PHP2Shell Vulnerabilities: Affected PHP Versions and How to Fix Them

Quick Answer

PHP2Shell refers to two critical vulnerabilities in the PHP runtime: CVE-2026-109618 and CVE-2026-109619. They can allow an attacker to execute code on a vulnerable web server without logging in. PHP released fixes on October 21, 2026, in 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Install a fixed release for your branch or a vendor-confirmed package containing both fixes.

If Hostinger sent you the message that your websites are protected, its announcement says the fix has been deployed to managed hosting. Hostinger VPS customers must update their own PHP installations. Updating WordPress or installing a security plugin does not replace updating the affected PHP runtime.

What Is the Actual PHP Problem?

PHP is software that runs website code on a server. These vulnerabilities involve PHP’s internal memory handling during request initialization, error handling, and cleanup. They are flaws in the runtime itself, rather than a single website application.

A worker is a server process that handles requests. A use-after-free occurs when software accesses memory after releasing it. Both vulnerabilities are rated 9.2, Critical, under CVSS v4.0.

Successful exploitation can run code with the permissions of the web worker account. This can expose application data or allow malicious changes; it does not automatically mean the attacker has administrator or root privileges. Exploitability depends on the PHP build, extensions, application behavior, and server configuration.

Why Is This a Worldwide Security Concern?

PHP is used across hosting services, content management systems, business applications, and embedded web interfaces. A runtime flaw can therefore affect unrelated products and organizations that share the same underlying technology.

The PHP security announcement identifies PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed as environments requiring attention. It identifies mod_php as particularly exposed, with a demonstrated attack occurring before application code executes. Application login checks cannot protect a processing stage that runs before those checks.

Amazon Threat Intelligence reported an exploitation attempt against its MadPot honeypot infrastructure dating to October 17, 2026, before public disclosure. This establishes that attack attempts occurred; it does not establish that every exposed website was compromised.

A website may continue working normally while vulnerable. Crashes, unexpected file changes, or unusual processes deserve investigation, but there is no single visible symptom that reliably identifies these flaws.

Which PHP Versions Are Affected or Fixed?

The following table describes standard upstream releases as of October 23, 2026. A vendor may separately backport the fixes into a package with an older PHP version number.

“Fixed” means these two vulnerabilities are addressed, not that the release is free of every security issue. Use the latest maintained patch release available through your trusted software provider.

PHP 8.4 and 8.5 remain under active upstream support on the verification date. PHP 8.2 and 8.3 receive security fixes only. For a planned migration, choose a maintained branch supported by your application and extensions.

The PHP team also provided exceptional minimal source backports for PHP 7.4, 8.0, and 8.1. These do not restore normal support for those branches. Most administrators should obtain a maintained vendor package or migrate instead of attempting an emergency source build.

Why an Older Version Number Can Still Be Patched

A backport applies a security fix to an older software release without adopting all changes from a newer release. Linux distributions and hosting providers may use this approach.

For a backported package, verify the complete package revision against the vendor’s security advisory for both CVE identifiers. A version-only scanner may need that evidence to resolve a finding. Neither an old-looking version nor a recent build date alone proves the patch status of an arbitrary installation.

What Does Hostinger’s “No Action Needed” Message Mean?

According to Hostinger’s announcement, updated October 22, its hosting servers were patched except for customer-managed VPS servers.

For its managed hosting, Hostinger gives this verification route:

1. Open Websites → Dashboard → PHP Info.
2. Check the Build Date.
3. Hostinger states that October 21, 2026 or later identifies its patched build.

This build-date rule is specific to Hostinger. Its PHP version number may remain unchanged because the fix was incorporated into the existing build.

The notification concerns these vulnerabilities. It does not replace routine application updates, backups, or investigation of suspicious activity.

How to Fix a Server You Manage

1. Identify Every PHP Runtime

Inventory the PHP versions used by websites, subdomains, hosting panels, containers, and application bundles. Check every server behind a load balancer. The PHP used in a terminal may differ from the PHP serving a website.

For a preliminary check, run these read-only commands in Linux or macOS Bash, or Windows PowerShell or Command Prompt, where PHP is available in the command search path. Administrator or root privileges are normally unnecessary.

php -v

This displays the selected PHP executable’s version and interface. Output marked cli identifies command-line PHP.

php --ini

This displays the configuration files loaded by command-line PHP. It does not establish which configuration PHP-FPM, Apache, or another web handler uses.

