PHP2Shell: how to protect your company's PHP servers

Updated 3 November 2026.

Does your website, management software or e-commerce run on PHP? Updating the CMS alone is not enough: check the version of the PHP engine and the configuration settings covered in this article.

On 21 October 2026 the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known as “PHP2Shell”. In some configurations they allow an attacker, even without authentication, to run code on the server hosting a PHP website or application. Both have a CVSS v4.0 score of 9.2.

Why it matters for your company too

PHP powers a huge number of websites and web applications: popular CMSs such as WordPress, Drupal and Joomla, business management software, internal portals and e-commerce. The flaw is in the PHP engine, not in a specific CMS: updating only the CMS or its plugins is not enough.

The vulnerabilities are already being exploited. watchTowr reports attack attempts observed from 21 October; AWS later identified an attempt dating back to 17 October, before the fixes were published. On 26 October the US CISA added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue. In Italy, a CERT-AGID scan started on 22 October found 650 web addresses listed in the Italian public administration index (IPA) declaring potentially vulnerable PHP versions; by the 26 October review there were 467. These are potential exposures inferred from the declared version, not confirmed vulnerabilities.

Which versions to install

• PHP 8.5: at least 8.5.12
• PHP 8.4: at least 8.4.27
• PHP 8.3: at least 8.3.36
• PHP 8.2: at least 8.2.35 (security support until 31 December 2026)
• PHP 7.4, 8.0 and 8.1: no new official release from the PHP project; you need fixed packages from your distribution or extended-support vendor, or a move to a supported version
• PHP 7.3 and earlier: no new official release from the PHP project; check for patches from your extended-support vendor and plan a migration to a supported version

Every way PHP serves web pages is affected: PHP-FPM, Apache with mod_php (considered the highest-risk case), php-cgi, LiteSpeed and FrankenPHP. Long-term support Linux distributions may ship the fixes while keeping apparently older version numbers: check your vendor's advisory.

Operational priorities

Updates, checks and containment should run in parallel, starting with the most exposed servers.

1. List your systems. Identify every server and container running PHP, starting with those reachable from the Internet and those using Apache with mod_php. Include managed hosting, test environments and container images.
2. Update. Install the fixed version on the runtime actually used by the web service and restart every affected process: with mod_php restart Apache, with PHP-FPM restart all workers. A simple reload can leave old processes running. For containers, rebuild or update the images and redeploy the instances.
3. If you cannot update right away. Restrict Internet access (VPN or upstream authentication) and enable dedicated WAF rules if available. As a temporary measure, set session.upload_progress.enabled = 0 in the administrative configuration used by the service (for example with php_admin_value in the PHP-FPM pool or the Apache configuration, so applications cannot override it) and restart the processes; this disables PHP's native upload progress feature. The PHP project states that, for PHP2Shell, no configuration change fully removes the risk.
4. Check for signs of intrusion. Updating does not remove intrusions that have already happened. Look for unexpected files in web folders, unexpected processes running under the web service account, unusual logins and changes to scheduled tasks. These are initial checks: the absence of obvious signs does not prove the system is intact. If you find signs of compromise, have qualified staff preserve the evidence before actions that can destroy it, such as restarts or reinstallations, without delaying containment.
5. Check the Linux kernel. According to the CISA entry, these flaws can be chained with Fragnesia (CVE-2026-46300), added to the KEV catalogue on 28 October, to gain administrator privileges on the server. Check whether your kernel is affected, apply your distribution's fix and activate it as your vendor instructs, rebooting when required.

A third vulnerability, with narrower exploitation conditions

On 23 October the PHP Security Team disclosed CVE-2026-115560, related to session handling. It requires an uncommon combination of configuration and application behaviour: a non-default session serialisation handler that the application switches back to “php” before starting the session, with upload progress enabled. The 21 October releases fix PHP2Shell but not this vulnerability: PHP has announced the fix for a later regular release. Until then, setting session.upload_progress.enabled = 0 blocks the documented vector for this CVE. Tools that only check the PHP version do not detect it: configuration and application code need to be reviewed.

The takeaway for IT managers

Incidents like this show how much it matters to know exactly which systems you have, keep them regularly updated and have procedures ready to handle an incident. For companies subject to NIS2, asset inventory, patch management and incident procedures help implement the risk-management obligations set by Italian Legislative Decree 138/2024, proportionately to risk and according to the applicable specifications.

If you need support with inventory, updates and checks of packages and configurations, discover our cyber security services for businesses and our NIS2 consulting. Let's talk about your project.

Sources: PHP security announcements; CISA, “CISA Adds Two Known Exploited Vulnerabilities to Catalog” (26/10/2026); CERT-AGID; watchTowr, CVE-2026-109618 FAQ; BleepingComputer, AWS detection of 17 October; Cybersecurity360, “PHP2Shell: due vulnerabilità critiche in PHP”; Cybersecurity360, “PHP2Shell e Fragnesia”. This information is current as of the date shown and may change: always check the official PHP and vendor advisories.