PHP2Shell (CVE-2026-109618): What to Patch, What to Upgrade, and 10 Jobs to Do Now

On 21 October 2026 PHP shipped emergency releases for PHP2Shell: two critical flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), that let an attacker run code on a server without logging in. Every PHP version from 5.4 to 8.5 is affected, and exploitation attempts were seen days before the fix.

The versions that fix it

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Anything older than these, on any branch, is exposed. PHP 8.1 and older get no patch at all: the only fix is an upgrade to 8.2 or newer, and 8.2 itself stops receiving security fixes at the end of 2026, so 8.4 or 8.5 is the better target.

The stopgap while you patch

Set session.upload_progress.enabled=0 in php.ini. Security researchers are clear that this reduces the risk but does not replace the patch. It also covers CVE-2026-115560, a separate advisory from 23 October that the 21 October releases do not fix, which affects apps that change the session serializer at runtime.

What we did on a real Laravel API

Go Doc is a doctor-on-demand platform first built in 2018 on Laravel 5.7 and PHP 7.1, and modernised in 2026 to Laravel 13 on PHP 8.4. On 24 October we patched it:

• Docker base image pinned to php:8.4.27, so a cached older image can never come back.
• session.upload_progress.enabled=0 and expose_php=Off as defence in depth.
• Verified on the rebuilt container: php -v shows 8.4.27, 110 of 110 PHPUnit tests and 19 of 19 API smoke tests pass.

Full write-up: PHP2Shell patch and PHP upgrades case study.

10 PHP jobs worth doing now

1. Emergency patch: find every server, container and hosting account and move it to a fixed release. 2. Upgrade off PHP 5, 7, 8.0 or 8.1: there is no other fix for these. 3. Laravel upgrades: Laravel 5 to 9 apps are stuck on old PHP; the jump to Laravel 13 is very doable. 4. WordPress and WooCommerce compatibility: test themes and plugins on the new PHP on a staging copy first. 5. Compromise check: look for exploitation signs and web shells, since attacks began before the fix. 6. Pinned Docker images and CI: stop latest tags from quietly keeping you on a vulnerable build. 7. Composer audit: vulnerable packages are as dangerous as old PHP. 8. Server hardening: tighten php.ini and PHP-FPM, hide version headers, separate sites. 9. Leave old shared hosting that cannot offer a patched PHP. 10. Monthly maintenance: the next PHP2Shell will come; someone should be watching.

Sources

PHP security releases of 21 October 2026; advisories from Datadog Security Labs, Palo Alto Networks Unit 42, Google Cloud and watchTowr; The Hacker News on CVE-2026-115560.