PHP2Shell: The Critical PHP Flaw That Can Hand Your Server to Hackers<\/title>\n<meta name=\"description\" content=\"Two critical PHP engine bugs (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution. Update PHP today.\">\n<style>.p2s{\n color-scheme:only light;\n --bg:#f6f7fb; --card:#ffffff; --text:#1c2333; --muted:#4b5568; --border:#d5dae6;\n --accent:#c81e34; --accent-soft:#fdecef; --brand:#1d4ed8; --brand-soft:#e8efff;\n --warn:#92400e; --warn-soft:#fff4e0; --ok:#15803d; --ok-soft:#e7f6ec;\n --code-bg:#0f172a; --code-text:#e2e8f0; --inline-code:#1e3a8a;\n}\n.p2s *{box-sizing:border-box}\n.p2s{margin:0;background:var(--bg);color:var(--text);\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif;\n line-height:1.7;font-size:17px}\n.p2s .wrap{width:100%;max-width:820px;margin:0 auto;padding:0 16px}\n.p2s header.hero{background:linear-gradient(135deg,#7f1020,#d6293e 60%,#ff7a45);color:#fff;padding:48px 0 40px}\n.p2s .tag{display:inline-block;background:rgba(255,255,255,.18);border-radius:999px;padding:4px 14px;font-size:.78rem;font-weight:700;letter-spacing:.06em;text-transform:uppercase}\n.p2s h1{font-size:clamp(1.7rem,5.5vw,2.8rem);line-height:1.2;margin:16px 0 12px;overflow-wrap:break-word}\n.p2s .meta{opacity:.9;font-size:.92rem}\n.p2s main{padding:28px 0 56px}\n.p2s section{margin-bottom:34px}\n.p2s h2{color:var(--text);font-size:clamp(1.3rem,3.6vw,1.7rem);line-height:1.3;margin:0 0 14px;padding-bottom:8px;border-bottom:2px solid var(--border)}\n.p2s h3{color:var(--text);font-size:1.1rem;margin:22px 0 8px}\n.p2s p{margin:0 0 14px}\n.p2s ul,.p2s ol{padding-left:22px;margin:0 0 14px}\n.p2s li{margin-bottom:8px}\n.p2s a{color:var(--brand)}\n.p2s .alert{color:var(--text);background:var(--accent-soft);border-left:5px solid var(--accent);border-radius:10px;padding:16px 18px;margin-bottom:22px}\n.p2s .alert strong.t{color:var(--accent)}\n.p2s .note strong,.p2s .good strong{color:inherit}\n.p2s label{cursor:pointer}\n.p2s .note{color:var(--text);background:var(--warn-soft);border-left:5px solid var(--warn);border-radius:10px;padding:14px 18px;margin:16px 0}\n.p2s .good{color:var(--text);background:var(--ok-soft);border-left:5px solid var(--ok);border-radius:10px;padding:14px 18px;margin:16px 0}\n.p2s .card{color:var(--text);background:var(--card);border:1px solid var(--border);border-radius:14px;padding:18px 20px;margin-bottom:16px}\n.p2s .grid{display:grid;grid-template-columns:repeat(2,1fr);gap:14px;margin-bottom:8px}\n.p2s .grid .card{margin:0}\n.p2s .grid .k{font-size:.76rem;font-weight:800;text-transform:uppercase;letter-spacing:.06em;color:var(--accent);margin-bottom:4px}\n.p2s .grid .card p{margin:0;font-size:.95rem}\n.p2s .table-wrap{overflow-x:auto;-webkit-overflow-scrolling:touch;border:1px solid var(--border);border-radius:12px;background:var(--card);margin:14px 0}\n.p2s table{border-collapse:collapse;width:100%;min-width:480px;font-size:.93rem}\n.p2s td{color:var(--text)}\n.p2s th,.p2s td{text-align:left;padding:11px 14px;border-bottom:1px solid var(--border);vertical-align:top}\n.p2s th{background:var(--brand-soft);color:var(--text);font-size:.78rem;text-transform:uppercase;letter-spacing:.05em}\n.p2s tr:last-child td{border-bottom:0}\n.p2s code{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:.88em;background:var(--brand-soft);color:var(--inline-code);padding:2px 6px;border-radius:5px;overflow-wrap:anywhere}\n.p2s pre{background:var(--code-bg);color:var(--code-text);padding:16px;border-radius:12px;overflow-x:auto;-webkit-overflow-scrolling:touch;font-size:.85rem;line-height:1.55;margin:10px 0 16px}\n.p2s pre code{background:none;padding:0;color:inherit;overflow-wrap:normal}\n.p2s .steps{list-style:none;padding:0;counter-reset:s}\n.p2s .steps li{color:var(--text);counter-increment:s;position:relative;background:var(--card);border:1px solid var(--border);border-radius:12px;padding:14px 16px 14px 56px}\n.p2s .steps li::before{content:counter(s);position:absolute;left:14px;top:14px;width:30px;height:30px;border-radius:50%;background:var(--accent);color:#fff;font-weight:800;display:flex;align-items:center;justify-content:center;font-size:.9rem}\n.p2s .timeline{list-style:none;padding:0;border-left:3px solid var(--border);margin-left:6px}\n.p2s .timeline li{position:relative;padding:0 0 16px 20px;margin:0}\n.p2s .timeline li::before{content:\"\";position:absolute;left:-9px;top:6px;width:15px;height:15px;border-radius:50%;background:var(--accent);border:3px solid var(--bg)}\n.p2s .timeline .d{font-weight:700;display:block}\n.p2s .checklist{list-style:none;padding:0}\n.p2s .checklist li{color:var(--text);display:flex;gap:10px;align-items:flex-start;background:var(--card);border:1px solid var(--border);border-radius:10px;padding:10px 14px}\n.p2s .checklist input{margin-top:6px;width:18px;height:18px;flex:none}\n.p2s .cta{background:linear-gradient(135deg,#1e3a8a,#1d4ed8);color:#fff;border-radius:16px;padding:26px 22px}\n.p2s .cta h2{border:0;color:#fff;padding:0}\n.p2s .cta ul{margin-bottom:16px}\n.p2s .cta a.btn{display:inline-block;background:#fff;color:#1e3a8a;font-weight:700;text-decoration:none;padding:11px 20px;border-radius:10px;margin:4px 8px 4px 0}\n.p2s .cta p.s{opacity:.92}\n.p2s footer{border-top:1px solid var(--border);padding:24px 0 40px;font-size:.9rem;color:var(--muted)}\n.p2s footer ul{padding-left:20px}\n.p2s footer strong{color:var(--text)}\n.p2s footer a{color:var(--brand)}\n.p2s .cta,.p2s .cta p,.p2s .cta li,.p2s .cta strong,.p2s .cta h2{color:#fff}\n.p2s .timeline li{color:var(--text)}\n.p2s .timeline li::before{border-color:var(--bg)}\n.p2s header.hero,.p2s header.hero h1,.p2s header.hero .meta,.p2s header.hero .tag{color:#fff}\n@media (max-width:640px){.p2s{font-size:16px}\n.p2s header.hero{padding:34px 0 28px}\n.p2s .grid{grid-template-columns:1fr}\n.p2s .card{padding:16px}\n.p2s .steps li{padding-left:52px}\n.p2s .cta{padding:22px 16px}\n.p2s .cta a.btn{display:block;text-align:center;margin:8px 0}\n.p2s th,.p2s td{padding:9px 10px}\n\n}\n@media print{.p2s header.hero{background:#fff;color:#000}\n.p2s .cta{background:#fff;color:#000;border:1px solid #000}\n.p2s .cta h2{color:#000}\n\n}\n\n\n\n.p2s{background:var(--bg);color:var(--text);font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif;line-height:1.7;font-size:17px;margin:0;padding:0;width:100%;overflow:hidden;position:relative;isolation:isolate;text-align:left}\n.p2s,.p2s *{box-sizing:border-box}\n.p2s a{text-decoration:underline}\n.p2s p,.p2s ul,.p2s ol,.p2s h1,.p2s h2,.p2s h3{max-width:none}\n.p2s h1,.p2s h2,.p2s h3{font-weight:700;letter-spacing:normal;text-transform:none}\n.p2s .alert{margin:0 0 24px;padding:20px 22px}\n.p2s .alert strong.t{display:block;font-size:1.15em;margin-bottom:8px}\n.p2s header.hero{margin:0}\n.p2s .cta p.s{opacity:1}\n\n\/* Text colours are locked with !important so a host theme's p\/li\/h2\/a rules can never override them *\/\n.p2s :where(p,li,ul,ol,td,th,tr,table,h1,h2,h3,span,strong,em,label,div,small,b,i){color:inherit!important}\n.p2s a{color:var(--brand)!important}\n.p2s code{color:var(--inline-code)!important}\n.p2s pre,.p2s pre code{color:var(--code-text)!important}\n.p2s .alert strong.t,.p2s .grid .k{color:var(--accent)!important}\n.p2s footer{color:var(--muted)!important}\n.p2s footer strong{color:var(--text)!important}\n.p2s footer a{color:var(--brand)!important}\n.p2s header.hero,.p2s header.hero *{color:#fff!important}\n.p2s .cta,.p2s .cta *{color:#fff!important}\n.p2s .cta a.btn{color:#1e3a8a!important;background:#fff!important}\n.p2s main.wrap{padding:40px 16px 56px}\n.p2s .steps li::before{color:#fff!important}\n\n\/* Sources + contact links *\/\n.p2s footer{background:var(--bg)!important;border-top:1px solid var(--border);padding:32px 0 44px}\n.p2s footer .src-title{color:var(--text)!important;font-size:1.25rem;margin:0 0 14px;padding:0;border:0}\n.p2s footer ul{list-style:none;padding:0;margin:0}\n.p2s footer li{margin:0 0 10px;padding:12px 14px 12px 16px;background:var(--card);border:1px solid var(--border);border-left:4px solid var(--brand);border-radius:10px;font-size:.95rem;line-height:1.45;color:var(--text)!important}\n.p2s footer li a{color:var(--brand)!important;text-decoration:underline;text-underline-offset:3px;overflow-wrap:anywhere;word-break:break-word}\n.p2s footer li a:hover{text-decoration-thickness:2px}\n.p2s .cta a.lnk{color:#fff!important;font-weight:700;text-decoration:underline;text-underline-offset:3px;overflow-wrap:anywhere}\n.p2s .cta a.btn{text-decoration:none}\n<\/style>\n<\/head>\n<body>\n<div class=\"p2s\" id=\"p2s\">\n\n<header class=\"hero\">\n <div class=\"wrap\">\n <span class=\"tag\">Security Advisory<\/span>\n <h1>PHP2Shell: The Critical PHP Flaw That Can Hand Your Server to Hackers<\/h1>\n <\/div>\n<\/header>\n\n<main class=\"wrap\">\n\n<section>\n <div class=\"alert\">\n <strong class=\"t\">Update PHP on your server today.<\/strong>\n On 21 October 2026 the PHP team shipped emergency fixes for two critical flaws, nicknamed <strong>PHP2Shell<\/strong>, that let an attacker run their own code on your server without logging in. Attacks were already seen in the wild hours before the fix came out.\n <\/div>\n <p>If your website, online store or web app runs on PHP, this affects you.<\/p>\n\n <h3>In short<\/h3>\n <div class=\"grid\">\n <div class=\"card\"><div class=\"k\">What<\/div><p>Two bugs in the PHP engine itself: CVE-2026-109618 and CVE-2026-109619.<\/p><\/div>\n <div class=\"card\"><div class=\"k\">Who<\/div><p>Almost every PHP website, including Magento, WooCommerce, WordPress, Laravel, Drupal and Joomla, even if your own code is perfectly clean.<\/p><\/div>\n <div class=\"card\"><div class=\"k\">Risk<\/div><p>Full server takeover, plus silent leaks of passwords, API keys and session tokens from server memory.<\/p><\/div>\n <div class=\"card\"><div class=\"k\">Fix<\/div><p>Upgrade to PHP <strong>8.5.12, 8.4.27, 8.3.36 or 8.2.35<\/strong>, then restart PHP. Nothing in your app code can fix this.<\/p><\/div>\n <\/div>\n <p>Can’t patch this hour? Use the <a href=\"#stopgaps\">temporary mitigations below<\/a>, and talk to us.<\/p>\n<\/section>\n\n<section id=\"what\">\n <h2>What is PHP2Shell?<\/h2>\n <p>PHP2Shell is the name for two memory-safety bugs in the core PHP engine, the software that runs underneath your website. Because the flaw sits in PHP itself, a store with flawless code is still exposed.<\/p>\n <div class=\"table-wrap\">\n <table>\n <thead><tr><th>CVE<\/th><th>Type of bug<\/th><th>What an attacker gets<\/th><\/tr><\/thead>\n <tbody>\n <tr><td><code>CVE-2026-109618<\/code><\/td><td>Use-after-free in the session upload-progress handler<\/td><td>Remote code execution, plus leaking of server memory<\/td><\/tr>\n <tr><td><code>CVE-2026-109619<\/code><\/td><td>Use-after-free in fatal-error handling, and OPcache type confusion<\/td><td>Remote code execution<\/td><\/tr>\n <\/tbody>\n <\/table>\n <\/div>\n <p>The PHP security team rates both at <strong>9.2 out of 10<\/strong> (CVSS v4.0), and the US NVD scores them <strong>9.8<\/strong> (CVSS v3.1). The researchers at Wiz, Calif and OpenAI who found them call these some of the most serious PHP bugs ever disclosed.<\/p>\n <div class=\"card\">\n <strong>In plain English:<\/strong> when a PHP request runs out of memory and crashes, PHP fails to clean up after itself. It leaves behind pointers to memory it has already freed. The next request handled by the same PHP worker trusts those stale pointers. An attacker who controls what fills that freed memory can make PHP read or run whatever they want.\n <\/div>\n<\/section>\n\n<section id=\"affected\">\n <h2>Who is affected?<\/h2>\n <p>Almost everyone running PHP on a web server. The vulnerable code goes back to PHP 5.4, released in 2012, and the default configuration is exploitable.<\/p>\n <ul>\n <li>Every PHP version before <strong>8.5.12, 8.4.27, 8.3.36 and 8.2.35<\/strong>.<\/li>\n <li>PHP 8.1, 8.0, 7.x and older get no official release. They stay vulnerable unless your host, Linux distribution or an LTS vendor backports the fix.<\/li>\n <li>Both common setups: Apache with <code>mod_php<\/code> and Nginx\/Apache with PHP-FPM. PHP flags <code>mod_php<\/code> as the highest-risk setup.<\/li>\n <li>Every PHP application. Researchers proved login-free takeover on Magento 2.4.9, WordPress, Drupal, Joomla, Laravel 13, Symfony 8, Nextcloud, phpMyAdmin, Roundcube, MediaWiki and WHMCS. WooCommerce and Shopware stores are exposed too.<\/li>\n <\/ul>\n <div class=\"good\">If you are on Shopify or BigCommerce, the platform runs the servers for you, so your storefront is not affected. Any custom PHP app, middleware or admin panel you host yourself still is.<\/div>\n<\/section>\n\n<section id=\"attack\">\n <h2>How PHP2Shell takes control of your server<\/h2>\n <p>The attack needs no login, no plugin bug and no admin access. It only needs your server to accept a file-upload style request, which every PHP site does by default.<\/p>\n <p><em>The attack chain: 4 steps, 2 outcomes. The same crash can be used two ways: to leak secrets from memory, or to run the attacker’s code. The leak often feeds the takeover.<\/em><\/p>\n <ol class=\"steps\">\n <li><strong>The attacker sends a crafted upload request.<\/strong> It is a <code>multipart\/form-data<\/code> POST, the same format a browser uses to upload a file. PHP reads it before your application code even starts.<\/li>\n <li><strong>PHP is pushed past its memory limit.<\/strong> The request is built to hit <code>memory_limit<\/code> at exactly the wrong moment, so PHP aborts with a fatal error.<\/li>\n <li><strong>PHP leaves stale pointers behind.<\/strong> The crash frees the request’s memory but forgets to reset some internal state, such as the session upload-progress data or the last error backtrace.<\/li>\n <li><strong>The next request reuses the poisoned worker.<\/strong> PHP-FPM and <code>mod_php<\/code> reuse worker processes. The attacker’s follow-up requests land in the same worker and fill the freed memory with data they control.<\/li>\n <li><strong>PHP treats attacker data as its own.