Hosting

You cannot update PHP yourself on shared hosting, so your host carries this job.

1. Open your hosting control panel and check which PHP version your site uses.
2. If you sit on 8.1 or older, switch to 8.2 or newer from the PHP selector.
3. Contact support and ask, in writing, whether they applied the PHP2Shell patch and when.

If You Run WordPress

1. Go to Tools > Site Health > Info > Server to see your PHP version.
2. Keep in mind that updating WordPress core, themes, or plugins does nothing for this bug. The fix must happen at the PHP level.

If You Manage a VPS or Dedicated Server

On a VPS, security updates are your responsibility.

1. Install the patched PHP package from your distribution or build from source.
2. Restart every PHP worker after the update. Old workers keep running vulnerable code until they restart.
3. Inventory every PHP install, including control panels like cPanel and Plesk, and vendor tools that quietly bundle PHP.
4. Patch internet-facing systems first.

If You Cannot Patch Today

These steps reduce risk but do not replace an update. Test them on a staging copy first, since some can slow your site.

• Add session.upload_progress.enabled = 0 to your active php.ini.
• On PHP 8.5, set fatal_error_backtraces = 0.
• Consider opcache.enable = 0 to close the OPcache route, at a speed cost.
• Turn on a web application firewall rule from your CDN or host. Several providers pushed free protection rules for known exploit patterns.
• Restart all PHP workers after any config change.
• Limit what the PHP process can reach, so a break-in steals less.
• If none of this is possible, take the service offline or put it behind a VPN until you can update.

Why PHP2Shell Is More Dangerous Than a Typical PHP Bug

Plenty of PHP bugs affect one plugin or one framework. PHP2Shell is different for a few reasons:

• No login needed. An attacker does not need an account on your site.
• Your code does not matter. Researchers showed that even a page that prints a single word can be exposed, because the dangerous work happens before your script starts.
• Secrets can leak without a full takeover. The memory disclosure path can expose passwords, API keys, session tokens, and certificates that belong to other visitors' requests.
• Logs may stay quiet. The attack happens below the application layer, so your app logs might show almost nothing.
• Huge reach. Proof-of-concept attacks worked against WordPress, Drupal, and Joomla. Any site on a vulnerable PHP build carries the risk.

How AI Found a Decade-Old Flaw in PHP

The root issue is old. Researchers had spotted a related memory-limit weakness years earlier, but nobody could prove a working attack, so the fix stalled.

This time, security teams used frontier AI models to dig deeper. The AI helped them study crash behavior, turn messy memory errors into reliable exploits, and test patches. Work that once needed a large expert team for months took a single researcher about a week.

That speed cuts both ways. The same tools that help defenders find bugs also lower the skill attackers need. The gap between a public disclosure and active attacks has shrunk from weeks to hours.

Are Hackers Exploiting PHP2Shell Right Now?

Details leaked online about a day before the planned release, and PHP pushed its patch out early as a result. Security firms reported exploit attempts both before and after the fix went public, and one large network provider counted attempts in the millions within days.

The good news is that confirmed break-ins remain limited so far. Turning these bugs into reliable code execution is hard. The attacker's follow-up request must hit the same worker and place data in exactly the right spot, and memory protections like ASLR (Address Space Layout Randomization) make that tricky to pull off remotely. Many public exploit scripts on GitHub simply do not work, and some are outright fakes.

Do not read that as a reason to wait. Exploits improve fast, and most PHP servers on the internet still run unpatched or end-of-life versions.

What Is CVE-2026-115560, the Follow-Up PHP Bug?

After the main patch shipped, PHP disclosed another remote code execution flaw in the same upload progress area. This one carries far less risk because it needs a rare setup to work.

An app must set session.serialize_handler to php_binary or php_serialize in its config, then switch it to php at runtime using ini_set() before calling session_start(). Session upload progress must also be on. If your app never changes the serialize handler at runtime, you are not exposed.

PHP will fix this in its next regular bugfix release instead of rushing an emergency patch. Until then, setting session.upload_progress.enabled = 0 blocks it fully.

Why a php.ini Tweak Alone Won't Secure Your Server

When details first leaked, many admins disabled session upload progress and assumed they were safe. That setting does close several attack routes, but not all of them.

PHP's official advisory confirmed a separate path inside the multipart form parser that fires on any multipart/form-data POST request, whether upload progress is on or off. On top of that, the upload progress switch is a per-directory setting, so a site's own .user.ini file can turn it back on.

The takeaway is simple: a config tweak buys time, but only a patched PHP build closes both bugs.

How to Tell if Hackers Attacked Your Server Through PHP2Shell

Attack attempts started before the official patch went public, so look back further than the release date when you review logs. Watch for:

• PHP out-of-memory errors or repeated worker crashes that line up with odd requests
• Very large upload requests or requests with an unusual number of form fields
• Unusually long PHPSESSID values in server responses
• PHP worker processes like php-fpm, php-cgi, httpd, or apache2 launching shells (sh, bash, cmd.exe, powershell.exe), interpreters (python, perl), or download tools (curl, wget, nc)
• Quick recon commands such as whoami, id, or uname -a running from the web server
• New or changed files in your web root, fresh cron jobs, or new user accounts

If you find any of these, isolate the server, save your web and PHP logs, hunt for webshells, and rotate every password and API key the server could reach.

How to Stay Ahead of the Next PHP Security Bug

PHP2Shell shows how fast the security landscape now moves. AI helped researchers find a decade-old flaw in days, and attackers started probing within hours of the leak. The old habit of patching during a monthly maintenance window no longer fits.

For site owners, the practical fix is a routine: run a supported PHP branch, keep automatic security updates on where possible, and know exactly who patches your server. That routine will matter again the next time a core bug drops.

Frequently Asked Questions

Related Guides

• PHPhotosErrorDomain Error 3302 on iOS and Mac: How to Fix It
• How to Fix WordPress Gutenberg Editor Blank Screen Even When Plugins Are Disabled
• Leveraging PHP Enum Extensions: A Comprehensive Guide