Learn what CVE-2026-109618 and CVE-2026-109619 affect, which PHP releases fixed them, and what to ask your hosting provider.
Checked 12 November 2026. PHP2Shell refers to two critical PHP runtime vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP says they can allow unauthenticated remote code execution. If your public site runs PHP, ask your hosting provider to confirm the version actually serving that domain and apply a current supported security release or a verified vendor fix. PHP’s October 2026 release announcements list the original fixes.
Does PHP2Shell affect WordPress and traditional PHP sites?
WordPress and many other applications run on PHP. Their exposure depends on the PHP package and configuration used by the web server. Updating WordPress core, a theme or a plugin covers that component. Your hosting provider or server administrator applies the PHP runtime fix. A site that publishes static HTML can still use PHP for a contact form, backend or a second site on the same account, so inventory those separately.
Palo Alto Networks’ Unit 42 documented exploitation against certain internet-exposed PAN-OS management interfaces. That is evidence of exploitation in the wild. Checking your own version and logs is how you assess your own exposure. Unit 42’s PHP2Shell threat brief describes its findings.
Which PHP versions first fixed these two CVEs?
| PHP branch | First upstream fix | What to request |
|---|---|---|
| 8.5 | 8.5.12 | Latest supported 8.5 security release your host provides. |
| 8.4 | 8.4.27 | Latest supported 8.4 security release your host provides. |
| 8.3 | 8.3.36 | Latest supported 8.3 security release your host provides. |
| 8.2 | 8.2.35 | Apply the available fix and plan a move to a supported branch before 8.2 support ends. |
These are the first upstream versions that addressed this pair of vulnerabilities. Some vendors backport fixes while keeping an older-looking version string. Ask for the vendor advisory or package revision that explicitly covers both CVEs. Check the PHP support schedule before planning a branch upgrade.
What should I ask my host or developer to do today?
- Confirm the active web runtime. Ask which PHP package serves each public domain, subdomain and application. A shell command can show a different PHP version from the one serving web requests.
- Apply the fix promptly. Confirm the host has applied the update to the serving workers. Test essential forms, checkout and admin sign-in after the update. PHP’s release guidance calls for updating even if a firewall is in place.
- Check for signs of compromise. Ask for available access, application and security logs. Review unexpected files, new administrator accounts, unexplained redirects or changes to scheduled tasks. Any single warning sign needs investigation.
- Escalate evidence of compromise. Work with your host or incident response provider to isolate the affected site, preserve logs and snapshots, assess the scope, recover from known-good sources and rotate affected credentials from a clean environment.
What is a web shell?
A web shell is a script an intruder can leave on a server to regain access or run actions with the web process’s permissions. PHP2Shell is the name of the two runtime vulnerabilities. A web shell is one possible result of a compromise. Applying a patch closes a vulnerable path. Incident investigation determines what an attacker may already have changed. See MITRE ATT&CK’s web shell entry.
For a site on old PHP or an abandoned theme, use our legacy site assessment guide to plan the upgrade. If your site uses WordPress, review the official hardening handbook for updates, access and backups.