<\/strong> This corrupts memory in a controlled way. Combined with the memory leak below, the attacker learns the exact memory layout and turns the corruption into running their own code.<\/li>\n <\/ol>\n\n <h3>The Heartbleed-style leak<\/h3>\n <p>CVE-2026-109618 can also be used on its own to read your server’s memory. PHP sends chunks of freed memory back to the attacker inside a <code>PHPSESSID<\/code> cookie, even if your app never uses sessions. That memory can hold other customers’ passwords, session tokens, payment-gateway API keys, database credentials and even TLS private keys.<\/p>\n\n <h3>What an attacker does once inside<\/h3>\n <p>Code running as your web user typically means:<\/p>\n <ul>\n <li>A web shell or backdoor that survives even after you patch.<\/li>\n <li>Card skimmers (Magecart) injected into checkout pages.<\/li>\n <li>Theft of the customer database, admin accounts and <code>env.php<\/code> \/ <code>.env<\/code> secrets.<\/li>\n <li>Defacement, SEO spam, crypto-miners or ransomware, and a foothold to attack other sites on the same server.<\/li>\n <\/ul>\n<\/section>\n\n<section id=\"urgent\">\n <h2>Why this one is so urgent<\/h2>\n <p>Attackers started before the patch existed, and a ready-made exploit tool is now public. Expect mass, automated scanning of every PHP site on the internet in the coming days.<\/p>\n <ul>\n <li><strong>It leaked early.<\/strong> Details went public on 20 October, two days ahead of the planned disclosure.<\/li>\n <li><strong>Attacks began before the fix.<\/strong> Cloudflare saw exploitation at 07:43 UTC on 21 October, more than six hours before PHP released patches.<\/li>\n <li><strong>A one-shot exploit tool exists.<\/strong> The <code>php2shell<\/code> tool chains both bugs into a single login-free attack.<\/li>\n <li><strong>AI made it practical.<\/strong> Wiz says frontier AI models let one researcher build and adapt working exploits in days instead of months. Attackers have the same tools.<\/li>\n <li><strong>Huge reach.<\/strong> PHP powers roughly 70% of websites, per Wiz.<\/li>\n <\/ul>\n\n <h3>Timeline (UTC)<\/h3>\n <ul class=\"timeline\">\n <li><span class=\"d\">11 Aug 2026<\/span>Calif reports the first bug to PHP<\/li>\n <li><span class=\"d\">24 Aug 2026<\/span>Wiz Research reports the bugs to PHP<\/li>\n <li><span class=\"d\">20 Oct 2026<\/span>Details leak; PHP announces an emergency release<\/li>\n <li><span class=\"d\">21 Oct 2026, 07:43<\/span>Cloudflare reports the first attacks<\/li>\n <li><span class=\"d\">21 Oct 2026, 14:00<\/span>PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35<\/li>\n <\/ul>\n<\/section>\n\n<section id=\"fix\">\n <h2>The fix: update PHP and restart it<\/h2>\n <p>The only complete fix is a patched PHP build on the server. No Magento patch, WordPress plugin or firewall rule inside your app can fix it, because the bug triggers before your code runs.<\/p>\n <div class=\"table-wrap\">\n <table>\n <thead><tr><th>Your PHP branch<\/th><th>Update to<\/th><th>Official support<\/th><\/tr><\/thead>\n <tbody>\n <tr><td>8.5<\/td><td><strong>8.5.12<\/strong><\/td><td>Yes<\/td><\/tr>\n <tr><td>8.4<\/td><td><strong>8.4.27<\/strong><\/td><td>Yes<\/td><\/tr>\n <tr><td>8.3<\/td><td><strong>8.3.36<\/strong><\/td><td>Yes<\/td><\/tr>\n <tr><td>8.2<\/td><td><strong>8.2.35<\/strong><\/td><td>Yes, security fixes only<\/td><\/tr>\n <tr><td>8.1, 8.0, 7.4<\/td><td>No official release<\/td><td>Source backports only; upgrade or use a vendor backport<\/td><\/tr>\n <\/tbody>\n <\/table>\n <\/div>\n\n <h3>Shared hosting or cPanel\/Plesk<\/h3>\n <p>Ask your host to confirm the patched PHP build is live for your account. Then use the PHP selector to move off 8.1 or older.<\/p>\n\n <h3>Ubuntu \/ Debian VPS<\/h3>\n <p>Update packages from your distribution or the Ond\u0159ej Sur\u00fd (sury.org) repository, which also backports to old branches. Then restart every PHP-FPM pool:<\/p>\n<pre><code>sudo apt update && sudo apt upgrade\nsudo systemctl restart php8.3-fpm # repeat for each installed version\nsudo systemctl reload nginx # or: sudo systemctl restart apache2<\/code><\/pre>\n\n <h3>RHEL \/ AlmaLinux \/ Rocky<\/h3>\n <p>If you use Remi’s repository, its update was not ready on 21 October. Switch to your distribution’s PHP packages or build from source until it is.<\/p>\n\n <h3>Laravel Forge, Docker and managed platforms<\/h3>\n <p>On Forge, upgrade PHP from the server panel, then restart queues and Horizon. For containers, pull the patched official <code>php<\/code> image, rebuild and redeploy every service.<\/p>\n\n <div class=\"note\">\n <strong>Check it really worked.<\/strong> <code>php -v<\/code> only shows the command-line PHP, not the one serving your site. Confirm the version from a page served by PHP-FPM, for example a temporary <code>phpinfo()<\/code> page you delete straight after. Distribution packages may keep an older version number with the fix backported, so check the package changelog for the two CVE numbers.\n <\/div>\n<\/section>\n\n<section id=\"stopgaps\">\n <h2>Can’t patch right now? Buy time with these stopgaps<\/h2>\n <p>These steps reduce risk for a few hours or days. They are <strong>not a fix<\/strong>, and you should remove them once PHP is updated.<\/p>\n\n <h3>1. Block upload-style requests at the web server<\/h3>\n <p>Every known trigger is a <code>multipart\/form-data<\/code> request. Blocking it stops the attack, but also breaks file uploads (such as product images in the Magento admin) and some checkout forms. Place a test order after adding it.<\/p>\n <p><strong>Nginx<\/strong>, inside each <code>server<\/code> block that passes requests to PHP:<\/p>\n<pre><code>if ($http_content_type ~* \"multipart\/form-data\") {\n return 403;\n}<\/code><\/pre>\n <p><strong>Apache<\/strong>, inside each <code><VirtualHost><\/code> that serves PHP:<\/p>\n<pre><code>RewriteEngine On\nRewriteCond %{HTTP:Content-Type} multipart\/form-data [NC]\nRewriteRule ^ - [F]<\/code><\/pre>\n <p>If you use Cloudflare, a WAF rule that blocks multipart requests to your PHP paths does the same job at the edge.<\/p>\n\n <h3>2. Go read-only or offline<\/h3>\n <p>Allowing only GET and HEAD requests keeps your catalogue browsable while blocking logins and orders. For full safety, stop PHP-FPM and serve a static maintenance page. The built-in maintenance modes in Magento and WordPress do not help, because PHP parses the request before they kick in.<\/p>\n\n <h3>3. Adjust PHP settings (partial only)<\/h3>\n <p>Set <code>session.upload_progress.enabled = 0<\/code> and <code>memory_limit = -1<\/code> for every PHP-FPM pool, then reload PHP-FPM. On its own this is not enough, and an unlimited memory limit lets one request eat all server RAM, so watch memory closely.<\/p>\n<\/section>\n\n<section id=\"hit\">\n <h2>Think you were already hit? What to check after patching<\/h2>\n <p>Patching closes the door, but it does not remove anyone already inside. If your server was exposed after 20 October, assume your secrets may have leaked and check for intruders.