Verify the web runtime separately through the hosting panel or server configuration. Avoid leaving a publicly accessible PHP information page online because it can disclose configuration details.

2. Prepare for the Update

• Back up application files, databases, and relevant server configuration.
• Record the installed PHP package revisions, extensions, and website-to-runtime assignments.
• Check application compatibility, particularly before changing PHP branches.
• Plan for worker restarts and possible brief service interruption.

Where available, a patched package within the existing supported branch can reduce the compatibility work required for the immediate fix. Plan any larger migration separately.

3. Install a Verified Fixed Package

Use your operating system vendor, hosting panel, application vendor, or established PHP distribution channel. Confirm that its advisory explicitly covers both CVEs.

• Linux servers: Follow the distribution’s package-update instructions for the installed PHP packages and extensions.
• Windows servers: Update the PHP runtime used by the web server, retaining a compatible architecture, build type, and extension set.
• Containers: Rebuild using a patched PHP runtime and redeploy all affected instances. Updating the host does not replace PHP inside an existing container image.
• Bundled applications: Obtain the vendor’s corrected package if it includes a separate PHP runtime.

Package names, repositories, and service names vary. Use the instructions for the actual installation rather than applying a generic update command to an unidentified server.

4. Restart and Verify

With administrator, root, or equivalent platform permissions, restart or replace the affected PHP workers using the vendor-supported procedure. Replacing files on disk is insufficient if old processes continue serving requests.

1. Confirm that each website uses the patched runtime or documented backported package.
2. Confirm that all affected workers, containers, and server instances have been replaced or restarted.
3. Test login, forms, uploads, scheduled jobs, and checkout where applicable.
4. Review application and server logs for new errors.
5. Record the package revision, supporting advisory, and verification date.

What If an Immediate Update Is Not Possible?

No configuration workaround completely fixes both vulnerabilities. CERT-EU recommends considering isolation of affected internet-facing services until a patch is applied and verified.

One limited mitigation is to disable session upload progress in the web runtime’s effective php.ini:

session.upload_progress.enabled = Off

This requires permission to edit the server configuration and restart every affected worker. Save the original configuration first. The setting must apply before request parsing; do not rely on application-level ini_set() or PHP-FPM .user.ini files. It blocks confirmed session-related paths, but other vulnerable paths remain.

On PHP 8.5, the official guidance additionally identifies disabling fatal_error_backtraces as a partial mitigation for a confirmed path. It is not a complete fix either.

Firewall filtering and upload restrictions can reduce exposure. They cannot establish that an unpatched runtime is secure. Reassess temporary restrictions after patching and functional testing.

What If the Update Breaks the Website?

Check the application error log and confirm that required PHP extensions and settings are present. If a branch upgrade caused incompatibility, use another compatible, patched branch while correcting the application.

Do not restore an unpatched runtime to public service as the routine rollback. If recovery requires a vulnerable backup, keep the affected service isolated until PHP is patched again. Database restoration can discard newer transactions, so assess that separately before restoring an entire backup.

What If Compromise Is Suspected?

Patching closes the vulnerabilities but does not remove an attacker’s existing access or undo unauthorized changes.

Review unexpected file modifications, new processes, unfamiliar administrative accounts, and unusual requests. Preserve relevant logs and evidence, isolate affected systems where necessary, and involve your hosting provider or incident-response team. If compromise is confirmed, recover from a trusted state and replace exposed credentials after containment.

A security notification alone is not evidence that passwords were stolen. Equally, a working website or clean basic malware scan is not proof that exploitation never occurred.

Sources

• Hostinger: Protections against PHP2Shell vulnerabilities
• PHP: October 2026 security announcement and release notices
• PHP security advisory: CVE-2026-109618, remote code execution through out-of-memory corruption
• PHP security advisory: CVE-2026-109619, remote code execution through stale global state
• PHP: Supported versions and support deadlines
• PHP Manual: Command-line options
• CERT-EU: Critical vulnerabilities in PHP
• Amazon Threat Intelligence: PHP2Shell exploitation attempts before public disclosure