PHP2Shell in short: if your server runs PHP 8.2–8.5, update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or newer) and restart PHP. If you run PHP 8.1 or older, you need a patched package from your distro or host, or an upgrade. No setting fully protects you. Last updated: October 27, 2026.

PHP2Shell is the name given to two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619 , which PHP fixed on October 21, 2026. They let an attacker run code on a web server with a single unauthenticated HTTP request, before your application code even starts. Because PHP powers WordPress and a large share of the web, this is one of the most serious PHP bugs in years. Here is what it is, how to check if you are affected and exactly how to patch.

What Is PHP2Shell?

PHP2Shell covers two separate bugs in the PHP interpreter.…