<\/p>\n\n <h3>Warning signs in your logs<\/h3>\n <ul>\n <li>Bursts of <code>multipart\/form-data<\/code> POST requests followed by “Allowed memory size exhausted” errors or repeated HTTP 500 responses.<\/li>\n <li>Unusually large or garbled <code>PHPSESSID<\/code> cookies in responses.<\/li>\n <li>PHP-FPM workers crashing or restarting more often than normal.<\/li>\n <li>New or recently modified PHP files you did not upload, unknown admin users, or new cron jobs.<\/li>\n <li>Changed checkout or payment templates, or unfamiliar JavaScript on checkout pages.<\/li>\n <\/ul>\n\n <h3>After patching, do this<\/h3>\n <ul>\n <li><strong>Rotate secrets.<\/strong> Change database passwords, payment-gateway and API keys, admin passwords and encryption keys stored in <code>env.php<\/code> or <code>.env<\/code>. The memory leak could have exposed them.<\/li>\n <li><strong>Log everyone out.<\/strong> Invalidate active sessions for admins and customers.<\/li>\n <li>Consider reissuing your TLS certificate if the server holds its own private key.<\/li>\n <li><strong>Scan for malware and backdoors.<\/strong> Compare files against a clean release and check for web shells and skimmers.<\/li>\n <li>Review admin accounts, SSH keys and cron jobs for anything you did not add.<\/li>\n <\/ul>\n<\/section>\n\n<section id=\"checklist\">\n <h2>Your PHP2Shell checklist<\/h2>\n <ul class=\"checklist\">\n <li><input type=\"checkbox\" id=\"c1\"><label for=\"c1\">Find every server, staging site and container that runs PHP<\/label><\/li>\n <li><input type=\"checkbox\" id=\"c2\"><label for=\"c2\">Update each one to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a confirmed vendor backport)<\/label><\/li>\n <li><input type=\"checkbox\" id=\"c3\"><label for=\"c3\">Restart PHP-FPM \/ Apache and confirm the version from a live web request<\/label><\/li>\n <li><input type=\"checkbox\" id=\"c4\"><label for=\"c4\">Plan an upgrade for anything still on PHP 8.1 or older<\/label><\/li>\n <li><input type=\"checkbox\" id=\"c5\"><label for=\"c5\">Remove temporary multipart blocks and restore <code>memory_limit<\/code><\/label><\/li>\n <li><input type=\"checkbox\" id=\"c6\"><label for=\"c6\">Rotate passwords, API keys and encryption keys<\/label><\/li>\n <li><input type=\"checkbox\" id=\"c7\"><label for=\"c7\">Scan for web shells, skimmers and unknown admin users<\/label><\/li>\n <\/ul>\n<\/section>\n\n<section class=\"cta\" id=\"help\">\n <h2>Need an expert to handle it? Talk to Unwavering Technology<\/h2>\n <p>If you’d rather not touch a live production server yourself, our team can patch, verify and clean up for you.<\/p>\n <p>We have been building and maintaining PHP, Laravel, Magento 2 and WooCommerce sites for over 12 years, for businesses in India, the Gulf, the UK and the US. For PHP2Shell we offer:<\/p>\n <ul>\n <li><strong>Emergency patching:<\/strong> PHP upgraded on every server and container, with downtime kept to minutes.<\/li>\n <li><strong>Safe upgrades from old PHP:<\/strong> moving Magento, Laravel or WordPress off PHP 8.1 or older and testing that checkout, admin and integrations still work.<\/li>\n <li><strong>Compromise check:<\/strong> log review, malware and web-shell scan, and checkout skimmer check.<\/li>\n <li><strong>Secret rotation and hardening:<\/strong> new keys and passwords, Cloudflare\/WAF rules and server hardening so the next vulnerability hits a tougher target.<\/li>\n <\/ul>\n <p class=\"s\"><strong>Get your server checked today:<\/strong> email us at <a class=\"lnk\" href=\"mailto:sales@unwaveringtechnology.com\">sales@unwaveringtechnology.com<\/a>, message us on WhatsApp at <a class=\"lnk\" href=\"tel:+919872592099\">+91 9872592099<\/a>, or book a call. Tell us your platform and hosting provider, and we’ll reply with a plan and a quote.<\/p>\n <a class=\"btn\" href=\"mailto:sales@unwaveringtechnology.com\">Email us<\/a>\n <a class=\"btn\" href=\"https:\/\/wa.me\/919872592099\" target=\"_blank\" rel=\"noopener noreferrer\">WhatsApp<\/a>\n<\/section>\n\n<\/main>\n\n<footer>\n <div class=\"wrap\">\n <h2 class=\"src-title\">Sources<\/h2>\n <ul>\n <li><a href=\"https:\/\/sansec.io\/research\/php2shell\" target=\"_blank\" rel=\"noopener noreferrer\">Sansec: PHP2Shell, critical PHP RCE<\/a><\/li>\n <li><a href=\"https:\/\/www.wiz.io\/blog\/php2shell-php-rce\" target=\"_blank\" rel=\"noopener noreferrer\">Wiz Research: PHP2Shell technical write-up<\/a><\/li>\n <li><a href=\"https:\/\/laravel.com\/forge\/docs\/knowledge-base\/php-security-release-october-2026\" target=\"_blank\" rel=\"noopener noreferrer\">Laravel Forge: PHP security advisory, October 2026<\/a><\/li>\n <li><a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/21\/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619\/\" target=\"_blank\" rel=\"noopener noreferrer\">Help Net Security: PHP2Shell patched, update now<\/a><\/li>\n <li><a href=\"https:\/\/www.tenable.com\/blog\/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote\" target=\"_blank\" rel=\"noopener noreferrer\">Tenable: PHP2Shell FAQ<\/a><\/li>\n <li><a href=\"https:\/\/www.codeable.io\/blog\/php-vulnerability-cve-2026-109618\/\" target=\"_blank\" rel=\"noopener noreferrer\">Codeable: what WordPress site owners need to do<\/a><\/li>\n <\/ul>\n <\/div>\n<\/footer>\n\n\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>PHP2Shell: The Critical PHP Flaw That Can Hand Your Server to Hackers Security Advisory PHP2Shell: The Critical PHP Flaw That Can Hand Your Server to Hackers Update PHP on your server today. On 21 October 2026 the PHP team shipped emergency fixes for two critical flaws, nicknamed PHP2Shell, that let an attacker run their own […]<\/p>\n","protected":false},"author":2,"featured_media":1538,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1540","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-how-online-businesess-grow-online-in-punjab"],"_links":{"self":[{"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/posts\/1540","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/comments?post=1540"}],"version-history":[{"count":3,"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/posts\/1540\/revisions"}],"predecessor-version":[{"id":1544,"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/posts\/1540\/revisions\/1544"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/media\/1538"}],"wp:attachment":[{"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/media?parent=1540"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/categories?post=1540"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/tags?post=1540"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":1540,"date":"2026-10-21T19:53:15","date_gmt":"2026-10-21T19:53:15","guid":{"rendered":"https:\/\/unwaveringtechnology.com\/blog\/?p=1540"},"modified":"2026-10-21T20:17:49","modified_gmt":"2026-10-21T20:17:49","slug":"php2shell-the-critical-php-flaw-that-can-hand-your-server-to-hackers","status":"publish","type":"post","link":"https:\/\/unwaveringtechnology.com\/blog\/php2shell-the-critical-php-flaw-that-can-hand-your-server-to-hackers\/","title":{"rendered":"PHP2Shell: The Critical PHP Flaw That Can Hand Your Server to Hackers"},"content":{"rendered":"\n\n\n\n\n\n\nPHP2Shell: The Critical PHP Flaw That Can Hand Your Server to Hackers<\/title>\n<meta name=\"description\" content=\"Two critical PHP engine bugs (CVE-2026-109618 and CVE-2026-109619) allow unauthenticated remote code execution. Update PHP today.\">\n<style>.p2s{\n color-scheme:only light;\n --bg:#f6f7fb; --card:#ffffff; --text:#1c2333; --muted:#4b5568; --border:#d5dae6;\n --accent:#c81e34; --accent-soft:#fdecef; --brand:#1d4ed8; --brand-soft:#e8efff;\n --warn:#92400e; --warn-soft:#fff4e0; --ok:#15803d; --ok-soft:#e7f6ec;\n --code-bg:#0f172a; --code-text:#e2e8f0; --inline-code:#1e3a8a;\n}\n.p2s *{box-sizing:border-box}\n.p2s{margin:0;background:var(--bg);color:var(--text);\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif;\n line-height:1.7;font-size:17px}\n.p2s .wrap{width:100%;max-width:820px;margin:0 auto;padding:0 16px}\n.p2s header.hero{background:linear-gradient(135deg,#7f1020,#d6293e 60%,#ff7a45);color:#fff;padding:48px 0 40px}\n.p2s .tag{display:inline-block;background:rgba(255,255,255,.18);border-radius:999px;padding:4px 14px;font-size:.78rem;font-weight:700;letter-spacing:.06em;text-transform:uppercase}\n.p2s h1{font-size:clamp(1.7rem,5.5vw,2.8rem);line-height:1.2;margin:16px 0 12px;overflow-wrap:break-word}\n.p2s .meta{opacity:.9;font-size:.92rem}\n.p2s main{padding:28px 0 56px}\n.p2s section{margin-bottom:34px}\n.p2s h2{color:var(--text);font-size:clamp(1.3rem,3.6vw,1.7rem);line-height:1.3;margin:0 0 14px;padding-bottom:8px;border-bottom:2px solid var(--border)}\n.p2s h3{color:var(--text);font-size:1.1rem;margin:22px 0 8px}\n.p2s p{margin:0 0 14px}\n.p2s ul,.p2s ol{padding-left:22px;margin:0 0 14px}\n.p2s li{margin-bottom:8px}\n.p2s a{color:var(--brand)}\n.p2s .alert{color:var(--text);background:var(--accent-soft);border-left:5px solid var(--accent);border-radius:10px;padding:16px 18px;margin-bottom:22px}\n.p2s .alert strong.t{color:var(--accent)}\n.p2s .note strong,.p2s .good strong{color:inherit}\n.p2s label{cursor:pointer}\n.p2s .note{color:var(--text);background:var(--warn-soft);border-left:5px solid var(--warn);border-radius:10px;padding:14px 18px;margin:16px 0}\n.p2s .good{color:var(--text);background:var(--ok-soft);border-left:5px solid var(--ok);border-radius:10px;padding:14px 18px;margin:16px 0}\n.p2s .card{color:var(--text);background:var(--card);border:1px solid var(--border);border-radius:14px;padding:18px 20px;margin-bottom:16px}\n.p2s .grid{display:grid;grid-template-columns:repeat(2,1fr);gap:14px;margin-bottom:8px}\n.p2s .grid .card{margin:0}\n.p2s .grid .k{font-size:.76rem;font-weight:800;text-transform:uppercase;letter-spacing:.06em;color:var(--accent);margin-bottom:4px}\n.p2s .grid .card p{margin:0;font-size:.95rem}\n.p2s .table-wrap{overflow-x:auto;-webkit-overflow-scrolling:touch;border:1px solid var(--border);border-radius:12px;background:var(--card);margin:14px 0}\n.p2s table{border-collapse:collapse;width:100%;min-width:480px;font-size:.93rem}\n.p2s td{color:var(--text)}\n.p2s th,.p2s td{text-align:left;padding:11px 14px;border-bottom:1px solid var(--border);vertical-align:top}\n.p2s th{background:var(--brand-soft);color:var(--text);font-size:.78rem;text-transform:uppercase;letter-spacing:.05em}\n.p2s tr:last-child td{border-bottom:0}\n.p2s code{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:.88em;background:var(--brand-soft);color:var(--inline-code);padding:2px 6px;border-radius:5px;overflow-wrap:anywhere}\n.p2s pre{background:var(--code-bg);color:var(--code-text);padding:16px;border-radius:12px;overflow-x:auto;-webkit-overflow-scrolling:touch;font-size:.85rem;line-height:1.55;margin:10px 0 16px}\n.p2s pre code{background:none;padding:0;color:inherit;overflow-wrap:normal}\n.p2s .steps{list-style:none;padding:0;counter-reset:s}\n.p2s .steps li{color:var(--text);counter-increment:s;position:relative;background:var(--card);border:1px solid var(--border);border-radius:12px;padding:14px 16px 14px 56px}\n.p2s .steps li::before{content:counter(s);position:absolute;left:14px;top:14px;width:30px;height:30px;border-radius:50%;background:var(--accent);color:#fff;font-weight:800;display:flex;align-items:center;justify-content:center;font-size:.9rem}\n.p2s .timeline{list-style:none;padding:0;border-left:3px solid var(--border);margin-left:6px}\n.p2s .timeline li{position:relative;padding:0 0 16px 20px;margin:0}\n.p2s .timeline li::before{content:\"\";position:absolute;left:-9px;top:6px;width:15px;height:15px;border-radius:50%;background:var(--accent);border:3px solid var(--bg)}\n.p2s .timeline .d{font-weight:700;display:block}\n.p2s .checklist{list-style:none;padding:0}\n.p2s .checklist li{color:var(--text);display:flex;gap:10px;align-items:flex-start;background:var(--card);border:1px solid var(--border);border-radius:10px;padding:10px 14px}\n.p2s .checklist input{margin-top:6px;width:18px;height:18px;flex:none}\n.p2s .cta{background:linear-gradient(135deg,#1e3a8a,#1d4ed8);color:#fff;border-radius:16px;padding:26px 22px}\n.p2s .cta h2{border:0;color:#fff;padding:0}\n.p2s .cta ul{margin-bottom:16px}\n.p2s .cta a.btn{display:inline-block;background:#fff;color:#1e3a8a;font-weight:700;text-decoration:none;padding:11px 20px;border-radius:10px;margin:4px 8px 4px 0}\n.p2s .cta p.s{opacity:.92}\n.p2s footer{border-top:1px solid var(--border);padding:24px 0 40px;font-size:.9rem;color:var(--muted)}\n.p2s footer ul{padding-left:20px}\n.p2s footer strong{color:var(--text)}\n.p2s footer a{color:var(--brand)}\n.p2s .cta,.p2s .cta p,.p2s .cta li,.p2s .cta strong,.p2s .cta h2{color:#fff}\n.p2s .timeline li{color:var(--text)}\n.p2s .timeline li::before{border-color:var(--bg)}\n.p2s header.hero,.p2s header.hero h1,.p2s header.hero .meta,.p2s header.hero .tag{color:#fff}\n@media (max-width:640px){.p2s{font-size:16px}\n.p2s header.hero{padding:34px 0 28px}\n.p2s .grid{grid-template-columns:1fr}\n.p2s .card{padding:16px}\n.p2s .steps li{padding-left:52px}\n.p2s .cta{padding:22px 16px}\n.p2s .cta a.btn{display:block;text-align:center;margin:8px 0}\n.p2s th,.p2s td{padding:9px 10px}\n\n}\n@media print{.p2s header.hero{background:#fff;color:#000}\n.p2s .cta{background:#fff;color:#000;border:1px solid #000}\n.p2s .cta h2{color:#000}\n\n}\n\n\n\n.p2s{background:var(--bg);color:var(--text);font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Roboto,Helvetica,Arial,sans-serif;line-height:1.7;font-size:17px;margin:0;padding:0;width:100%;overflow:hidden;position:relative;isolation:isolate;text-align:left}\n.p2s,.p2s *{box-sizing:border-box}\n.p2s a{text-decoration:underline}\n.p2s p,.p2s ul,.p2s ol,.p2s h1,.p2s h2,.p2s h3{max-width:none}\n.p2s h1,.p2s h2,.p2s h3{font-weight:700;letter-spacing:normal;text-transform:none}\n.p2s .alert{margin:0 0 24px;padding:20px 22px}\n.p2s .alert strong.t{display:block;font-size:1.15em;margin-bottom:8px}\n.p2s