On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities in the core of PHP, known together as PHP2Shell. Both are rated 9.2 (CVSS 4.0) and can be exploited by an unauthenticated remote attacker, in the worst case before any of your application's code runs. The PHP team asks everyone running PHP 8.2–8.5 to update immediately.
What the vulnerabilities are
- CVE-2026-109618 — running out of memory while PHP is setting up a request can leave internal data half-initialized. The cleanup that follows then treats that data as valid and works on invalid memory.
- CVE-2026-109619 — internal state that belongs to one request can outlive the memory behind it, and a later request on the same PHP worker can use it before it is reset.
Every way of serving PHP on the web is affected — PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed — together with every PHP version before the fixed releases. The risk is highest with Apache mod_php.
App Hosting: already patched
The App Hosting servers already run the fixed releases (8.2.35, 8.3.36 and 8.4.27), and PHP has been restarted for every account. You do not need to do anything. To see the version your account runs:
# over SSH, on your App Hosting account
php -vcPanel Hosting: already patched
On the cPanel Hosting servers the supported PHP versions run the fixed releases, and the older PHP versions that no longer get official releases run patched builds that include the fix. PHP has been restarted, so you do not need to do anything. If your site still runs PHP 8.1 or older, we still recommend switching it to a supported version in your cPanel.
Your own VPS: update now
On a VPS you manage PHP yourself. Install the security update from your distribution or PHP repository and restart PHP — workers that are still running keep using the old code until they restart. If PHP runs inside Apache (mod_php), restart Apache too.
# Rocky Linux, AlmaLinux, RHEL
dnf upgrade 'php*' && systemctl restart php-fpm
# Debian, Ubuntu
apt update && apt install --only-upgrade 'php*' && systemctl restart 'php*-fpm'Distributions often ship the fix as their own security update under the old version number, so check your distribution's advisory rather than only php -v. PHP 8.1 and older no longer receive official releases — if you still run one, plan the move to a supported version.
If you cannot update right away
The PHP team lists settings that reduce exposure. They do not make a server safe — updating is the only complete fix — but they close the confirmed attack paths of CVE-2026-109619:
; php.ini or the PHP-FPM pool, then restart every PHP worker
session.upload_progress.enabled = 0
fatal_error_backtraces = 0 ; PHP 8.5 onlySet them in php.ini or in the PHP-FPM pool configuration and restart every PHP worker; ini_set() and .user.ini files are not enough. If your sites do not use upload progress, keep session.upload_progress.enabled off even after updating.
Source: the PHP project's announcement and advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp.