PHP2Shell · CVSS 9.2 · Unauthenticated RCE
Every PHP installation that serves web traffic is affected by CVE-2026-109618 and CVE-2026-109619. We find every exposed system you have, upgrade or rebuild what's vulnerable, and test that it's fixed without breaking your business.
Enter the PHP version from php -v, your hosting panel, or your developer. You'll get an instant answer and what to do next.
Running more than one site, or not sure what versions you have? That's what our Exposure Analysis is for.
Services
Hire us for one step or the whole job. Every engagement starts with a fixed-scope quote.
For: companies that don't know how many PHP systems they have, or which ones are at risk.
You get: a written risk report and a remediation plan with costs.
Request analysisFor: sites on PHP 8.2 or newer, or on 8.x versions that can move up safely.
You get: patched production servers with as little downtime as possible.
Request upgradeHighest risk
For: applications on PHP 5.x, 7.x, 8.0 or 8.1. These versions have no official patched release, so a version bump won't fix them.
You get: a supported, maintainable application. No more emergency patching every time a CVE drops.
Discuss a rebuildFor: anyone who has patched, or thinks they have, and needs proof.
You get: evidence you can show your customers, auditors and cyber insurer.
Request testingHow it works
30 minutes to understand your setup and how urgent it is. If there's a quick fix you can do yourself, we'll tell you.
A written quote with deliverables and a timeline. You approve it before any work starts.
Mitigate first, then upgrade or rebuild. Every production change is scheduled with you and has a rollback plan.
We check that the fix works, test that nothing broke, and give you a report you can share.
We focus on PHP and nothing else. Legacy codebases, WordPress, Magento, Laravel, Symfony and custom frameworks are our day job.
Staging first, rollback ready, maintenance windows that suit you. We protect your revenue while we fix your security.
Every engagement ends with written evidence of what we changed, what we tested, and what risk is left.
There's no official patched release for you. Mitigations only buy time. Let's plan the way out.
Free remediation guide
On 21 October 2026 the PHP project released emergency fixes for two memory-safety bugs in the PHP engine. If you have the in-house skills, here's what to do.
CVE-2026-109618
When PHP runs out of memory, it can stop partway through setting up a request. The cleanup step then treats the half-built data as valid. An attacker can trigger this with a crafted request, such as a large multipart upload, and use it to run code.
Advisory GHSA-w8hw-w9fx-j79w ↗CVE-2026-109619
PHP keeps some global state that points to memory owned by a request. If that state isn't reset before the memory is freed, the next request on the same worker can use the stale pointer. This is a use-after-free that leads to remote code execution.
Advisory GHSA-6wmf-4rv5-p3rp ↗Affected: all web SAPIs, including PHP-FPM, Apache mod_php (highest risk), php-cgi, FrankenPHP and LiteSpeed.
| Branch | Patched version | Status |
|---|---|---|
| 8.5 | 8.5.12 | Supported |
| 8.4 | 8.4.27 | Supported |
| 8.3 | 8.3.36 | Security-only |
| 8.2 | 8.2.35 | Security-only, end of life 31 Dec 2026 |
| 8.6 (pre-release) | 8.6.0RC4 | Earlier 8.6 test builds are vulnerable |
| 8.1, 8.0, 7.4 | Source backports only | Unsupported. Use vendor LTS packages, build from source, or rebuild. |
| 7.3 and older | No fix | Upgrade or rebuild. Mitigate or take offline meanwhile. |
sudo apt update
sudo apt install --only-upgrade 'php*'
# Restart EVERY PHP process. Old workers keep running vulnerable code.
sudo systemctl restart 'php*-fpm' apache2 2>/dev/null
# Check that the fix is in your distro's changelog
apt changelog php8.3 | grep -E 'CVE-2026-10961[89]'Distro packages often backport the fix without changing the upstream version number. Check the changelog, not just php -v.
sudo dnf upgrade --refresh 'php*'
sudo systemctl restart php-fpm httpd
rpm -q --changelog php-cli | grep -E 'CVE-2026-10961[89]'At disclosure, the Remi repository had not published fixed builds. If you depend on it, switch to your distribution's packages or build from source.
FROM php:8.3.36-fpm # or 8.4.27-apache, 8.5.12-cli, ...
docker build --pull --no-cache -t myapp .
docker run --rm myapp php -vBase images cached on CI runners and in registries will still be vulnerable. Rebuild everything.
Ask your host directly: "Are you patched for CVE-2026-109618 and CVE-2026-109619, and have all PHP workers been restarted?" If they can't confirm it, ask them to apply the mitigations below, or ask us to migrate you.
These steps block the known attack paths only. Other variants may exist. They buy time. They don't make you safe.
; php.ini or FPM pool. Must apply before request parsing; ini_set() and .user.ini do NOT work.
session.upload_progress.enabled = 0 ; CVE-2026-109619
fatal_error_backtraces = 0 ; PHP 8.5 only
php_admin_value[memory_limit] = -1 ; CVE-2026-109618 (pool level)
post_max_size = 8M ; 32M if uploads are needed
upload_max_filesize = 6M ; keep it below post_max_size
; Then restart EVERY worker.Also cap request body size, field count and multipart parts at your web server or proxy. Turn on WAF rules: Cloudflare has released managed rules for the known exploit patterns, including on its free plan.
Look for new .php files in upload and cache folders, unknown cron jobs, outbound connections from PHP workers, worker segfaults, and large multipart POSTs to arbitrary URLs. If you find anything, snapshot the server before you change it, rotate every secret the web user could read, and get a compromise assessment.
Patching is often only part of the job. Common gaps: a forgotten second server or staging site, workers that were never restarted, distro packages that don't include the backport, and attackers who got in before the patch. Our testing service checks all of these.
Sometimes. Older code often uses features removed in PHP 8, and plugins and extensions may need replacing. We start with a code audit so you know whether you're looking at an upgrade or a rebuild, and what it costs, before you commit.
For analysis and upgrades, yes. We agree the access level with you, use named accounts you can revoke, and never ask for credentials by email or through this form. For rebuilds we can work in a copy of your repository and hand over the result.
Book a triage call. If you're actively exposed, we'll go through the interim mitigations with you on that first call.
We plan every production change with you. Most upgrades are staged so the switchover takes seconds, and every change has a tested rollback.
Get a quote
Tell us a little about your setup. An engineer, not a salesperson, will reply with next steps and a fixed-scope proposal.
Guide last reviewed 22 October 2026.