header.hero{margin:0}\n.p2s .cta p.s{opacity:1}\n\n\/* Text colours are locked with !important so a host theme's p\/li\/h2\/a rules can never override them *\/\n.p2s :where(p,li,ul,ol,td,th,tr,table,h1,h2,h3,span,strong,em,label,div,small,b,i){color:inherit!important}\n.p2s a{color:var(--brand)!important}\n.p2s code{color:var(--inline-code)!important}\n.p2s pre,.p2s pre code{color:var(--code-text)!important}\n.p2s .alert strong.t,.p2s .grid .k{color:var(--accent)!important}\n.p2s footer{color:var(--muted)!important}\n.p2s footer strong{color:var(--text)!important}\n.p2s footer a{color:var(--brand)!important}\n.p2s header.hero,.p2s header.hero *{color:#fff!important}\n.p2s .cta,.p2s .cta *{color:#fff!important}\n.p2s .cta a.btn{color:#1e3a8a!important;background:#fff!important}\n.p2s main.wrap{padding:40px 16px 56px}\n.p2s .steps li::before{color:#fff!important}\n\n\/* Sources + contact links *\/\n.p2s footer{background:var(--bg)!important;border-top:1px solid var(--border);padding:32px 0 44px}\n.p2s footer .src-title{color:var(--text)!important;font-size:1.25rem;margin:0 0 14px;padding:0;border:0}\n.p2s footer ul{list-style:none;padding:0;margin:0}\n.p2s footer li{margin:0 0 10px;padding:12px 14px 12px 16px;background:var(--card);border:1px solid var(--border);border-left:4px solid var(--brand);border-radius:10px;font-size:.95rem;line-height:1.45;color:var(--text)!important}\n.p2s footer li a{color:var(--brand)!important;text-decoration:underline;text-underline-offset:3px;overflow-wrap:anywhere;word-break:break-word}\n.p2s footer li a:hover{text-decoration-thickness:2px}\n.p2s .cta a.lnk{color:#fff!important;font-weight:700;text-decoration:underline;text-underline-offset:3px;overflow-wrap:anywhere}\n.p2s .cta a.btn{text-decoration:none}\n<\/style>\n<\/head>\n<body>\n<div class=\"p2s\" id=\"p2s\">\n\n<header class=\"hero\">\n <div class=\"wrap\">\n <span class=\"tag\">Security Advisory<\/span>\n <h1>PHP2Shell: The Critical PHP Flaw That Can Hand Your Server to Hackers<\/h1>\n <\/div>\n<\/header>\n\n<main class=\"wrap\">\n\n<section>\n <div class=\"alert\">\n <strong class=\"t\">Update PHP on your server today.<\/strong>\n On 21 October 2026 the PHP team shipped emergency fixes for two critical flaws, nicknamed <strong>PHP2Shell<\/strong>, that let an attacker run their own code on your server without logging in. Attacks were already seen in the wild hours before the fix came out.\n <\/div>\n <p>If your website, online store or web app runs on PHP, this affects you.<\/p>\n\n <h3>In short<\/h3>\n <div class=\"grid\">\n <div class=\"card\"><div class=\"k\">What<\/div><p>Two bugs in the PHP engine itself: CVE-2026-109618 and CVE-2026-109619.<\/p><\/div>\n <div class=\"card\"><div class=\"k\">Who<\/div><p>Almost every PHP website, including Magento, WooCommerce, WordPress, Laravel, Drupal and Joomla, even if your own code is perfectly clean.<\/p><\/div>\n <div class=\"card\"><div class=\"k\">Risk<\/div><p>Full server takeover, plus silent leaks of passwords, API keys and session tokens from server memory.<\/p><\/div>\n <div class=\"card\"><div class=\"k\">Fix<\/div><p>Upgrade to PHP <strong>8.5.12, 8.4.27, 8.3.36 or 8.2.35<\/strong>, then restart PHP. Nothing in your app code can fix this.<\/p><\/div>\n <\/div>\n <p>Can’t patch this hour? Use the <a href=\"#stopgaps\">temporary mitigations below<\/a>, and talk to us.<\/p>\n<\/section>\n\n<section id=\"what\">\n <h2>What is PHP2Shell?<\/h2>\n <p>PHP2Shell is the name for two memory-safety bugs in the core PHP engine, the software that runs underneath your website. Because the flaw sits in PHP itself, a store with flawless code is still exposed.<\/p>\n <div class=\"table-wrap\">\n <table>\n <thead><tr><th>CVE<\/th><th>Type of bug<\/th><th>What an attacker gets<\/th><\/tr><\/thead>\n <tbody>\n <tr><td><code>CVE-2026-109618<\/code><\/td><td>Use-after-free in the session upload-progress handler<\/td><td>Remote code execution, plus leaking of server memory<\/td><\/tr>\n <tr><td><code>CVE-2026-109619<\/code><\/td><td>Use-after-free in fatal-error handling, and OPcache type confusion<\/td><td>Remote code execution<\/td><\/tr>\n <\/tbody>\n <\/table>\n <\/div>\n <p>The PHP security team rates both at <strong>9.2 out of 10<\/strong> (CVSS v4.0), and the US NVD scores them <strong>9.8<\/strong> (CVSS v3.1). The researchers at Wiz, Calif and OpenAI who found them call these some of the most serious PHP bugs ever disclosed.<\/p>\n <div class=\"card\">\n <strong>In plain English:<\/strong> when a PHP request runs out of memory and crashes, PHP fails to clean up after itself. It leaves behind pointers to memory it has already freed. The next request handled by the same PHP worker trusts those stale pointers. An attacker who controls what fills that freed memory can make PHP read or run whatever they want.\n <\/div>\n<\/section>\n\n<section id=\"affected\">\n <h2>Who is affected?<\/h2>\n <p>Almost everyone running PHP on a web server. The vulnerable code goes back to PHP 5.4, released in 2012, and the default configuration is exploitable.<\/p>\n <ul>\n <li>Every PHP version before <strong>8.5.12, 8.4.27, 8.3.36 and 8.2.35<\/strong>.<\/li>\n <li>PHP 8.1, 8.0, 7.x and older get no official release. They stay vulnerable unless your host, Linux distribution or an LTS vendor backports the fix.<\/li>\n <li>Both common setups: Apache with <code>mod_php<\/code> and Nginx\/Apache with PHP-FPM. PHP flags <code>mod_php<\/code> as the highest-risk setup.<\/li>\n <li>Every PHP application. Researchers proved login-free takeover on Magento 2.4.9, WordPress, Drupal, Joomla, Laravel 13, Symfony 8, Nextcloud, phpMyAdmin, Roundcube, MediaWiki and WHMCS. WooCommerce and Shopware stores are exposed too.<\/li>\n <\/ul>\n <div class=\"good\">If you are on Shopify or BigCommerce, the platform runs the servers for you, so your storefront is not affected. Any custom PHP app, middleware or admin panel you host yourself still is.<\/div>\n<\/section>\n\n<section id=\"attack\">\n <h2>How PHP2Shell takes control of your server<\/h2>\n <p>The attack needs no login, no plugin bug and no admin access. It only needs your server to accept a file-upload style request, which every PHP site does by default.<\/p>\n <p><em>The attack chain: 4 steps, 2 outcomes. The same crash can be used two ways: to leak secrets from memory, or to run the attacker’s code. The leak often feeds the takeover.<\/em><\/p>\n <ol class=\"steps\">\n <li><strong>The attacker sends a crafted upload request.<\/strong> It is a <code>multipart\/form-data<\/code> POST, the same format a browser uses to upload a file. PHP reads it before your application code even starts.<\/li>\n <li><strong>PHP is pushed past its memory limit.<\/strong> The request is built to hit <code>memory_limit<\/code> at exactly the wrong moment, so PHP aborts with a fatal error.<\/li>\n <li><strong>PHP leaves stale pointers behind.<\/strong> The crash frees the request’s memory but forgets to reset some internal state, such as the session upload-progress data or the last error backtrace.