PHP2Shell: the October 2026 PHP vulnerabilities, and what we did for every client

Quick answer

If your site runs PHP 8.2–8.5, update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 today. If it runs PHP 8.1 or older, there is no normal update for you: you need either a backported build from your host or a PHP upgrade. Then set session.upload_progress.enabled=0 and restart PHP. PHP recommends that setting against PHP2Shell, and it also covers a third flaw disclosed on 23 October that has no patch yet, although that flaw affects only applications that switch their session serializer at runtime.

Every site under an itmarkerz maintenance plan was patched and restarted on 21–22 October, before CISA’s federal deadline of 29 October. If you are not a client and are unsure where you stand, send us your PHP version and we will tell you in one reply.

What happened

On 21 October 2026 the PHP project released emergency fixes for two critical bugs in the core runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both are rated 9.2 on CVSS v4. Both can be reached by an unauthenticated attacker sending crafted HTTP requests, and both can lead to code execution as the web worker.

They affect every common way of running PHP for the web: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php is the most exposed because the bug can be triggered before your application code runs at all, so no framework-level protection helps.

• CVE-2026-109618 is a memory-corruption bug in how PHP handles running out of memory. A crafted multipart upload can push a worker past its limit even when the request looks within bounds.
• CVE-2026-109619 is a use-after-free caused by stale state left behind between requests on a reused worker. Known paths run through the session lifecycle and, on PHP 8.5, the new fatal-error backtrace feature.

Proof-of-concept code circulated around the release; early versions were reported as non-functional or limited to specific setups. On 26 October CISA added both CVEs to its Known Exploited Vulnerabilities catalogue, which it only does when it has evidence of real attacks, and gave US federal agencies until 29 October to remediate.

The third one, with no patch

Two days after the emergency release, on 23 October, PHP published an advisory for CVE-2026-115560. It is a separate issue in the interaction between session serialisation and the upload-progress feature. The fully patched releases above do not fix it, and PHP has said the fix will come in the next regular bugfix release rather than another emergency one.

Its scope is narrow. PHP calls it an unlikely RCE vector. It needs session.serialize_handler set to php_binary or php_serialize in configuration, switched to php with ini_set() before session_start(), with upload progress enabled. Applications that never change the handler are not exposed to this CVE.

The good news is that the mitigation is simple and the same one recommended for PHP2Shell: disable session.upload_progress and restart your workers. If you did that on 21 October, you are already covered.

Fixed versions

That last row is the one that matters for most of the sites we are asked to rescue. PHP 8.1 left security support at the end of 2025. If you are still on it, PHP2Shell is not the last time this will happen, and each time the gap between “patch available” and “patch available for you” gets wider. Our Laravel to PHP compatibility matrix shows which Laravel version you need to move to a supported PHP.

The checklist we ran on every client site

This is the exact sequence, in the order we did it. Use it as your own.

1. Inventory. List every server and container, the PHP version on each, and the SAPI (FPM, mod_php, CGI). Do not trust the version in your deploy script; run php -v on the box.
2. Patch the runtime. Distribution packages first (Ubuntu, Debian, RHEL/Alma, and the Sury/Ondřej PPA all shipped same-day). PHP itself warned that the Remi repository would lag on 21 October, so Remi users checked before relying on it. Docker images: rebuild from the patched base tag, do not just restart.
3. Apply the configuration mitigations regardless of patch status, at a level the application cannot override (php.ini or the FPM pool, not ini_set):
   • session.upload_progress.enabled = 0
   • memory_limit = -1 is what PHP recommends against the OOM path; we only did this where the FPM pool already enforces pm.max_children and the host has swap headroom. Otherwise we tightened request limits at the proxy instead.
   • On PHP 8.5: fatal_error_backtraces = 0
4. Restart every worker. FPM reload is not enough for the stale-state bug; a full restart clears the reused workers.
5. Bound requests at the edge. In Nginx or Cloudflare: cap client_max_body_size, header count and multipart part count. Block multipart entirely on routes that do not accept uploads.
6. Do not use RLIMIT_AS or RLIMIT_DATA as a shortcut; they can trigger the vulnerable path.
7. Look back, not just forward. Review access logs from 17 October onward for unusual multipart POSTs and for new or odd child processes under the PHP user. Absence of log entries is not proof of absence.
8. Re-verify. php -v, php -i | grep upload_progress, and a request to a test endpoint after the restart.

Across our maintained estate this took most of a day for the sites already on PHP 8.2+ and the patched versions were confirmed by the morning of 22 October. The sites that took longer were the ones that had to move off PHP 8.1 first.

What this means if you are on Laravel

Laravel itself is not the vulnerable component; the PHP runtime is. No Laravel release fixes PHP2Shell. What Laravel determines is whether you can run a supported PHP:

• Laravel 13 requires PHP 8.3–8.5 and is supported until March 2028.
• Laravel 12 runs on PHP 8.2–8.5 and gets security fixes until 24 February 2027.
• Laravel 11 and 10 are out of security support. They can still run a patched PHP branch (Laravel 11 on PHP 8.2–8.4, Laravel 10 on PHP 8.1–8.3), but the framework itself no longer gets security fixes. The risk of being stuck on a PHP that cannot be patched applies to Laravel 10 apps still on PHP 8.1, and to Laravel 9 and older.

If that describes your application, the honest answer is not “patch PHP”, it is “upgrade the application so PHP can be patched”. That is the work our Laravel upgrade service does at a fixed price, and it is why the sites on our maintenance plans were closed before CISA’s deadline instead of after it.

FAQ

Is PHP2Shell being exploited?

Yes. CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalogue on 26 October 2026 on the basis of observed attacks.

Does updating Laravel or Composer packages fix it?

No. The bugs are in the PHP runtime. You have to update PHP itself and restart the workers.

I updated to 8.3.36. Am I done?

Almost. Also set session.upload_progress.enabled=0 and restart: PHP recommends it against PHP2Shell, and it also covers CVE-2026-115560, which 8.3.36 does not fix. That flaw only affects applications that switch session.serialize_handler to php with ini_set() before session_start().

My host says they will backport the fix to PHP 8.1. Is that enough?

For this incident, possibly. For the next one, no. PHP 8.1 has been out of security support since December 2025 and backports are at the host’s discretion.

Is a WAF rule enough on its own?

No. A WAF reduces exposure; it does not fix a memory-corruption bug in the runtime. Patch first, then add the WAF rule as defence in depth.

Sources: PHP 8.2.35/8.3.36/8.4.27/8.5.12 security release announcements (php.net, 21 Oct 2026); PHP advisory for CVE-2026-115560 (23 Oct 2026); CISA Known Exploited Vulnerabilities catalogue entries (26 Oct 2026); Rapid7 emerging-threat advisory (21–27 Oct 2026).