Critical PHP vulnerabilities (PHP2Shell): what happened and what to do

On October 21, 2026, the PHP team is releasing an emergency security update. It fixes two critical vulnerabilities in the PHP interpreter itself that allow an attacker to execute code on a server remotely. The vulnerabilities have already been given the unofficial name PHP2Shell.

Your websites continue to run. Below is what happened, who is affected, what we have already done and what you need to do.

Wat ass geschitt

The PHP security team has announced fixes for two critical vulnerabilities. Both are rated 9.2 out of 10 on the CVSS v4.0 scale. Researchers track them as CVE-2026-109618 and CVE-2026-109619.

The fixes are released on October 21 at 14:00 UTC (17:00 Moscow time). The release was originally planned for a day later, but details of the vulnerabilities leaked ahead of schedule, and PHP moved the release forward. According to Patchstack, hosting providers were already reporting exploitation attempts on the morning of October 21.

Wien ass betraff

The vulnerability is not in a CMS or plugin but in PHP itself. Any website running a vulnerable PHP version is at risk: WordPress, WooCommerce, Joomla, Drupal, 1C-Bitrix, Magento, Laravel and custom-built projects. Updating your CMS and plugins does not protect against this issue.

According to preliminary reports, all versions from PHP 5.4 onward are affected. Official fixes will be released only for supported branches:

PHP will publish the exact list of affected and fixed versions together with the release. We will update this article as soon as it is available.

What is known and what has not been disclosed yet

PHP has not published technical details yet. Everything known so far comes from the leak and analysis by independent researchers:

• the vulnerabilities allow arbitrary code execution on the server without authentication — a specially crafted request to the website is enough;
• at least one of them is related to the file upload progress tracking mechanism (session.upload_progress), which is enabled in PHP by default;
• according to researchers, the second one is in the file upload handler and does not depend on this setting.

Not officially confirmed until the release:

• an exact description of the vulnerabilities and attack conditions;
• the list of affected and fixed versions;
• indicators of compromise (IoCs).

Security experts expect mass attacks within minutes of the fixes being published: by comparing the old and new code, attackers will quickly work out how the vulnerability works. That is why the update must not be postponed.

Wat mir maachen

Without waiting for the official release, we have taken measures across our entire infrastructure:

1. Added request filtering rules that block the known attack scenario. This is a limited measure: some attacks may bypass the filter, so it only buys time until the update.
2. Stepped up monitoring: we track suspicious PHP process activity on our servers and PHP crashes that may indicate attack attempts.
3. Prepared the PHP update. As soon as the release is out, we will install the fixed versions for branches 8.2–8.5 on all shared hosting servers. We will notify you separately once the work is complete.

Temporary measures reduce the risk but do not fully eliminate the vulnerability. The only reliable protection is updating PHP.

Wat Dir braucht fir ze maachen

If you use shared hosting

We handle most of the work ourselves. All you need to do is:

1. Check your PHP version in the PHP settings section of the control panel for each website.
2. If the version is 8.2 or later, no action is needed: we will install the fixed version automatically.
3. If the version is 8.1 or older, switch the website to PHP 8.2 or later (see the next section).
4. Do not re-enable session.upload_progress in your own PHP settings, even if a plugin's instructions suggest it.

If you have a VPS or dedicated server

On VPS and dedicated servers, you manage PHP yourself, and we cannot update it for you. Do the following as soon as possible:

1. Find all PHP versions installed on the server. Keep in mind that control panels (ISPmanager, cPanel, Plesk, FastPanel and others) often keep several versions at once.
2. Disable upload progress tracking until the update is out. For PHP-FPM, add these lines to the configuration of every pool, for example /etc/php/8.3/fpm/pool.d/www.conf: php_admin_flag[session.upload_progress.enabled] = off php_admin_flag[session.use_strict_mode] = on If PHP runs as an Apache module (mod_php), set these parameters in php.ini and restart Apache. This setting cannot be changed from code with ini_set().
3. Restart PHP-FPM and check the result: create a file containing <?php phpinfo(); in the website root, open it in a browser and make sure session.upload_progress.enabled is Off. Delete the file immediately afterwards. Checking with php -i in the console does not work — it shows the command-line settings, not the web server's.
4. Update PHP as soon as the fixed packages appear in your distribution's or control panel's repository. Then restart PHP-FPM or Apache — without a restart, the old version keeps running.

According to researchers, disabling session.upload_progress closes only one of the two vulnerabilities. It is a temporary measure, not a substitute for the update.

If your website runs on PHP 8.1 or older

PHP 8.1 and older branches are end-of-life and will not receive an official fix. These websites will stay vulnerable until they are moved to a supported version.

1. Plan your move to PHP 8.2 or later. We recommend PHP 8.4. Note that the 8.2 branch receives security fixes only until December 31, 2026.
2. Test compatibility on a copy of your website. Moving between branches is a migration, not a simple update: older versions of CMS, themes and plugins may not work on newer PHP. Update your CMS and extensions first, then switch the PHP version.
3. If you cannot migrate quickly, take the website off public access until the migration is complete: restrict access by IP address, with a password or through a VPN.

If it is hard to assess compatibility yourself, contact our support team — we will help with the migration.

How to check whether your website has been compromised

Attacks began before the fix was released, so after updating PHP it is worth making sure your website was not compromised earlier. Pay particular attention to the period since October 20.

1. Check your website files for unfamiliar PHP files, especially in upload, cache and temporary folders. Look closely at files modified after October 20.
2. Check cron jobs for unfamiliar entries.
3. Check administrator accounts in your CMS, and on a VPS, system users and keys in ~/.ssh/authorized_keys.
4. Review web server logs for suspicious POST requests with file uploads, especially to URLs that should not accept uploads.
5. On a VPS, check processes: PHP-FPM or Apache processes should not launch sh, bash, curl, wget, nc, python or perl.
6. Run e Malware Scan of your website using the control panel or a dedicated scanner.

If you find anything suspicious, do not delete files right away: keep copies and logs, change your CMS, database and FTP/SSH passwords, and contact us.

Brauch Hëllef?

Not sure which PHP version your website uses, need help moving to a newer branch, or found something suspicious on your server? Contact our support team — we will sort it out together.

We will update this article once PHP publishes the official details and fixed version numbers, and we will notify you separately when the updates are installed on our servers.