<\/li>\n <li><strong>The next request reuses the poisoned worker.<\/strong> PHP-FPM and <code>mod_php<\/code> reuse worker processes. The attacker’s follow-up requests land in the same worker and fill the freed memory with data they control.<\/li>\n <li><strong>PHP treats attacker data as its own.<\/strong> This corrupts memory in a controlled way. Combined with the memory leak below, the attacker learns the exact memory layout and turns the corruption into running their own code.<\/li>\n <\/ol>\n\n <h3>The Heartbleed-style leak<\/h3>\n <p>CVE-2026-109618 can also be used on its own to read your server’s memory. PHP sends chunks of freed memory back to the attacker inside a <code>PHPSESSID<\/code> cookie, even if your app never uses sessions. That memory can hold other customers’ passwords, session tokens, payment-gateway API keys, database credentials and even TLS private keys.<\/p>\n\n <h3>What an attacker does once inside<\/h3>\n <p>Code running as your web user typically means:<\/p>\n <ul>\n <li>A web shell or backdoor that survives even after you patch.<\/li>\n <li>Card skimmers (Magecart) injected into checkout pages.<\/li>\n <li>Theft of the customer database, admin accounts and <code>env.php<\/code> \/ <code>.env<\/code> secrets.<\/li>\n <li>Defacement, SEO spam, crypto-miners or ransomware, and a foothold to attack other sites on the same server.<\/li>\n <\/ul>\n<\/section>\n\n<section id=\"urgent\">\n <h2>Why this one is so urgent<\/h2>\n <p>Attackers started before the patch existed, and a ready-made exploit tool is now public. Expect mass, automated scanning of every PHP site on the internet in the coming days.<\/p>\n <ul>\n <li><strong>It leaked early.<\/strong> Details went public on 20 October, two days ahead of the planned disclosure.<\/li>\n <li><strong>Attacks began before the fix.<\/strong> Cloudflare saw exploitation at 07:43 UTC on 21 October, more than six hours before PHP released patches.<\/li>\n <li><strong>A one-shot exploit tool exists.<\/strong> The <code>php2shell<\/code> tool chains both bugs into a single login-free attack.<\/li>\n <li><strong>AI made it practical.<\/strong> Wiz says frontier AI models let one researcher build and adapt working exploits in days instead of months. Attackers have the same tools.<\/li>\n <li><strong>Huge reach.<\/strong> PHP powers roughly 70% of websites, per Wiz.<\/li>\n <\/ul>\n\n <h3>Timeline (UTC)<\/h3>\n <ul class=\"timeline\">\n <li><span class=\"d\">11 Aug 2026<\/span>Calif reports the first bug to PHP<\/li>\n <li><span class=\"d\">24 Aug 2026<\/span>Wiz Research reports the bugs to PHP<\/li>\n <li><span class=\"d\">20 Oct 2026<\/span>Details leak; PHP announces an emergency release<\/li>\n <li><span class=\"d\">21 Oct 2026, 07:43<\/span>Cloudflare reports the first attacks<\/li>\n <li><span class=\"d\">21 Oct 2026, 14:00<\/span>PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35<\/li>\n <\/ul>\n<\/section>\n\n<section id=\"fix\">\n <h2>The fix: update PHP and restart it<\/h2>\n <p>The only complete fix is a patched PHP build on the server. No Magento patch, WordPress plugin or firewall rule inside your app can fix it, because the bug triggers before your code runs.<\/p>\n <div class=\"table-wrap\">\n <table>\n <thead><tr><th>Your PHP branch<\/th><th>Update to<\/th><th>Official support<\/th><\/tr><\/thead>\n <tbody>\n <tr><td>8.5<\/td><td><strong>8.5.12<\/strong><\/td><td>Yes<\/td><\/tr>\n <tr><td>8.4<\/td><td><strong>8.4.27<\/strong><\/td><td>Yes<\/td><\/tr>\n <tr><td>8.3<\/td><td><strong>8.3.36<\/strong><\/td><td>Yes<\/td><\/tr>\n <tr><td>8.2<\/td><td><strong>8.2.35<\/strong><\/td><td>Yes, security fixes only<\/td><\/tr>\n <tr><td>8.1, 8.0, 7.4<\/td><td>No official release<\/td><td>Source backports only; upgrade or use a vendor backport<\/td><\/tr>\n <\/tbody>\n <\/table>\n <\/div>\n\n <h3>Shared hosting or cPanel\/Plesk<\/h3>\n <p>Ask your host to confirm the patched PHP build is live for your account. Then use the PHP selector to move off 8.1 or older.<\/p>\n\n <h3>Ubuntu \/ Debian VPS<\/h3>\n <p>Update packages from your distribution or the Ond\u0159ej Sur\u00fd (sury.org) repository, which also backports to old branches. Then restart every PHP-FPM pool:<\/p>\n<pre><code>sudo apt update && sudo apt upgrade\nsudo systemctl restart php8.3-fpm # repeat for each installed version\nsudo systemctl reload nginx # or: sudo systemctl restart apache2<\/code><\/pre>\n\n <h3>RHEL \/ AlmaLinux \/ Rocky<\/h3>\n <p>If you use Remi’s repository, its update was not ready on 21 October. Switch to your distribution’s PHP packages or build from source until it is.<\/p>\n\n <h3>Laravel Forge, Docker and managed platforms<\/h3>\n <p>On Forge, upgrade PHP from the server panel, then restart queues and Horizon. For containers, pull the patched official <code>php<\/code> image, rebuild and redeploy every service.<\/p>\n\n <div class=\"note\">\n <strong>Check it really worked.<\/strong> <code>php -v<\/code> only shows the command-line PHP, not the one serving your site. Confirm the version from a page served by PHP-FPM, for example a temporary <code>phpinfo()<\/code> page you delete straight after. Distribution packages may keep an older version number with the fix backported, so check the package changelog for the two CVE numbers.\n <\/div>\n<\/section>\n\n<section id=\"stopgaps\">\n <h2>Can’t patch right now? Buy time with these stopgaps<\/h2>\n <p>These steps reduce risk for a few hours or days. They are <strong>not a fix<\/strong>, and you should remove them once PHP is updated.<\/p>\n\n <h3>1. Block upload-style requests at the web server<\/h3>\n <p>Every known trigger is a <code>multipart\/form-data<\/code> request. Blocking it stops the attack, but also breaks file uploads (such as product images in the Magento admin) and some checkout forms. Place a test order after adding it.<\/p>\n <p><strong>Nginx<\/strong>, inside each <code>server<\/code> block that passes requests to PHP:<\/p>\n<pre><code>if ($http_content_type ~* \"multipart\/form-data\") {\n return 403;\n}<\/code><\/pre>\n <p><strong>Apache<\/strong>, inside each <code><VirtualHost><\/code> that serves PHP:<\/p>\n<pre><code>RewriteEngine On\nRewriteCond %{HTTP:Content-Type} multipart\/form-data [NC]\nRewriteRule ^ - [F]<\/code><\/pre>\n <p>If you use Cloudflare, a WAF rule that blocks multipart requests to your PHP paths does the same job at the edge.<\/p>\n\n <h3>2. Go read-only or offline<\/h3>\n <p>Allowing only GET and HEAD requests keeps your catalogue browsable while blocking logins and orders. For full safety, stop PHP-FPM and serve a static maintenance page. The built-in maintenance modes in Magento and WordPress do not help, because PHP parses the request before they kick in.<\/p>\n\n <h3>3. Adjust PHP settings (partial only)<\/h3>\n <p>Set <code>session.upload_progress.enabled = 0<\/code> and <code>memory_limit = -1<\/code> for every PHP-FPM pool, then reload PHP-FPM. On its own this is not enough, and an unlimited memory limit lets one request eat all server RAM, so watch memory closely.