PHP2Shell (CVE-2026-109618, CVE-2026-109619): How to Check If You Are Vulnerable, and When It Becomes an Incident

PHP2Shell is two critical flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, that allow remote code execution without a login on PHP web servers. PHP fixed them on October 21, 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Patch and restart every PHP worker now. Because exploitation attempts were seen before the patch existed, an internet-facing PHP server that was unpatched also needs an investigation, which counts as incident response under SOC 2 and ISO 27001 even when no personal data is involved.

Last updated: October 22, 2026, 12:46 UTC

How the two PHP2Shell flaws work

Both PHP2Shell flaws are memory-safety bugs in PHP's own runtime, so they affect any PHP application that handles web requests, whatever framework or CMS it uses. The bugs trigger while PHP is still setting up the request, before WordPress, Drupal, Laravel or custom code runs. Application logins, plugins and input validation cannot stop them.

PHP rates both 9.2 on CVSS v4.0 and marks the attack complexity as high, because exploitation depends on worker reuse, memory conditions and defeating address randomization. Failed attempts tend to crash workers, which leaves traces in the logs. The Datadog Security Labs analysis walks through both bugs in technical detail.

Which PHP versions does PHP2Shell affect?

PHP2Shell affects every supported PHP branch below the October 21, 2026 releases, and every end-of-life branch.

Linux distributions patch their own PHP packages and usually keep the old version number, so a distribution's PHP 8.3 or 8.2 package can be patched while still reporting an older version. Red Hat, Debian, AlmaLinux and cPanel had published updates on October 21. Check the vendor's advisory for the exact package build.

How can I check if we are vulnerable to PHP2Shell?

Check the PHP that serves web traffic, because the PHP on the command line is often a different build and attackers reach the web one.

1. List every place PHP runs. Web servers, container images, WordPress and other CMS hosting, internal tools, and appliances or vendor products that embed PHP.
2. Find the runtime version from the web context. Use phpinfo() or phpversion() from a protected page, since php -v in a shell reports the command-line build.
3. Check the package, not just the version string. On Debian and Ubuntu, run apt changelog for the PHP package. On RHEL-family systems, run rpm -q --changelog php or dnf updateinfo list --cve CVE-2026-109618. Look for the CVE IDs in the changelog.
4. Check the server API. Apache with mod_php is the highest risk. PHP-FPM, FrankenPHP, LiteSpeed and php-cgi are also affected.
5. Ask managed hosts in writing. On shared hosting, managed WordPress and cPanel, the host patches PHP. Ask whether the exact PHP version each site uses is patched for both CVEs, and keep the reply as evidence.
6. Run an external check as a first signal. The PHP2Shell checker reads the PHP version a site advertises in its response headers, without sending any exploit traffic. A visible unpatched version is a strong warning. A hidden or patched-looking version still needs the internal checks above, because headers do not reflect distribution backports.

Vulnerability scanners from Tenable, Datadog, Tanium and others have added checks. They see OS packages, so a self-compiled PHP or a PHP inside a container image needs a separate look.

What to do about PHP2Shell, step by step

PHP2Shell needs vulnerability remediation first and then, because exploitation began before the patch, an incident response check that follows the NIST SP 800-61 phases: detection and analysis, containment, eradication and recovery, and post-incident activity. Evidence preservation comes before everything else, because patching and redeploying can wipe the logs the analysis needs. The first three steps can be finished today.

Step 1. Evidence preservation

• Copy web server, PHP-FPM and PHP error logs from at least October 17, 2026 to storage the web servers cannot write to.

Step 2. Remediation

• Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install the vendor package that carries the fix.
• Restart every PHP worker, because old workers keep running vulnerable code.
• Rebuild and redeploy container images, then confirm no old containers remain.
• Where patching must wait, apply PHP's partial mitigations: set session.upload_progress.enabled=0, set fatal_error_backtraces=0 on PHP 8.5, cap request and multipart sizes at the web server or proxy, and turn on WAF rules from Cloudflare or another provider. PHP's advisory calls patching the only complete fix.

Step 3. Detection and analysis

• Review the preserved logs for the signs in the next section, starting with internet-facing servers that ran mod_php.
• Record a finding for each server: no evidence, inconclusive evidence, or evidence of compromise, with the reasoning.
• With no evidence of compromise, close the vulnerability record with the patch evidence and the analysis notes.
• With evidence of compromise, declare an incident and make the breach determination for each law that applies, using the obligations sections below.

Step 4. Containment, eradication and recovery (when a server was compromised)

• Isolate the server from the network and rotate every credential it held or could read.
• Rebuild the server from a known-good image with patched PHP. Cleaning a compromised server in place can leave a backdoor behind.
• Restore data from a backup taken before the compromise and confirm the service works.

Step 5. Post-incident activity

• Set an upgrade date for anything still on PHP 8.1 or older, or record a formal risk acceptance with an owner.
• Compare how long remediation took with the vulnerability management policy, and add any PHP servers the inventory missed. A SOC 2 or ISO 27001 auditor will ask about both.

What are the signs that PHP2Shell was exploited?

No confirmed indicators of compromise (file hashes, IP addresses, domains) had been published by October 22, 2026. Researchers, including Datadog Security Labs and the NCSC-NL and CERT-EU repository, point to behavior instead.

A successful exploit can return HTTP 200 and leave the worker running, so a clean-looking access log alone does not settle the question.

Which design choices contain a PHP2Shell compromise?

PHP2Shell triggers before any application code runs, so logins, input validation and plugin updates play no part in stopping it. Once a worker is taken over, the design around PHP decides how far the attacker gets.

The same choices decide the breach question. A compromised web server that could reach no personal data is a security incident to clean up, while one holding database credentials with broad read access is a likely breach.

Should PHP2Shell be treated as a security incident?

Treat PHP2Shell as a vulnerability to patch and, for any internet-facing PHP server that was unpatched after October 17, 2026, as a security event that needs an investigation. Running the incident response process to answer were we exploited? is the expected control, and it does not by itself mean a breach occurred.

The same facts lead to different answers under different rules:

The second row is the one teams tend to miss. A compromised web server is a security incident for the company, with recovery work and evidence to keep, even if no regulator ever needs to hear about it.

What are my obligations under SOC 2 and ISO 27001 for PHP2Shell?

SOC 2 and ISO 27001 expect a documented vulnerability response and, where exploitation is possible, a documented decision on whether an incident occurred. Neither framework sets a notification deadline.

An end-of-life PHP version with no fix is a risk to record and treat: upgrade, isolate, or formally accept the risk with an owner and a date. The SOC 2 CC7.1 vulnerability management guide, the ISO 27001 A.8.8 guide and the SOC 2 vulnerability risk acceptance guide cover each step.

What are my obligations under GDPR and HIPAA for PHP2Shell?

GDPR and HIPAA apply only if the investigation finds, or cannot rule out, that personal data or protected health information was compromised. An unexploited vulnerability is not a breach under either law, although GDPR Article 32 and the HIPAA Security Rule both expect timely patching as part of keeping systems secure.

HIPAA is broader at the incident stage. Under 45 CFR 164.304, even an attempted unauthorized access is a security incident that the Security Rule expects covered entities and business associates to identify, respond to and document.

Frequently asked questions about PHP2Shell

Is PHP2Shell being exploited?

Exploitation attempts are confirmed. Amazon's honeypots logged an attempt on October 17, 2026, and Cloudflare and watchTowr reported attack traffic on October 21. CISA had not listed either CVE in its Known Exploited Vulnerabilities catalog, and no compromised organization had been named, as of October 22, 2026.

Does a WAF protect against PHP2Shell?

A WAF reduces risk while patching is under way. Cloudflare enabled rules for all plans on October 21, 2026, and other vendors claim coverage, but Cloudflare has seen attackers change payloads to slip past rules. PHP states that patching is the only complete fix.

Is WordPress affected by PHP2Shell?

Yes. PHP2Shell is in PHP itself, so any WordPress, Drupal, Magento or Laravel site running an unpatched PHP is exposed regardless of plugins or application updates. On managed WordPress hosting, the host patches PHP, so ask the host to confirm in writing.

Does upgrading to PHP 8.2.35 fix PHP2Shell?

Yes. PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 fix both CVEs. Restart every PHP worker after upgrading, and rebuild container images, because running workers keep the old code in memory.

Is a PHP2Shell vulnerability on our server a reportable breach?

An unpatched vulnerability alone is not a breach under GDPR, HIPAA or PIPEDA. It becomes one only if exploitation led to personal data or PHI being compromised, which the log investigation decides. It is still a security event to assess and document for SOC 2 and ISO 27001.

What if we run PHP 8.1 or older?

PHP 8.1 and older receive no official release. Upgrade to 8.2 or newer, or confirm that the OS vendor or host has shipped a patched package, and isolate the server from the internet until one of those is done.

A runtime flaw tests the inventory before it tests the patch

PHP2Shell rewards the teams that know where PHP runs, which version each site uses, and who patches it. From a security architecture view, PHP2Shell also tests the design around the runtime: egress, privileges and segmentation decide how far one compromised worker gets. The patch takes minutes. Finding every PHP server, preserving the logs and making a documented call on were we exploited? is where the work is.

If your team needs help scoping the exposure, reviewing logs or making the incident and breach determination, Truvo's incident response team can run it with you and leave you with the evidence your auditor and customers will ask for. The PHP2Shell incident tracker stays updated as vendors publish.

Sources

• PHP advisory GHSA-w8hw-w9fx-j79w, CVE-2026-109618 (October 21, 2026)
• PHP advisory GHSA-6wmf-4rv5-p3rp, CVE-2026-109619 (October 21, 2026)
• Datadog Security Labs, PHP2Shell analysis (October 21, 2026)
• NCSC-NL and CERT-EU, php2shell repository (October 21, 2026)
• Amazon Threat Intelligence, PHP2Shell exploitation before disclosure
• Cloudflare, WAF protections for PHP vulnerabilities (October 21, 2026)
• watchTowr, PHP2Shell FAQ
• Red Hat security bulletin RHSB-2026-013
• AlmaLinux, PHP2Shell patched packages (October 21, 2026)
• NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide
• GDPR, Regulation (EU) 2016/679
• EDPB Guidelines 9/2022 on personal data breach notification
• 45 CFR Part 164 (HIPAA Security and Breach Notification Rules)
• PIPEDA
• Quebec, Act respecting the protection of personal information in the private sector