<\/p>\n<\/section>\n\n<section id=\"hit\">\n <h2>Think you were already hit? What to check after patching<\/h2>\n <p>Patching closes the door, but it does not remove anyone already inside. If your server was exposed after 20 October, assume your secrets may have leaked and check for intruders.<\/p>\n\n <h3>Warning signs in your logs<\/h3>\n <ul>\n <li>Bursts of <code>multipart\/form-data<\/code> POST requests followed by “Allowed memory size exhausted” errors or repeated HTTP 500 responses.<\/li>\n <li>Unusually large or garbled <code>PHPSESSID<\/code> cookies in responses.<\/li>\n <li>PHP-FPM workers crashing or restarting more often than normal.<\/li>\n <li>New or recently modified PHP files you did not upload, unknown admin users, or new cron jobs.<\/li>\n <li>Changed checkout or payment templates, or unfamiliar JavaScript on checkout pages.<\/li>\n <\/ul>\n\n <h3>After patching, do this<\/h3>\n <ul>\n <li><strong>Rotate secrets.<\/strong> Change database passwords, payment-gateway and API keys, admin passwords and encryption keys stored in <code>env.php<\/code> or <code>.env<\/code>. The memory leak could have exposed them.<\/li>\n <li><strong>Log everyone out.<\/strong> Invalidate active sessions for admins and customers.<\/li>\n <li>Consider reissuing your TLS certificate if the server holds its own private key.<\/li>\n <li><strong>Scan for malware and backdoors.<\/strong> Compare files against a clean release and check for web shells and skimmers.<\/li>\n <li>Review admin accounts, SSH keys and cron jobs for anything you did not add.<\/li>\n <\/ul>\n<\/section>\n\n<section id=\"checklist\">\n <h2>Your PHP2Shell checklist<\/h2>\n <ul class=\"checklist\">\n <li><input type=\"checkbox\" id=\"c1\"><label for=\"c1\">Find every server, staging site and container that runs PHP<\/label><\/li>\n <li><input type=\"checkbox\" id=\"c2\"><label for=\"c2\">Update each one to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a confirmed vendor backport)<\/label><\/li>\n <li><input type=\"checkbox\" id=\"c3\"><label for=\"c3\">Restart PHP-FPM \/ Apache and confirm the version from a live web request<\/label><\/li>\n <li><input type=\"checkbox\" id=\"c4\"><label for=\"c4\">Plan an upgrade for anything still on PHP 8.1 or older<\/label><\/li>\n <li><input type=\"checkbox\" id=\"c5\"><label for=\"c5\">Remove temporary multipart blocks and restore <code>memory_limit<\/code><\/label><\/li>\n <li><input type=\"checkbox\" id=\"c6\"><label for=\"c6\">Rotate passwords, API keys and encryption keys<\/label><\/li>\n <li><input type=\"checkbox\" id=\"c7\"><label for=\"c7\">Scan for web shells, skimmers and unknown admin users<\/label><\/li>\n <\/ul>\n<\/section>\n\n<section class=\"cta\" id=\"help\">\n <h2>Need an expert to handle it? Talk to Unwavering Technology<\/h2>\n <p>If you’d rather not touch a live production server yourself, our team can patch, verify and clean up for you.<\/p>\n <p>We have been building and maintaining PHP, Laravel, Magento 2 and WooCommerce sites for over 12 years, for businesses in India, the Gulf, the UK and the US. For PHP2Shell we offer:<\/p>\n <ul>\n <li><strong>Emergency patching:<\/strong> PHP upgraded on every server and container, with downtime kept to minutes.<\/li>\n <li><strong>Safe upgrades from old PHP:<\/strong> moving Magento, Laravel or WordPress off PHP 8.1 or older and testing that checkout, admin and integrations still work.<\/li>\n <li><strong>Compromise check:<\/strong> log review, malware and web-shell scan, and checkout skimmer check.<\/li>\n <li><strong>Secret rotation and hardening:<\/strong> new keys and passwords, Cloudflare\/WAF rules and server hardening so the next vulnerability hits a tougher target.<\/li>\n <\/ul>\n <p class=\"s\"><strong>Get your server checked today:<\/strong> email us at <a class=\"lnk\" href=\"mailto:sales@unwaveringtechnology.com\">sales@unwaveringtechnology.com<\/a>, message us on WhatsApp at <a class=\"lnk\" href=\"tel:+919872592099\">+91 9872592099<\/a>, or book a call. Tell us your platform and hosting provider, and we’ll reply with a plan and a quote.<\/p>\n <a class=\"btn\" href=\"mailto:sales@unwaveringtechnology.com\">Email us<\/a>\n <a class=\"btn\" href=\"https:\/\/wa.me\/919872592099\" target=\"_blank\" rel=\"noopener noreferrer\">WhatsApp<\/a>\n<\/section>\n\n<\/main>\n\n<footer>\n <div class=\"wrap\">\n <h2 class=\"src-title\">Sources<\/h2>\n <ul>\n <li><a href=\"https:\/\/sansec.io\/research\/php2shell\" target=\"_blank\" rel=\"noopener noreferrer\">Sansec: PHP2Shell, critical PHP RCE<\/a><\/li>\n <li><a href=\"https:\/\/www.wiz.io\/blog\/php2shell-php-rce\" target=\"_blank\" rel=\"noopener noreferrer\">Wiz Research: PHP2Shell technical write-up<\/a><\/li>\n <li><a href=\"https:\/\/laravel.com\/forge\/docs\/knowledge-base\/php-security-release-october-2026\" target=\"_blank\" rel=\"noopener noreferrer\">Laravel Forge: PHP security advisory, October 2026<\/a><\/li>\n <li><a href=\"https:\/\/www.helpnetsecurity.com\/2026\/10\/21\/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619\/\" target=\"_blank\" rel=\"noopener noreferrer\">Help Net Security: PHP2Shell patched, update now<\/a><\/li>\n <li><a href=\"https:\/\/www.tenable.com\/blog\/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote\" target=\"_blank\" rel=\"noopener noreferrer\">Tenable: PHP2Shell FAQ<\/a><\/li>\n <li><a href=\"https:\/\/www.codeable.io\/blog\/php-vulnerability-cve-2026-109618\/\" target=\"_blank\" rel=\"noopener noreferrer\">Codeable: what WordPress site owners need to do<\/a><\/li>\n <\/ul>\n <\/div>\n<\/footer>\n\n\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>PHP2Shell: The Critical PHP Flaw That Can Hand Your Server to Hackers Security Advisory PHP2Shell: The Critical PHP Flaw That Can Hand Your Server to Hackers Update PHP on your server today. On 21 October 2026 the PHP team shipped emergency fixes for two critical flaws, nicknamed PHP2Shell, that let an attacker run their own […]<\/p>\n","protected":false},"author":2,"featured_media":1538,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1540","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-how-online-businesess-grow-online-in-punjab"],"_links":{"self":[{"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/posts\/1540","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/comments?post=1540"}],"version-history":[{"count":3,"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/posts\/1540\/revisions"}],"predecessor-version":[{"id":1544,"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/posts\/1540\/revisions\/1544"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/media\/1538"}],"wp:attachment":[{"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/media?parent=1540"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/categories?post=1540"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unwaveringtechnology.com\/blog\/wp-json\/wp\/v2\/tags?post=1540"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}